Opening up the code of an infrastructure that handles enterprise data is never a simple decision. Here is the reasoning behind the new choice that the Radicalbit team is proud to announce, and the concrete implications for companies that want real control over their AI stack.

The contradiction at the core of AI Governance tools

There is a structural tension that most vendors in the AI Governance space prefer not to address openly: companies are asked to trust a black box in order to make their AI stack more transparent. The solutions that should tell you what happens to data, where prompts go, or whether guardrails actually work are paradoxically opaque tools themselves.

When an AI Gateway sits between enterprise applications and the models they query, it sees everything: prompts, completions, user data, internal documents passed as context. If the code governing that layer is not inspectable, you are extending a significant level of trust to a vendor based on its own claims. An uncomfortable position, especially as regulatory pressure on AI data management intensifies across Europe.

Radicalbit’s recent decision to release an open source version of its AI Gateway starts exactly from here: not from a positioning move, but from a concrete attempt to resolve this contradiction.

The strategic choice of Open Source

It would be easy to frame open source as a growth strategy: building community, increasing adoption, creating an ecosystem. That can be a positive side effect, but it is not the reason why it is the right choice for an AI governance layer.

The AI Governance market has so far been structured around the needs of large groups, leaving a significant gap for everyone else. Open source fills that gap by removing the access barrier entirely: you download it, inspect it, run it.

There is also a topic tied to the maturity of the sector. The AI Governance space is still relatively young and standards are not consolidated. In this context, locking governance infrastructure behind proprietary code means asking companies to make long-term bets on vendors whose approach they cannot fully evaluate. An open codebase makes evaluation possible on your own terms: companies can verify not only what the vendor says the software does, but what the software actually does.

It is in this sense that the Radicalbit team interprets open source as a democratic choice: not a vague, aspirational concept, but a concrete commitment to making it possible for more companies to adopt verifiable and auditable governance infrastructure, as opposed to opaque governance-as-a-service models.

The security question addressed with honesty

The oldest objection to open source software that is critical to security is still the most widespread: if the code is public, anyone can study its flaws. This is technically true, but at the same time it is also misleading.

Recent software history has handed us more than one case in which a serious vulnerability in a widely adopted open source library, present in countless enterprise applications worldwide, was discovered and resolved in timeframes that a closed-source equivalent could hardly have guaranteed.

When the code is public, the global community can produce patches, analyses, and mitigations in parallel and in rapid time. In a closed context, disclosure and remediation times depend entirely on the ability and willingness of a single vendor to act.

Applied to an AI Gateway, this reasoning carries specific weight. The attack surface is unusual. Traditional vulnerabilities tend to be at the code level, such as a dependency issue or an authentication bypass. An AI Gateway must also deal with semantic vulnerabilities: prompt injection attempts, data exfiltration through model outputs, guardrail bypasses that exploit how models interpret instructions rather than how code is executed. These scenarios require not only security researchers looking at the code, but AI researchers, data scientists, and domain experts examining the design logic of the guardrails themselves.

The open source nature of Radicalbit AI Gateway enables precisely this multidisciplinary review, allowing different professional figures to analyze and validate every aspect of the system.

Verifiability and Compliance

When a company adopts an AI Gateway, the vendor provides precise guarantees on data management: logging, data retention, telemetry flows, and security are defined by official documentation and protected by strict contractual SLAs. In this scenario, trust rests on the solidity of the partner and on the legal commitments signed.

The adoption of an open codebase adds a further layer of immediate verifiability to this framework. Code transparency allows security teams to instantly confirm PII masking logic and compliance officers to validate GDPR flows in real time.

This synergy between enterprise reliability and open source transparency represents the ideal bridge for companies that need total control over their compliance standards.

The AI Gateway is not positioned as a standalone product, but as a specialized component of the broader Radicalbit AI Governance suite. While the Radicalbit Platform focuses on the operationalization and observability of MLOps, the AI Gateway provides the central point for the governance and control of Generative AI-based applications. In this architecture, the Gateway acts as the necessary guardian for observability and policy enforcement.

Opening the Gateway’s code creates a verifiable foundation: the part of the stack that touches the most sensitive data is the part that can be inspected in full.

Building with the community

In open source announcements, the temptation to promise a governance model before it exists is strong.

What the Radicalbit team wants to focus on instead is the direction: a genuinely open roadmap, contribution channels that give external developers a real influence on the evolution of the project, and structured feedback opportunities before decisions are consolidated.

At this stage, the distinction between open source as a pure formality and open source as a development methodology is fundamental for us. The latter means allowing the code to concretely improve thanks to contributions and external input.

For companies evaluating the AI Gateway, this vision has an immediate practical implication. We are aware that we are taking the first steps and that the road to becoming a successful OS project is long, but we believe that community-driven development in a rapidly evolving domain like AI Governance allows software to adapt to real use cases faster than a roadmap designed in isolation. When problems discovered in production by independent teams emerge publicly, workarounds become patches and edge cases are handled collectively. It is a pace of improvement structurally superior to what a closed development cycle can hope to achieve.

Code as proof: Governance beyond vendor claims

There is a version of AI governance that functions essentially as documentation: policies, vendor certifications, periodic audits. It provides a paper trail and not real control. As AI systems handle increasingly important decisions and increasingly sensitive data, this version of governance becomes difficult to sustain.

The alternative is governance infrastructure that is itself verifiable: in which the company can independently confirm that the controls it relies on work as designed. An open source AI Gateway is a concrete step in that direction. Not because open source is a guarantee in itself — quality always depends on the engineering and maintenance behind it — but because it makes independent verification possible.

For those building secure AI infrastructure, the question of where to place trust and on what basis is anything but theoretical.

Radicalbit AI Gateway, as a new open source project, offers a concrete answer: inspect the code, conduct the audit, verify the behavior. Governance that holds up to that kind of scrutiny is governance worth having.

The invitation is to follow Radicalbit on the various social channels for all updates on the release timing and on the modalities of community participation. Stay tuned!

Frequently Asked Questions about the Open Source AI Gateway

Key Takeaways

• An open source AI Gateway resolves the structural contradiction of proprietary governance tools: the part of the stack that handles the most sensitive data becomes the part that can be independently verified, not just declared.
• The security advantage does not lie in the absence of vulnerabilities, since no software is immune to them, but in the speed of remediation and in the possibility of a multidisciplinary review that closed software structurally does not allow.
• Open source lowers the barrier to access to AI governance for SMEs and specific sectors such as Public Administration and the research world, which would otherwise remain excluded from a market built around the needs of large groups.
• The distinction between “open source as a license” and “open source as a methodology” is relevant: in the latter case, software improves through external contributions, adapting to real use cases more quickly than any roadmap designed in isolation.