Europe’s Sovereign AI Bet Still Runs on Chinese Weights

Mozilla’s September assessment of open-source AI puts the best open model three points behind the closed leader, at 60 against 63. The gap is now small enough that governments talk about owning the weights rather than renting an API. Most of the weights that actually move live traffic still come from Chinese labs that do not publish a full data recipe.

Britain is training a from-scratch model for air-gapped rooms, and Switzerland already released weights, data, and training code. Those projects are real, and they are not where the tokens are.

The Best Open Model Trails by Three Points

Mozilla’s v1.1 report, with data through 1 September 2026, scores Moonshot’s Kimi K3 at 60 on the Artificial Analysis Intelligence Index v4.1.1. Anthropic’s Claude Opus 5 leads at 63.0. Claude Fable 5 sits at 62.1, so the best open model is two points behind Fable 5 at 30% of that model’s list price, and at 60% of the closed leader’s price.

Four of the top ten entries on that snapshot are open: K3, Z.ai’s GLM-5.3 (also 60), Alibaba’s Qwen 3.8, and GLM-5.3 Flash. Mozilla’s fit on METR time-horizon data puts the open-to-closed lag at 4.4 months, with open capability doubling about every 3.9 months against 5.5 for closed systems. Inference list prices have fallen about 60 times in 45 months.

HOW THE TOP MODELS SAT ON 1 SEPTEMBER

The jagged bit is the work, not the headline score. K3 led LMArena’s Frontend Code Arena at 1679 Elo and sits at 88.3 on Terminal-Bench 2.1 against 88.8 for GPT-5.6 Sol. Fable 5 still leads K3 by 92 Elo on GDPval-AA v2, the expert-graded knowledge-work test, which is where polish and long-context fidelity still sit with the closed labs.

For the jobs most builders actually ship, Mozilla’s CTO Raffi Krikorian wrote in the July launch of the series that the data no longer says promising. It says ready. The September cut does not walk that back. It just names who got ready first.

Seven of Eight Busy Open Models Are Chinese

On OpenRouter, which routes production traffic rather than demo queries, August 2026 was the first month an open model led weekly text requests. DeepSeek took that slot on 3 August after Google had held it for 51 weeks. Eight of the top ten models by token volume that month were open-weight. Seven of the eight were Chinese-built. Chinese models’ share of routed tokens peaked at 46%.

WHERE OPENROUTER TRAFFIC ACTUALLY WENT

• Request lead: DeepSeek passed Google on 3 August 2026, the first open-model week at number one on that series.
• Token top ten: Eight of ten models by August volume were open weights, seven of them from Chinese labs.
• Peak share: Chinese models accounted for as much as 46% of routed OpenRouter tokens.
• Hub gravity: Nvidia’s agreed purchase of Hugging Face, signed 3 September 2026, is listed in Mozilla’s capital census at $12.93 billion, which puts the main public square for those weights under a chip vendor.

That is the Android-shaped split without needing the metaphor. The files you can download and run are cheap and good enough for a huge share of tokens. The invoice for the hardest remaining work still goes to a closed US lab. Stripe’s agreed purchase of OpenRouter, announced 19 August 2026 and listed by Mozilla at about $7.5 billion, moves the routing layer the same way: up, away from the model file itself.

European labs are not absent from the table. They are not in that top-eight traffic pack. Mistral appears further down the capability list, and Mozilla flags that Mistral Medium 3.5 uses a modified MIT licence with a revenue carve-out, which is a reminder that a downloadable file is not the same as a licence you can take to a bank.

Open Weights Still Fail the Recipe Test

Mozilla checked sixteen notable open releases against the Open Source Initiative’s test. None shipped the data recipe that definition asks for. “Open weights” in the report means a file you can download unless the page says otherwise, and the page usually does not say otherwise.

The complete description of all training data is the piece that lets a skilled team rebuild a substantially equivalent system. Without it, you can run the model, fine-tune it, and even air-gap it. You cannot audit how it was made, and you cannot train a twin from the same mix when the vendor changes terms.

WHAT COUNTS AS OPEN SOURCE AI

• Data information: Provenance, scope, how the data was obtained and filtered, plus lists of public and third-party sources, under OSI-approved terms.
• Code: The full training, filtering, validation, and inference stack, not a summary card.
• Parameters: Weights and related settings, including intermediate checkpoints where they exist, also under OSI-approved terms.

