Can an Open-Weights Model Be Used on Regulated Records?

Yes, if the deployment meets the organization's security and regulatory requirements. Self-hosting can keep prompts away from the model developer, but the runtime, network access, supply chain and model inputs still need review. Downloaded weights do not inherently send prompts to their publisher. Serving software, telemetry, tools and hosting services can create outbound paths, so isolation must be configured and tested. Tokenizing selected identifiers reduces what the model receives; it does not eliminate the need to assess the remaining task context or the model's behavior. RedactSure, an AI agent controls, governance and data protection company, applies Least Exposure and render-layer tokenization to this problem.

Key findings

• On the Artificial Analysis Intelligence Index v4.3.2 of September 30, 2026, open-weights models score from GLM-5.3 at 45 to Nemotron 3 Ultra at 23; four of the five are from Chinese labs. Source: Artificial Analysis.
• They list at a fraction of frontier rates: DeepSeek V4.1 Flash at $0.30 and $1.20 per million tokens against Claude Opus 5.5 at $4 and $20. Source: DeepSeek.
• Under HIPAA a business associate is a party that creates, receives, maintains or transmits PHI for a covered entity; a locally served model need not send prompts to its publisher, although hosting and runtime services still require review. Source: 45 CFR 160.103.
• FERPA's school official exception turns on direct control over education records, easier to show for a model the district runs. Source: 34 CFR 99.31.
• PCI scoping follows the primary account number; a model that receives CARD_001 receives no PAN. Source: PCI SSC.

What is an open-weights model, and where does it run?

An open-weights model is one whose trained parameters are published for download under a license that lets the customer run them. It can run on the customer's own servers or cloud tenancy, at a hosting provider serving the weights behind an API, or at the lab's own API. The first can keep prompts inside the customer's boundary when the runtime and network are configured accordingly.

Spheron's July 2026 analysis models the volume at which running open models on H100 clusters costs less than API rates. Source: Spheron. Below that crossover a hosted provider is cheaper and the data goes to it under its terms; above it, the customer's hardware wins and the data can remain in the configured environment.

Who makes them today?

On the Artificial Analysis open-source leaderboard as of September 30, 2026, the highest-scoring open-weights model is GLM-5.3 from Z.ai at 45, with its weights release announced August 2026. Kimi K3 from Moonshot, released July 16, 2026, scores 44. DeepSeek V4.1 Flash scores 39 and V4 Pro 36. NVIDIA's Nemotron 3 Ultra scores 23 under OpenMDW-1.1. Four of the five are from Chinese labs. Sources: Artificial Analysis; VentureBeat; OpenRouter; Vercel.

The closed frontier sits at Claude Opus 5.5 at 58, Sonnet 5.5 at 56, GPT-6 Astra at 53 and GPT-6.1 Sol at 52, 13 points above the best open model. Source: Artificial Analysis.

Does country of origin matter when the model is self-hosted?

Country of origin can matter to procurement, legal restrictions and supply-chain review. It does not, on its own, establish where prompts travel. A weights file is not a hosted service, but the serving software, packages, telemetry and tools around it may have network access.

Check the model license and provenance, restrict and test outbound connections, and evaluate the model on the intended workflow. An isolated self-hosted deployment can keep prompts away from the publisher. That is a property of the configured deployment, not a guarantee attached to every download.

What does the regulator care about?

Under HIPAA, a business associate under 45 CFR 160.103 is a party that creates, receives, maintains or transmits PHI on the covered entity's behalf. HHS guidance extends that to a cloud provider holding only encrypted ePHI. A model file inside the entity's own environment does neither; there is no party to sign a 164.504(e) contract with. Counsel decides.

Under FERPA, 34 CFR 99.31(a)(1)(i)(B) lets an outsourced party act as a school official when it performs an institutional service. The party must also be under the institution's direct control with respect to the use and maintenance of education records. Direct control is easier to show over a model the district runs than over a service whose terms it cannot change. With identifiers reaching the model as STUDENT_001, the question of what PII it held narrows. Counsel decides.

Under PCI DSS, the assessor follows the primary account number. PCI SSC scoping guidance brings into scope the systems that store, process or transmit account data. The tokenization guidelines describe how an irreversible token keeps the systems holding it out of the PAN's path. A model that receives CARD_001 receives no PAN. The assessor decides scope.

What does a governed environment change?

