Hanad KubatVisit Website →
← Back to blog

Open Source vs OpenAI: How to Choose for Your Product

October 26, 2026
Open Source vs OpenAI: How to Choose for Your Product

For most startups and small businesses, the honest answer is to start with a hosted OpenAI model and move to an open model only when a specific constraint forces it: data that cannot leave your infrastructure, a per-token bill that has become a line item, or a narrow task where a small model is good enough. The comparison is also less clean than the keyword suggests. "Open source" has a strict definition that most popular models do not meet, and OpenAI itself now ships some open-weight models.

I am Hanad Kubat, a senior software engineer in Vienna. I build AI features and first versions of software products at a fixed price, so I get this question from founders before they have written any code. Below is how I think about it, with the evidence I trust and a test you can run in a week.

Hanad Kubat
Build AI Into a Working Product
Turn your AI approach into a working product with a fixed-price build, fixed scope, and code you own from the first commit.
Visit Hanad Kubat

Key takeaways

  • "Open source" and "open weight" are different things. Most models people call open source only publish the weights, not the training data or full code.
  • OpenAI is not purely closed: it has released open-weight models, but its strongest models are available only through its API.
  • Closed frontier models still lead on the hardest tasks. Open models are close on narrower ones and can be much cheaper when small enough to self-host.
  • The real cost of self-hosting is infrastructure and engineering time, not the model download.
  • Decide with your own data: build a small evaluation set from your real workflow and run both options against it.

Table of Contents

What "open source" actually means for AI

The Open Source Initiative defines an Open Source AI system as one that grants the freedoms to use, study, modify and share it. To get there, the preferred form for modification includes information about the training data, the complete source code, and the model parameters. That is a high bar.

Most of what the market calls open source falls short of it. An open-weight model gives you the trained parameters, so you can run it and fine-tune it, but not necessarily the data or the training code. PBS NewsHour's explainer notes that many developers believe a fully open-source model must also include the source code and training data.

The distinction matters for research as much as for definitions. Stanford HAI argues that withholding data and code closes off research into how models pick up cultural assumptions or fairness problems, and it points to a wide gap between open-weight and truly open-source AI. For a business buyer the practical reading is simpler. Three categories exist:

CategoryWhat you getTypical use
Closed (API only)Access to a hosted model, billed per tokenFastest start, strongest models
Open weightDownloadable parameters, often with a licenseSelf-hosting, fine-tuning, data control
Open source (OSI sense)Weights, code and data informationResearch, full auditability

When someone says "open source vs OpenAI" they almost always mean the second row against the first.

Is OpenAI open source?

No, but it is not entirely closed either. In its comment to the NTIA on open model weights, OpenAI describes a staged release for GPT-2, GPT-3 delivered through its API, and later weight releases for models including CLIP and Whisper. It also argues that API delivery makes it easier to respond to misuse, and says that it and Microsoft used that visibility to detect, study and disrupt malicious activity that would not have been possible if frontier weights had been widely released.

Then in August 2025 OpenAI released gpt-oss-120b and gpt-oss-20b, two open-weight reasoning models under the Apache 2.0 license, built to run efficiently on modest hardware. So the choice is no longer "OpenAI or open source". You can use OpenAI's hosted models, or OpenAI's own open-weight models, or models from other labs. If you want the wider context on how big the hosted side of that business has become, there is a summary of OpenAI revenue and usage statistics.

The frontier models, the ones you use through the API, remain closed. That is the real fork.

Is OpenAI open source? — overview diagram

Capability: how big is the gap?

Closed frontier models still win at the top end. The UK AI Security Institute's analysis, summarized in a Cloud Security Alliance research note, found that on the cyber tasks it assessed, frontier closed models performed best on the hardest tasks. Leading open-weight models trailed them by four to seven months on offensive cyber tasks, and were comparable on some narrow tasks.

