On Artificial Analysis's independent ranking in October 2026, the three highest-scoring open models are all Chinese: Xiaomi's MiMo-V2.6-Pro, Zhipu's GLM-5.3 and Moonshot AI's Kimi K3. Meanwhile, plenty of Dutch companies have a policy line that says "no DeepSeek". That line lumps four very different situations together.
Chinese AI models are language models from Chinese makers such as DeepSeek, Alibaba (Qwen), Moonshot AI (Kimi), Zhipu (GLM) and MiniMax. Their business risk depends almost entirely on the route you use them through: the maker's app, the maker's API, a European hosting provider, or the open weights on your own server. The first route can't be defended for company data. The last is legally no different from any other open model, with two concerns of its own.
Which route should you choose for a Chinese AI model?
The route for a Chinese AI model decides where your data goes, which law applies to it and who can get at it. This is the overview we use with clients.
| Route | Where your data goes | Law and access | Our view |
|---|---|---|---|
| DeepSeek app or web chat | Stored in China, used for training (with opt-out) | Chinese law, Hangzhou court | Not for company data |
| DeepSeek API | Personal data under the same privacy policy, so China | Chinese law, Hangzhou court | Not for personal or confidential data |
| Alibaba API (Qwen) in Frankfurt | Stored in the EU; processed in the EU only if you choose that explicitly | Chinese parent company | Only with the EU setting, and not for sensitive data |
| European hosting provider | Stays with the host in the EU, maker has no access | European law | Comparable to any other hosted model |
| Weights on your own hardware | Never leaves your environment | Under your control | Defensible, with attention to model behaviour and model files |
The DeepSeek app and API
DeepSeek's privacy policy, updated 10 February 2026, is plain about it: "we directly collect, process and store your Personal Data in People's Republic of China". It lists training DeepSeek's own models as a purpose. There's now an EU representative and a right to opt out of training. None of that changes where the data is stored.
The API platform terms, in force since 29 April 2026, choose the law of the People's Republic and the court in Hangzhou, and refer to that same privacy policy for personal data. They contain no separate commitment on training on API input or on retention.
Why the storage location matters: Article 7 of China's National Intelligence Law requires "all organizations and citizens" to cooperate with intelligence work. A Chinese company can't refuse a state request. That applies to every route where the data sits with a Chinese party.
Alibaba's API in Frankfurt
Alibaba Cloud offers Qwen models from Frankfurt among other regions, and its documentation says stored data stays in the chosen region. There's a catch. In Frankfurt you choose per workspace between "Global (any available node, including Chinese mainland and overseas)" and "EU (inference within the region)". Leave the default and the processing itself may happen in China. Alibaba says it doesn't use customer data to train models. The parent company is still Chinese.
A European hosting provider
A European hosting provider runs the open weights of Chinese models on its own infrastructure, without the maker seeing anything. France's Scaleway offers DeepSeek V4.1 Flash, GLM-5.3 and Qwen3.8-27B among others, and states in its privacy documentation: "Your data is not accessible to the creators of the underlying large language models". Legally, that's the same position as an open Mistral or Google model at the same host. How to assess such a provider is covered in choosing a sovereign cloud.
What have Dutch regulators said about DeepSeek?
Dutch regulators have warned about the DeepSeek app, not about running the weights yourself. Policies often miss that distinction.
The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) warned app users on 3 February 2025 to be "very careful and restrained", opened a wider investigation into transfers of personal data to China, and noted "similar concerns" about using the underlying model. It added a line that matters to employers: whoever uploads other people's data is liable for that unlawful transfer. An employee pasting a client file into the app makes the company liable.
Dutch central government civil servants may not use DeepSeek. That isn't a new ban; it follows from a 2023 policy, adopted on the advice of the AIVD intelligence service, against apps from countries with an offensive cyber programme aimed at the Netherlands. China is on that list. In Germany, the Berlin data protection authority reported the app to Apple and Google as illegal content in June 2025, because the transfer to China breaches the GDPR.
