Model Weights as a National Asset: The Case

In a south-block corridor conversation that never made the minutes, a joint secretary asked a simple question after a demo. If we spend three years teaching this model how this ministry writes, and the vendor is sold or sanctioned, what exactly do we still have? The integrator pointed at the India-region badge. The CIO pointed at the runbooks. Nobody pointed at the adapter file.

That adapter was the only object in the room that encoded the ministry's voice, its scheme names, its exception patterns, and the ugly edge cases officers had labelled at night. The base model was a commodity. The adapter was institutional memory in binary form. It was not listed on any asset register.

This is an opinion, not a statute. DPDP does not assign intellectual property in weights. No general gazette we can cite declares a checkpoint to be a national asset. The case for treating some weights that way is still worth making, because continuity failures do not wait for a definition.

What the phrase can honestly mean

National asset is a dangerous slogan if it means we will not buy foreign tools. It is a useful slogan if it means four operational facts.

1. Custody: the institution can produce the artefact without asking a vendor's permission on a weekend.
2. Continuity: a second party can load the artefact and serve the same workflow if the first party vanishes.
3. Export and access: who may copy the artefact, and under which licence or classification, is written down.
4. Non-training of others: the artefact is not quietly merged into a vendor's next general model.

Those four facts do not require you to train a foundation model in a national lab. They require you to stop treating a fine-tune as a feature flag inside someone else's product.

Not all weights are equal

Register artefacts the way you register other systems that would hurt to lose.

Artefact	Strategic weight	What to demand
Public base checkpoint	Commodity; continuity hedge	Local copy, hashed; licence that allows your use
Department fine-tune / LoRA	High; encodes your work	Institution owns it; escrow; no vendor reuse
Prompt library and tool schemas	High; this is the procedure	Plain-text export; versioned in your git
Retrieval corpus and eval set	High; often full of personal data	Your object store; retention rules; no vendor copy
Vendor secret model	Low control; high lock-in	Use only where continuity is expendable
Safety classifier hosted abroad	Operational chokepoint	Replace or run local; do not let it see case files

The political temptation is to talk only about foundation models. That is a national industrial question, and IndiaAI is one attempt to fund compute and capacity for it. A department CIO cannot wait for that debate to end. The adapter you fine-tune this quarter is the asset you can actually custody.

Continuity is the test the board actually understands

Secretaries do not need a lecture on tensors. They understand a weekend where the vendor is sold, sanctioned, or simply late on a licence invoice. Ask, in that meeting, who can stand the assistant back up from files the department already holds. If the answer is we would call the account manager, the adapter is not an asset. It is a hostage.

Write a restore drill the way you write a disaster-recovery drill for the database. A clean box, the hashed artefact, the prompt pack, the retrieval snapshot, an officer who is not the original data scientist. Time it. The first drill will fail on a missing tokenizer or a licence file that still wants the internet. That failure is the point of the drill.

Export control, in the institutional sense, is the twin of continuity. Who may copy the artefact onto a laptop? Who may show it to a second integrator during a retender? Who may publish a model card that reveals the scheme list? Those questions belong on the asset row. They are not glamorous. They are how a national-asset conversation becomes a register instead of a speech.

Objections to the national-asset frame

This is just software. Some of it is. A public 7B checkpoint you downloaded last Tuesday is software. A year of labelled exceptions from a subsidy scheme is closer to an official record. The frame is for the second object.

Calling it a national asset will scare vendors away. Good vendors will escrow. Vendors who refuse to let you hold your own adapter are telling you what the renewal will feel like.

Open weights make this whole debate obsolete. They make the base layer cheaper. They do not give you ownership of the work you do on top, and they do not stop a hosted wrapper from locking the serving path. That is a different article in this series, and the short version is partly.

We should wait for a government classification circular. You can wait. The vendor change-of-control will not.

What not to nationalise

Do not put a public FAQ model on the same register as a shop-floor fine-tune. The register will swell and the interesting rows will drown. National-asset language is for artefacts whose loss would change a department’s ability to function or whose leakage would change a security conversation. A downloaded 7B you can fetch again next week is inventory, not treasure.

Do not use the phrase to block every foreign tool. Maps for a public website, a library catalogue, a compiler. The case is about custody of work product and continuity of sensitive workflows. Inflating it into a general embargo will make the next secretary ignore you.

Do not classify an adapter in a civilian department because the phrase sounded martial. Classification has its own law and its own officers. If those officers have not marked the file, you are doing custody and access control, which is already enough work.

A 90-day custody register

• Days 1–15: inventory every weight file, adapter, prompt pack and eval set in use, including unofficial fine-tunes on officer laptops.
• Days 16–40: write ownership and licence against each row. Kill unofficial copies.
• Days 41–70: stand up a department registry with hashes, access lists and an offline export test.
• Days 71–90: put ownership, escrow and a reuse ban into the MSA. Run one restore onto a clean box.

What goes in the file

An asset row for each artefact, the licence, the hash, the restore test date, the people who may copy it, and the contract clause that says the department owns the work product. Add one honest sentence: this is a continuity control, not a claim that the Act created a new class of property.

Prcept AI will not claim your adapters. If we help you fine-tune inside your perimeter, those files should land in your registry with your hashes.

How to defend this in the file

A P1 CIO/CTO will be asked to explain “Model Weights as a National Asset: The Case” to a secretary who has ten minutes. Do not start with the model. Start with the store, the hop, the clause, or the residual risk. “model weights national asset” is a search phrase. The file needs a decision.

DPDP does not call a checkpoint a national asset. Continuity, export control and custody still argue that some weights belong in the same conversation as maps and key material. DPDP does not define sovereign AI. Transfers can be lawful and still be a bad idea. Sector circulars can be stricter than DPDP. Write which instrument you are using.

If you cannot name the Data Fiduciary, the processor, the location of traces, and the erasure method, you are not ready for production personal data — whatever the architecture PDF says.

• One sentence on lawful basis or the procurement rule you are invoking.
• One sentence on where prompts, embeddings and logs live.
• One sentence on who can compel the operator.
• One artefact: packet capture, DPA schedule, or deletion certificate template.

Close this loop before the next CAB

Put “Model Weights as a National Asset: The Case” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P1 CIO/CTO, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “model weights national asset” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.