CAISI vs NTIA: Open-Weight AI Playbooks

No — they can't, on the dates involved. NTIA's report was published July 30, 2024, more than a year and a half before GLM-5.2 (June 2026), Kimi K3 (July 2026), or GLM-5.3 (August 2026) existed. NTIA's report is a standing policy framework meant to apply to open-weight models generally, including ones released long after it, not a review of any named model.

No. The report's own language is explicit that it does neither: “current evidence is not sufficient to definitively determine either that restrictions on such open weight models are warranted, or that restrictions will never be appropriate in the future.” It sets up a process for revisiting that question — collect evidence, evaluate it, act if warranted, stay flexible — rather than answering it either way in 2024.

Neither directly, on the public record. CAISI (created within NIST in 2025) and NTIA are both Commerce Department components, and CAISI's per-model cyber assessments are exactly the kind of technical “evidence collection” NTIA's 2024 framework calls for in its first phase — but CAISI's assessments themselves don't cite NTIA's report, and NTIA's report predates CAISI's 2026 assessment cadence by nearly two years. Treat them as two separate outputs of the same department's broader open-weight-model posture, not a documented pipeline from one to the other.

No, and this page doesn't claim one exists. NIKOLAI's N1 track defines a Coverage scope threshold element — the if-then test deciding whether a framework applies to a given model — and its live crosswalk maps eleven labs, statutes, and proposals (Anthropic, OpenAI, the EU AI Act, SB 53, the FRONTIER Act, and others) against that element. None of those rows is NTIA's report, and none currently exists for it: NTIA's framework sets a process for deciding whether to regulate, rather than a scope test with a specific compute or revenue threshold that a NIKOLAI crosswalk row is built to record.

Yes — a real, live one. NIKOLAI's N1 track includes a Risk domain element (the top-level category of catastrophic harm a framework's evaluations are organized around), and its crosswalk already carries a shadow-mapped row for the US Government/CAISI reading it as narrow-scope: “advanced cyber capabilities” only — unlike Anthropic, OpenAI, or the EU AI Act, which each name three to four domains (CBRN, cyber, loss of control, harmful manipulation). That's CASRAI's own independent, unendorsed reading of CAISI's public assessments, not a mapping CAISI has filed or endorsed itself — but it is a specific, checkable claim, not an invented one.

University labs that train and openly release model weights already route that release decision through their institution's export-control/research-security office before publication — not through NIST or NTIA. That review turns on the same public-availability logic NTIA's 2024 report examines: technology and software that qualify as "published" or "publicly available" generally sit outside export-licensing requirements, and research-security offices apply the closely related Fundamental Research Exclusion when clearing a lab's intent to publish code, results, or model weights openly. A research-security officer deciding whether to greenlight release of a university-trained open-weight model is, at smaller scale, making the same call NTIA's framework poses.