On September 7, 2026, DCMS and DSIT published an independent University of Greenwich review of cybersecurity evidence for open-source software and open-source AI. The study screened 14,561 academic records, retained 43 high-relevance studies and reviewed 172 grey-literature records, supported by GitHub and Hugging Face analysis.

It identifies inconsistent definitions and major upstream-governance gaps involving training-data provenance, model lineage, model-weight integrity, fine-tuning history and distribution security.

The report recommends UK working definitions that distinguish fully open, open-weight and partially open systems; wider and more consistent use of Software Bills of Materials; development of an AI Bill of Materials covering provenance and known vulnerabilities; engagement with platform operators on documentation, contributor verification and integrity validation; and UK participation in ISO/IEC JTC 1/SC 42 and ETSI standardisation.

The report is an evidence and policy-recommendation document only and explicitly does not represent UK government policy or impose mandatory requirements.

Impact

Impact assessment: Low.

Key reasons: the report has no binding legal effect, but it is government-commissioned evidence that may shape future UK cybersecurity policy, procurement expectations and international standards for open-source AI.

Who is affected?

OSS and AI developers, model distributors, repository platforms, regulated-sector adopters, software suppliers and policymakers.

Conclusion:

no immediate compliance action is mandated; organisations should monitor whether the proposed definitions, SBOM/AI BoM concepts and platform-governance measures enter future policy or standards work.