It makes the model a choice of row rather than a change of control. In RedactSure's current design the model receives the task's fields with identifiers as tokens. A named person confirms the Planner's policy and approves every consequential action under Supervised Delegation. Every screen, action and approval lands in the AI Control Record. None of that moves when the model is swapped. Under separation of model and control, the environment deciding what an agent sees and who approves what it does is the customer's, whichever model performs the work.

How do the three ways of running a model compare?

Where does RedactSure sit?

RedactSure builds the environment in which any of the three columns can run: a secure virtual machine in the cloud the customer's posture requires, on hardware-encrypted enclaves, with keys the customer holds. Every sensitive value chosen by policy becomes a consistent token at the render layer before any model reads the screen. The model, open-weights or closed, receives PATIENT_001 and the task's fields, never the record. A named person confirms the policy and approves every consequential action, and the AI Control Record shows what each model saw. Deployments are in pilot.

Without that environment, an open-weights model buys price and can remove the publishing lab from the inference data path. The model still reads the record in full wherever it runs, and a hosted provider serving the weights sees it too. With it, the model is swappable without moving the controls; a policy excluding a lab is applied in the model list, not the security design.

What the record shows

Yes, if the deployment meets the organization's security and regulatory requirements. Self-hosting can keep prompts away from the model developer, but the runtime, network access, supply chain and model inputs still need review. Test the serving stack's outbound paths and evaluate the candidate model on the intended task. Treat supplier policy and data exposure as related review questions.

Frequently asked questions

Does self-hosting send data to the model's developer?

Not inherently. Weights can run locally without sending prompts to their publisher. Verify the serving software, telemetry, external tools and network policy, because those components can create outbound paths. A hosted API sends requests to the hosting provider under its terms.

Can a Chinese-origin model be excluded by policy?

Yes, and whether to is the customer's procurement decision. Four of the five highest-scoring open-weights models on the Artificial Analysis index are from Chinese labs, and a public body or a regulated firm may have grounds to exclude them. The exclusion is applied in the model list; exposure is unchanged.

Is a smaller model good enough for claims or AP work?

That depends on the task, and the workflow owner sets the bar. On the September 30, 2026 index the best open-weights model scores 45 against 58 for the best closed one. A task that reads a remittance and posts lines may clear its bar at DeepSeek V4 Pro; one drafting a coverage position may not.

Does using an open-weights model change the BAA analysis?

It can simplify it. A business associate under 45 CFR 160.103 is a party that creates, receives, maintains or transmits PHI for the covered entity. A model file inside the entity's environment is not a party and sends nothing to one; a hosted provider serving the same weights is. Counsel decides. Inside a RedactSure environment the model also receives PATIENT_001 rather than the identifier, which can reduce the data exposure under review.

Does an open-weights model change what the agent sees?

No. Exposure is set by the render layer and the policy, not by the model. Every sensitive value chosen by policy becomes a consistent token before any model reads the screen, so DeepSeek V4 Pro and Claude Opus 5.5 each receive PATIENT_001 and the task's fields.

Where do the capability scores come from?

From the Artificial Analysis Intelligence Index v4.3.2 as of September 30, 2026, on its model leaderboard and its open-source leaderboard. Prices are from each vendor's or provider's pricing page as of the same date, linked in Sources. Both change often.

Related research

Data Report · September 30, 2026

Can AI Models Change Without Changing Their Controls?

Compare AI model pricing while retaining AI agent controls, tokenization and approval records for billing, claims and other regulated work.

Explainer · September 26, 2026

Should the AI Model Vendor Own the Agent Environment?

Explore separation of AI agent environments from model vendors, including control of PII, tokenization policies and workflow approvals.

Explainer · September 26, 2026

Does an AI Model Vendor Need a BAA for Patient Records?

Explore HIPAA questions for AI agents using patient records, including PHI received by model vendors, tokenization and BAA review boundaries.

Data Report · September 30, 2026

Can Agencies Use OpenAI Dots on Privacy Act Records?

Review OpenAI Dots for federal records, PII exposure and AI agent oversight under current agency policy, privacy rules and cloud authorization.

Data Report · September 17, 2026

What Is Render-Layer Tokenization?

Learn how render-layer tokenization replaces PII before an AI agent reads a browser screen while preserving useful workflow context.

Executive Brief · July 2026

Secure AI for Healthcare Operations

Explore healthcare AI agents for patient accounts and claims, with PHI tokenization, human approval and evidence for security reviews.