SlashData fielded Mozilla’s developer survey. Álvaro Ruiz Cubero said the production gap “indicates that there is not an issue purely of model quality, but of missing infrastructure,” and that buyers now put licensing terms (31%) and ownership (26%) ahead of raw capability. The survey’s professional-developer cut is 954 people. Seventy-nine percent use open models, 71% use closed ones, and 50% use both, so the typical shop is already mixing, not converting.

Hugging Face, in the accompanying letter to the report, is credited with 2.5 million public models, 13 million users, and roughly a third of the Fortune 500 on the platform. That is a lot of files. It is not a lot of recipes.

Britain Is Training Lumen on Isambard-AI

The UK’s answer is not a fine-tune of K3. London-based Cosine is building Lumen Sovereign from scratch on Isambard-AI in Bristol, using compute from the government’s £500 million Sovereign AI programme. Cosine was named in the first cohort on 16 April 2026, alongside Prima Mente, Cursive, Doubleword, Twig Bio, and Odyssey, with Callosum taking the unit’s first equity cheque. The programme can put up to 1 million GPU hours behind a startup; Cosine’s published Lumen plan is a 500,000 GH200 GPU-hour compute budget on a 256k-context sparse mixture-of-experts design.

About one-third of that compute is aimed at software engineering, including the COBOL, Fortran, and Ada still sitting under British defence and finance. The other two-thirds is aimed at cybersecurity tests, KYC and AML investigations, and clinical-trial coordination. Deployment inside a customer’s own rooms, including air-gapped sites with no external transfer, is targeted for late 2026. Because those rooms have to hold the weights, API-only vendors are out of the deal by design.

The Coalition Signed Design-Phase Deals

On 8 June 2026 Cosine published memorandums of understanding with 13 organisations: BAE Systems, Babcock International Group, BT, Era4, HSBC, Leonardo, Lloyds Banking Group, LSEG, NatWest Group, PwC, Telefónica Tech UK&I, Thales UK, and the Alan Turing Institute. Mozilla records those as design-phase agreements, not purchase commitments. The banks and primes are helping write the requirements. They have not, on the public record, ordered the model.

LUMEN’S PUBLIC DATES

1. 16 April 2026: The Department for Science, Innovation and Technology names Cosine in the first Sovereign AI compute cohort.
2. 8 June 2026: Cosine announces the 13-organisation coalition at London Tech Week.
3. Late 2026: Target window for air-gapped deployment inside customer infrastructure.

Yang Li, Cosine’s co-founder, said on the April announcement that “the model itself trains on sovereign infrastructure, and Britain stops renting its AI future from abroad in the sectors where capability, security and national control cannot be outsourced.” Technology Secretary Liz Kendall called the unit a bet so founders “never have to choose between your ambition and your home.” The hardware those words sit on is still a public supercomputer, and the customers are still in the design room.

Vendor lock in creates security risk, dependency risk and cost escalation risks. Cosine is addressing those risks by building a model that is fully trained on UK soil and available into air gapped environments at a far more efficient price point than OpenAI and Anthropic alternatives.

Alistair Pullen, CEO and co-founder, Cosine, 8 June 2026 coalition note

That is a serious product for a regulated buyer who cannot send a prompt to Virginia. It is also a 500,000-hour training run, not a closed-lab pretraining campaign. “Frontier” is the word in the press note. The compute budget is the constraint in the prospectus. Mozilla also notes Cohere’s plan to roughly triple its UK office as a second signal that on-prem demand in Britain is growing even while Lumen is unfinished.

Open Models Take 4% of the Revenue

The SlashData survey found that 51% of open-model users have reached production, against 63% for closed models, a 12-point gap that barely moves as companies get larger. Mozilla reads that as tooling and trust, not scoreboard performance. Cost and compliance are not what leavers name first. Maintenance, hosting, and the lack of someone to call are.

THE USAGE AND REVENUE SPLIT

• Developer reach: 79% of professional developers in the survey use open models; 29% use open only, 21% closed only.
• Production: 51% of open-model users have deployed in production, versus 63% for closed models.
• Model-layer take: Open models took 4% of OpenRouter model-layer revenue from May to September 2025, against 96% for closed providers.
• Linux Foundation figure: About $24.8 billion in unrealized annual savings from that price gap, in the paper Mozilla cites.