Two cautions follow. First, that is a security benchmark, not your product. Your workflow might be extracting fields from invoices, answering questions over a knowledge base or classifying support tickets, and a smaller model may do that perfectly well. Second, benchmark numbers travel badly. One public agentic-coding benchmark write-up found open-weight results on SWE-bench Verified can fall below self-reported figures and depend heavily on the scaffold wrapped around the model. I treat that as a hint, not evidence. The lesson is the same either way: never choose from a leaderboard alone.

My rule of thumb: if the task needs long multi-step reasoning, reliable tool use or strong handling of messy input, start with a closed frontier model. If the task is narrow, repetitive and easy to check, an open model is a serious candidate.

Cost: tokens versus infrastructure

The two options bill in different units, so the comparison is easy to get wrong.

  • API: you pay per token. Cost scales with usage and is close to zero when nobody uses the product. I wrote a separate piece on what changes between OpenAI Enterprise and the plain API before a pilot.
  • Self-hosting: you pay for GPUs or a managed inference host, plus the engineering to keep it running. Cost is mostly fixed, so it only wins when utilization is high.

Published benchmarks give a feel for the range. Fin's research on the cost of serving LLMs found that self-hosting small-to-medium open-weight models, under roughly 30B parameters, can be significantly more cost-effective than commercial APIs, while larger models need optimized hardware and serving engines to get anywhere close. The Tokenando index adds that smaller models under 14B parameters were notably cheaper to serve than GPT-4.1 mini, while larger ones can cost as much as or more than provider models. It also notes that frontier closed models have no like-for-like self-hostable equivalent, so a price comparison is also a capability comparison.

The AISI figures show how extreme it can get on a heavy agentic workload: a 100-million-token autonomous attack run cost roughly $1.19 on DeepSeek V4-Pro against about $85 on Anthropic's closed models, per the same CSA summary. A gap that size is worth taking seriously at high volume. It does not account for the engineer who has to run the thing.

A worked way to think about it

Take a support-triage feature that processes 50,000 short tickets a month. On an API, that is a small, predictable bill and zero servers. Self-hosting means renting GPU capacity continuously, setting up monitoring and autoscaling, and being on call when it falls over. At that volume the API is almost certainly cheaper in total cost, once you count your own time. Now multiply the volume by a hundred, or run a long-context agent all day, and the arithmetic flips. Do this calculation with your numbers before you commit.

Privacy, licensing and control

Control is the strongest argument for open weights. Self-hosting lets you keep prompts and documents on your own infrastructure, remove vendor-side monitoring and tune the model on your data. The same CSA note points out the flip side: removing that monitoring also removes the safety guardrails the API provider imposes, and the assessment is that cheaper, closer-to-frontier self-hosted models call for different governance than monitored APIs. In a business setting that means you now own abuse prevention, logging and incident response.

What to check before choosing either path:

  1. Training on your data. Read the provider's current data-usage terms for the exact product you will use. API and consumer ChatGPT plans have not always been treated the same way, so confirm it for your plan instead of assuming.
  2. License terms. "Open weight" does not mean unrestricted. Some licenses limit commercial use above a revenue threshold or require reviews for certain service businesses. Apache 2.0, used for gpt-oss, is permissive. Read each model's license.
  3. Where data goes. If you serve EU customers, the hosting region, subprocessors and a data protection impact assessment matter more than the model's brand. My guides on GDPR for AI and an AI DPIA template cover the fields to fill, and the EU AI Act checklist covers the regulation side.
  4. Rate limits and availability. Hosted APIs throttle you. If that worries you, see how to check, handle and raise OpenAI rate limits.

If you handle medical, legal or financial client data, talk to your data protection officer or counsel before sending anything to any third-party model, open or closed.

When each option makes sense

This is the part nobody can answer from a benchmark, so here is how I decide for small teams.

Choose OpenAI's hosted models when:

  • You are pre-product-market-fit and speed matters more than unit cost.
  • The task needs strong reasoning or reliable tool calling.
  • You have no one who wants to run GPU infrastructure.
  • Volume is low or unpredictable.

