Microsoft and NVIDIA issue open-weight model risk taxonomy for enterprises
Microsoft and NVIDIA publish joint guidance grouping open-weight model risks into five categories and mapping selected risks to evaluations, with agent and runtime guidance planned.
The joint whitepaper classifies model risks across five categories and maps them to evaluations. Runtime, agent-harness and application guidance is planned, not part of this initial release.
Microsoft and NVIDIA published an open-weight model risk taxonomy for enterprises on 16 October 2026, giving organisations a common way to classify risks and select evaluations before deploying AI models. Their joint paper, Risk Management for Open-Weight Models in Enterprise, focuses on the model layer rather than claiming to assess complete AI applications or autonomous agents.
In Microsoft’s official announcement, the companies said the guidance builds on established standards, including the NIST AI Risk Management Framework and ISO standards. It is an industry whitepaper, not a new regulation, certification scheme or mandatory security baseline.
Five categories organise model-level risks
The taxonomy groups risks into Cybersecurity, Data Protection, Content, Human-AI Interaction and Bias. These categories cover concerns such as model misuse, disclosure of sensitive information, unreliable outputs and unequal treatment. Companies are expected to adapt the categories to their own workloads rather than apply a universal checklist.
NVIDIA’s accompanying research post draws a distinction between a model that drafts a report and the same model connected to tools that can retrieve files, execute code and send emails. The second deployment introduces operational risks that cannot be measured by evaluating the model’s responses alone.
Evaluations help connect risks to controls
The joint paper maps evaluations to selected risks across the five categories. Teams can identify which failures matter in a particular deployment, run relevant tests and record the results alongside mitigations and remaining gaps. Microsoft cites Foundry evaluations, automated red teaming and content-safety controls as possible tools, subject to their availability for the chosen model and configuration.
The companies say model provenance, intended use, users and deployment conditions all affect the assessment. Access to downloadable model weights does not itself determine whether a system is safe. Safeguards may sit in model configuration, access controls, filtering, monitoring or human review.
Additional system-layer guidance remains planned
Microsoft and NVIDIA have also published a jointly maintained repository containing the paper, taxonomy and evaluation resources. Both companies plan to expand the materials as risk categories and testing methods change.
This first release mainly addresses model risks. Future publications are intended to cover the runtime, agent harness and application layers, including how tools and permissions influence agent behaviour. The paper does not claim that evaluating an open-weight model alone demonstrates the security of the system built around it.