Chinese and Open Source AI Models: A Guide for Builders

Is it possible to build entirely on Chinese AI models? The honest answer depends entirely on how you use them — and most of the debate collapses once you separate two very different things. Using a Chinese company’s hosted API or consumer app means your prompts travel to servers subject to Chinese law. Self-hosting the open weights — DeepSeek V4 and GLM-5.2 under MIT licences, Qwen 3.5 under Apache 2.0 — on infrastructure you control means no data leaves your environment at all. The model is a static file; the data-sovereignty objection largely disappears, though behavioural quirks from Chinese training and alignment remain.

That distinction explains an apparent contradiction: Australia, Taiwan, South Korea and Italy restricted the DeepSeek app in early 2025 (Al Jazeera, February 2025), while Singapore’s OCBC — an MAS-regulated bank — runs more than 30 internal tools on self-hosted open-source models including DeepSeek and Alibaba’s Qwen across six Asian markets. Both positions are rational. Here is the due-diligence picture as of 25 July 2026.

The distinction that settles most of the debate

Most headlines about Chinese AI risk conflate two deployment modes with completely different threat models.

Mode one: the hosted API or app. Call DeepSeek’s API or use the Kimi app, and your data is processed on the vendor’s servers, subject to Chinese data-security and national-intelligence law. This is the mode every government ban targets, and the mode with real incidents — Wiz Research found a publicly exposed DeepSeek database leaking chat histories and API keys in January 2025. If prompts contain customer or regulated data, this mode fails most enterprise governance tests.

Mode two: self-hosted open weights. Download the weights from Hugging Face, verify the checksums, and run them on your own GPUs or cloud tenancy. Nothing is transmitted to the model’s creator; weights are inert numerical files with no network capability. What you inherit instead is the model’s behaviour — alignment choices and topic censorship baked in during training — a quality and reputation issue, not a data-exfiltration one.

This is why OCBC can deploy DeepSeek and Qwen internally for document summarisation, coding and market analysis while governments restrict the consumer app on official devices. Our coverage of Chinese AI models in Southeast Asia documents the wider pattern: Indosat Ooredoo Hutchison’s DeepSeek-powered work with AIonOS in Indonesia, and Malaysia’s sovereign AI ecosystem hosting DeepSeek on Huawei GPUs — the first national-scale DeepSeek deployment outside China.

What the licences actually say

Licence risk is the easiest box to tick — the major Chinese labs have converged on genuinely permissive terms. As of July 2026:

DeepSeek V4 (released 24 April 2026) ships its weights under the MIT licence — 1.6 trillion total parameters, 49 billion active, 1-million-token context (WinBuzzer, April 2026). MIT permits unrestricted commercial use, modification and redistribution.

Qwen 3.5 (Alibaba, February 2026) uses Apache 2.0, which adds an explicit patent grant on top of MIT-style freedoms — arguably the most enterprise-friendly of the lot. GLM-5.2 (Z.ai, 16 June 2026) is MIT-licensed, with 744 billion parameters (Labellerr, June 2026).

Kimi K3 (Moonshot AI, announced 16 July 2026) is the one to watch this week: weights drop on 27 July 2026, expected under Moonshot’s Modified MIT licence, which historically added an attribution requirement for very large-scale deployments (VentureBeat, July 2026). Until the text is published, treat K3 as API-only and unverified for enterprise self-hosting.

One caveat applies across the board: these are open-weight releases, not open-source in the strict sense — training data and code remain proprietary, which matters for provenance auditing. Check current terms in our LLM accessibility tracker for Asia.

What security researchers have (and haven’t) found

The most rigorous public evaluation remains the US NIST Center for AI Standards and Innovation (CAISI) report of 30 September 2025. It found DeepSeek’s R1-0528 model complied with 94% of overtly malicious requests under common jailbreak techniques, versus 8% for US reference models, and that DeepSeek-based agents were 12 times more likely to follow hijacking instructions (NIST CAISI, September 2025). CAISI also found DeepSeek models echoed four times as many inaccurate Chinese state narratives as US counterparts. Real findings — but note what they describe: weaker guardrails and ideological skew, both mitigable with output filtering and your own red-teaming, and neither unique to Chinese models.

On poisoning, Anthropic, the UK AI Security Institute and the Alan Turing Institute showed in October 2025 that as few as 250 malicious training documents can backdoor a model of any size (Anthropic, October 2025). That research is model-agnostic — an argument for provenance discipline with every open model, not a China-specific finding.

And here is the honest part most coverage skips: as of July 2026 there is no documented case of self-hosted Chinese model weights exfiltrating data. No researcher has demonstrated weights “phoning home” — architecturally, they cannot. The censorship layer is also demonstrably removable: in February 2025 Perplexity released R1 1776, a post-trained DeepSeek R1 with Chinese political censorship stripped out. CAISI itself noted DeepSeek model downloads grew nearly 1,000% between January and September 2025 — the market has largely priced these trade-offs.