The clearest government text on routes comes from the Czech Republic. The national cyber agency NÚKIB warned against DeepSeek products in critical systems in July 2025, but expressly exempted open models deployed locally without any way to communicate with DeepSeek's servers. We found no Dutch or European rule that bars companies from running Chinese open weights themselves.
Is the censorship in the weights?
Yes, the censorship of Chinese AI models sits in the weights themselves, even when you run them on your own hardware. The US Center for AI Standards and Innovation (CAISI) at NIST tested DeepSeek models it downloaded from Hugging Face and ran on its own servers, without touching DeepSeek's API. Its conclusion: "CCP censorship is built directly into DeepSeek models".
The numbers are more nuanced than the headline. On English prompts, DeepSeek V3.1 repeated a Chinese Communist Party narrative 5% of the time, against 2% for the US reference models. R1-0528 reached 16%. In Chinese, all figures were higher. For Kimi K2 Thinking, CAISI found heavy censorship in Chinese, while the model was relatively uncensored in English. Bear in mind the report comes from the US government, with a political message of its own.
For most business tasks this doesn't matter. Reading an invoice or answering a Dutch customer question touches no sensitive subject. It does matter for market research on China, for text about geopolitics or human rights, and for any use where staff treat the model as a reference source. In those cases, put sensitive questions in your test set, as we describe in evaluating AI benchmarks.
What security risks come with open weights?
Open weights carry two security risks that a hosted service handles for you: the model itself is easier to manipulate, and model files can contain malicious code.
On the first, CAISI measured that agents built on DeepSeek R1-0528 followed malicious instructions twelve times as often on average as the US frontier models. But the open US model gpt-oss did just as badly on phishing emails: 48% for both. The report itself notes that cloud providers often add input and output filters. So the risk is partly "open weights without filters", not only "Chinese". For an agent with access to your systems, you build those filters yourself, as we set out in securing AI agents against prompt injection.
On the second: a model file in the old pickle format can run arbitrary code when loaded. Hugging Face warns about this itself. JFrog found around a hundred malicious models on the platform in 2024, and ReversingLabs found two in 2025 that Hugging Face's scanner didn't flag as unsafe. Some models also ship their own Python code that runs with trust_remote_code; in October 2026 that includes Kimi K3 and DeepSeek V4.1 Flash. Our working rules:
- download only from the maker's official repository
- load only
.safetensorsfiles, never pickle - pin the version to a specific commit
- read bundled code before enabling
trust_remote_code, or use an inference server that supports the model without that code
Time saved
Save 5 hours per week on manually reviewing AI tools and models that departments want to adopt
Which licences apply to Chinese open models?
Licences for Chinese open models vary widely in 2026, and the trend is tightening. DeepSeek V4 and V4.1 are under the plain MIT licence, the 27-billion-parameter Qwen models under Apache 2.0, and GLM-5 through 5.2 under MIT. Those are as permissive as licences get.
Then there are custom licences with thresholds. Kimi K3 and the newer Qwen models require a separate agreement if you offer the model to others as a service, and a name display above 100 million users or 20 million dollars in monthly revenue. Internal use is exempt. MiniMax goes furthest: for MiniMax M2.7, any commercial use without prior written permission is prohibited. A full comparison with the US and European models is in open-weight licences compared.
How do you write a policy for Chinese AI models?
A policy for Chinese AI models describes what's allowed per route instead of banning a brand. A ban on "DeepSeek" blocks the safe route and leaves the unsafe routes of other makers open.
We recommend four rules. Apps and web chats from Chinese makers aren't allowed on work devices, like any other unapproved AI tool; see our piece on a shadow AI policy. APIs from Chinese makers aren't allowed for personal or confidential data. Open weights are allowed at a European host or on your own hardware, after testing on your own tasks and checking the licence. And every agent with write access gets extra filters, whatever the model's origin.
That turns the question back into what it should be: which model does this task best, within the limits of your own environment. How Chinese models compare with the rest of the open field is in open-weight models versus the frontier, and our guide to local AI for business covers the whole route from model choice to operations. Want an open model, Chinese or not, running safely under your own control? We do that as part of local AI.