So the traffic can migrate without the money migrating. Closed labs keep the high-price, high-regret jobs. Open weights take the high-volume remainder, and they often burn more tokens to finish the same task, which eats some of the sticker discount. That is why a ministry can wave a sovereignty strategy and still find, at the procurement desk, that the model it wants to run for free is a Chinese file it cannot reproduce, and the model it wants to hold liable is an American API it cannot air-gap.

Krikorian put the same production problem in public on 17 September 2026, when Mozilla and Montreal’s Mila announced a foundation layer backed by an initial $5 million from the Canadian government, with working reference implementations promised within six months.

79% of developers reach for open models. only 53% of teams ever get one into production.

today @Mila_Quebec & @mozilla announced an open source AI foundation layer at ALL IN to help close that gap. this is local ownership, local control, no landlord. a layer that belongs to the…

— Raffi Krikorian (@raffi) September 17, 2026

Own the stack, he wrote, don’t rent it. The survey still says most teams that reach for open files never get them into production. Canada’s cheque is aimed at that hole. It is not a European frontier model.

Switzerland Published the Recipe Others Skipped

The report’s own opening letter uses Switzerland as the rare case that did the whole job. A public consortium trained a national model on public supercomputers and released the weights, the data, and the training code. That project is Apertus, built by EPFL, ETH Zurich, and the Swiss National Supercomputing Centre on the Alps machine in Lugano, and first released on 2 September 2025.

Apertus shipped at 8 billion and 70 billion parameters, trained on 15 trillion tokens across 1,811 languages, with about 40% of the mix outside English, under Apache 2.0. The team published data-prep scripts, checkpoints, eval suites, and training code. On 17 September 2026, ETH said Proton would put Apertus 1.5 inside Proton’s Lumo assistant, a Swiss privacy chatbot, and feed user signal back to the lab.

That is actual ownership in the OSI sense. It is also a 70-billion-parameter public model, not K3. The report’s other postcard from the field is a Māori broadcaster training speech models under a licence that keeps the recordings with the communities that made them, and a cassava-leaf diagnostic small enough to run on a phone with no signal. None of those teams asked a US lab for permission. None of them is filling OpenRouter’s top ten.

Western Europe is one of only two regions in Mozilla’s survey where closed models still run ahead of open ones. The builders are here. The default production path, for shops that do not have a national supercomputer and a public consortium, is still a download from a Chinese lab or a call to a closed US endpoint. The “opportunity above the model” that the report sketches for European firms, in orchestration, compliance, and on-prem tooling, is the unglamorous work of making other people’s weights behave inside a regulated network. It is also the layer Nvidia and Stripe just paid billions to sit on.

What the EU AI Act Counts as Systemic Risk

The Act still uses training compute as a stand-in for danger. A general-purpose model is presumed to have high-impact capabilities, and therefore systemic risk, when cumulative training compute exceeds 10^25 floating-point operations. Providers then pick up extra duties: adversarial tests, Union-level risk work, incident reporting, and cybersecurity around the model and its physical kit. The Commission can move that threshold by delegated act as the hardware and the algorithms change, and it can designate a model even when the FLOP count is lower.

Mozilla’s warning is that sparse mixture-of-experts models now reach similar scores with less raw compute, so two systems that behave alike can fall on different sides of the line. Open source is not a blanket pass. A company that substantially adapts an open model for hiring, credit scoring, or medical diagnostics can become the provider on the hook. GPAI duties have been in force since 2 August 2025, with full Commission enforcement from 2 August 2026, including fines.

Forty-seven countries already restrict foreign processing for critical workloads, in the July companion figures, and 12 national AI strategies launched in the year before that first report. The policy fashion is local control. The traffic fashion is Chinese open weights. The revenue fashion is still a closed US invoice.

Lumen is supposed to be inside customer rooms by the end of 2026, held as weights those customers own. Apertus is already inside a Swiss assistant that millions of Proton users can switch on. The files that set the open-model pace on 1 September were K3 and GLM-5.3, and the recipe for both remains with the labs that trained them.