Compliance by market

United States: bans target apps and federal procurement, not weights

US federal action — including the No Adversarial AI Act, introduced in June 2025 to bar federal agencies from using “foreign adversary” AI (The Record, 2025) — and state bans in Texas, New York and Virginia all target the hosted app and API on government systems. None currently prohibits a private company from running open weights on its own hardware, though export-control creep is a live risk; our analysis of whether the US can actually ban Chinese AI models covers the mechanisms.

European Union: obligations apply regardless of origin

The EU AI Act does not care where a model was trained. General-purpose AI obligations have applied since 2 August 2025; from 2 August 2026 the AI Office can fine GPAI providers up to €15 million or 3% of global turnover, while the digital omnibus deferred most high-risk obligations to December 2027 (Gibson Dunn, 2026). Critically, an enterprise that substantially modifies and commercialises an open model in the EU can itself become the “provider” — the burden is identical whether the base model is Qwen or Llama.

Asia: data residency rules actually favour self-hosting

Vietnam’s Personal Data Protection Law took effect on 1 January 2026, tightening cross-border transfer requirements (DFDL, 2026); Indonesia mandates domestic processing for public-sector data under GR 71/2019; India’s DPDP Act lets Delhi blacklist transfer destinations; Singapore’s MAS expects banks to control outsourced data. Self-hosted weights satisfy all of these by construction — the data never crosses a border — which is why sovereign AI programmes from Jakarta to Kuala Lumpur keep choosing Chinese open models. Track the moving parts in our Asia AI policy tracker.

The due-diligence checklist

• Licence review. Confirm the exact licence of the exact checkpoint (Kimi’s Modified MIT differs from DeepSeek’s plain MIT) and log it in your OSS register.
• Weights provenance. Download only from the lab’s official Hugging Face organisation; verify SHA-256 checksums; pin the revision hash; avoid community re-uploads.
• Air-gap the inference environment. Run inference with no outbound network access, and monitor egress anyway — verification beats trust.
• Red-team before production. Given CAISI’s jailbreak findings, test your own guardrails against prompt injection and agent hijacking; don’t rely on native refusals.
• Output filtering. Layer a moderation model over responses to catch unsafe content and politically skewed answers.
• Fallback strategy. Keep your inference layer swappable to Llama, Mistral or a hosted Western model within days, in case US restrictions ever extend to weights.
• Paper trail. Document the assessment; MAS, BSP and OJK examiners increasingly ask.

When you shouldn’t use a Chinese model

Skip Chinese models — even self-hosted — if: you sell to the US federal government or defence supply chain, where association risk outweighs cost savings; your product surfaces raw model output on politically sensitive topics to the public; you cannot resource red-teaming and egress monitoring, in which case a managed Western API is genuinely safer; or your board’s risk appetite won’t survive the headline. And never route regulated or confidential data through China-hosted APIs — the one scenario where the critics are straightforwardly right.

For everyone else, the economics are hard to ignore: GLM-5.2 beat GPT-5.5 on the FrontierSWE coding benchmark (74.4% vs 72.6%) at roughly one-sixth the price, and DeepSeek V4’s output tokens cost about a tenth of GPT-5.5’s (July 2026 pricing — see our live AI model cost tracker). The governance overhead above is real but bounded; a 5–10x unit-cost advantage at near-frontier capability usually isn’t.

FAQ

Can self-hosted DeepSeek or Qwen weights send data back to China?

No. Weights are static parameter files with no network capability; inference happens entirely on your hardware. As of July 2026, no researcher has documented data exfiltration from self-hosted open weights — every documented incident, such as Wiz Research’s January 2025 exposed-database discovery, involves DeepSeek’s hosted services.

Do government DeepSeek bans apply to my company?

Almost certainly not. The bans in Australia, Taiwan, South Korea, Italy and several US states cover the DeepSeek app and hosted service on government devices. No major jurisdiction currently prohibits private enterprises from self-hosting the open weights, though government contractors should check procurement clauses.

Are the licences safe for commercial products?

Yes, for the current flagships: DeepSeek V4 and GLM-5.2 use MIT, Qwen 3.5 uses Apache 2.0 — all permit commercial use, modification and redistribution. Review Kimi K3’s expected Modified MIT licence once published (weights due 27 July 2026); Moonshot’s previous versions carried attribution conditions for very large deployments.

Will the model refuse or skew answers on sensitive topics?

On Chinese political topics, yes — NIST’s CAISI evaluation (September 2025) found DeepSeek models echoed four times as many inaccurate state narratives as US models. This rarely surfaces in enterprise workloads like code and document processing; for public-facing content, add output filtering or use a de-censored variant such as Perplexity’s R1 1776.

What if the US restricts open weights later?

Downloaded weights cannot practically be recalled, but future updates could be cut off. Mitigate by archiving verified checkpoints, keeping your inference stack swappable to Llama or Mistral, and monitoring proposals like the No Adversarial AI Act — see our companion piece on whether the US can ban Chinese AI models.