The transition of large-scale artificial intelligence(AI) models from closed-source to open-source architectures has given rise to a new generation of open-source foundation models exemplified by DeepSeek, LLaMA, and others, and they demonstrate pronounced advantages in openness, transparency, and customizability. These advantages help overcome key limitations inherent in closed-source models, including algorithmic opacity and high deployment costs, thereby revealing broad application prospects and significant practical value. Nevertheless, the technological shift from closed to open source has also reshaped the underlying risk landscape. The application risks of open-source large models have undergone notable transformations in their external manifestations, diffusion pathways, and controllability. Specifically, open-source models, their supply chains, and associated training data become more susceptible to low-barrier attacks; intellectual property infringement risks grow increasingly salient and complex; and the risk of model misuse or deviation from intended purposes may be amplified at scale as developer control becomes more diffuse. These developments underscore the necessity of establishing a governance approach tailored to the unique risks of open-source large models.
Employing normative analysis, comparative analysis, and related research methods, this study first examines the existing governance arrangements for open-source large models and identifies their structural limitations. It then introduces the concept of embedded governance into the domain of open-source AI governance and, drawing on the distinctive risk characteristics and governance needs of open-source large models, constructs a dedicated theoretical framework. Building on this framework, the study proposes a governance system specifically designed for open-source large models.
The findings indicate that current governance practices continue to rely predominantly on traditional “command-and-control” external regulatory models, which are ill-suited to addressing the dynamic and evolving risks associated with large AI models and are unable to balance risk mitigation with innovation incentives. In essence, the open-source model depends on global collaborative participation and derives its vitality from mechanisms of collective knowledge production and iterative technological advancement. Consequently, the governance of open-source large models should be aligned with the operational logic of open-source ecosystems. Rather than imposing predominantly external controls, governance mechanisms should be deeply embedded within the ecosystem itself, thereby fostering an endogenous and collaborative governance paradigm. To this end, the proposed shift from external regulation to embedded governance involves developing a theoretical framework across three dimensions-organizational embedding, institutional embedding, and technical embedding, which are grounded in existing embedded governance theory and adapted to the risk profile of open-source large models. This framework enables governance mechanisms to be integrated into the internal dynamics of the open-source ecosystem, activating its inherent capacity for self-regulation. Guided by this theoretical model, the study further proposes a progressive governance structure characterized by the interaction between "open-source ecosystem self-governance" and "government oversight". Through this structure, governmental authority is incorporated into open-source self-governance networks to facilitate co-governance, while institutional norms and technical tools appropriate for the open-source context are simultaneously embedded. The resulting governance system is capable of responding adaptively to emerging risks while promoting open-source innovation.
By developing an embedded governance system tailored to the risk characteristics of open-source large models, this study extends the application of embedded governance theory and provides an effective response to the governance challenges arising from the shift from closed-source to open-source AI. The proposed governance system incentivizes active self-regulation by industry associations, foundations, and open-source communities, harmonizes the relationship between ecosystem autonomy and governmental regulation, and achieves a more effective balance between risk management and innovation incentives. This research offers a theoretical foundation for the safe governance of open-source artificial intelligence in China and holds substantial significance for advancing the orderly development of the open-source ecosystem.