Choose an open-weight model when:

  • Data must stay inside your own environment for contractual or regulatory reasons.
  • The task is narrow and a fine-tuned small model can match a large one.
  • Volume is high and steady enough to keep hardware busy.
  • You need to avoid dependence on a single vendor's pricing and limits.

Do both when: a cheap open model handles the bulk of routine requests and a frontier model takes the hard cases. This routing pattern is common in mature products. It is a second-phase optimization, not a day-one architecture.

For most founders I talk to, the first version belongs on an API. You can swap the model later if the code is built so that the model sits behind one interface. That is a design decision worth making in week one, and it costs almost nothing.

One interface routing to interchangeable model backends

How to test both on your real workflow

A one-week test beats a month of reading comparisons. Fin's published benchmark approach is a good template: it used real customer-support prompts and compared self-hosting against provider APIs on both cost and latency. OpenAI likewise recommends using evals to find where its models fall short.

  1. Collect 50 to 200 real examples of the input your feature will see, including ugly ones. Remove personal data first.
  2. Write the expected output for each, or a clear pass/fail rule.
  3. Run a hosted OpenAI model and one or two open-weight candidates through the same prompts.
  4. Score them on accuracy, latency and cost per 1,000 requests. Include failure modes, not just averages.
  5. Project the monthly bill at your expected volume and at ten times that volume, including hosting and engineering time for the open option.
  6. Re-run on a schedule. Models change, and so do prices. A small regression suite pays for itself; see my notes on AI evaluation metrics for production LLMs and the AI audit checklist.

If the open model is within a few points of the hosted one and the savings hold at your volume, switch that task. If not, you have your answer and it cost you a week.

Also put guardrails in place regardless of the model you pick: input validation, output checks and fallbacks. The five AI guardrails for SaaS founders are the ones I would add before launch.

My perspective

Most of the "open source vs OpenAI" debate is about ideology or benchmarks, and most founders I work with need neither. They need a feature that works for real users, costs a predictable amount and does not trap them. I have spent ten years in engineering, including systems work for Deutsche Bahn, BMW and the Bundesrechenzentrum, and the lesson that carries over is boring: pick the simplest thing that meets the requirement, and keep the exit open.

In practice I start almost every AI feature on a hosted model, behind a thin interface of my own, with a small evaluation set from the client's real data. If the numbers or the data rules later demand an open model, the swap is a contained change, not a rewrite. If a ready-made tool would do the job, I say so, because selling you a custom build you do not need helps nobody.

— Hanad Kubat

Need this built, not just compared?

If you have a workflow in mind and want it running in two to four weeks, I build it end to end myself: fixed price, fixed scope, and you own the code from the first commit. Apps start from €12,000, and the model choice, hosted or open, is made with you on your own data rather than assumed. The stack is deliberately mainstream (TypeScript, Next.js, Node, Cloudflare Workers), so the next developer can pick it up. Details and a way to get in touch are on hanadkubat.com.

FAQ

Is OpenAI open source?

No. OpenAI's flagship models are available only through its API, and their weights are not published. The company has released some open-weight models, such as Whisper, CLIP and gpt-oss, under permissive terms, but even those do not meet the Open Source Initiative's definition because training data is not included.

Is open source AI cheaper than OpenAI?

Sometimes. Small open models, especially under about 14B to 30B parameters, can be much cheaper to serve at high, steady volume. At low or spiky volume, a pay-per-token API is usually cheaper once you count servers and engineering time. Run the numbers on your own traffic.

Can an open model match GPT-level quality?

On narrow, well-defined tasks, often yes, especially after fine-tuning. On the hardest reasoning and agentic tasks, closed frontier models still lead, with one government-backed analysis putting the lag of open-weight models at several months on cyber tasks. Test on your own examples rather than trusting a leaderboard.

Is it safe to send company data to OpenAI?

That depends on the plan, the contract and your data. Read the provider's current data-usage terms for the exact product you will use, and if you handle personal or regulated data, involve your data protection officer or lawyer first. Self-hosting keeps data in your environment, but you then own the security of that environment.

Sources