Should businesses consider using Chinese AI models?

Chinese AI models are emerging as an increasingly capable alternative to their US-based peers. Recently, Nvidia CEO Jensen Huang hailed the capabilities of Chinese open source AI models amidst growing interest in low-cost options for enterprises.

At the same time, Hugging Face used an open-weight Chinese AI model to help mitigate the attack by the escaped OpenAI agent. The Cloud Security Alliance’s (CSA’s) post-mortem following the OpenAI agent escape fiasco detailed why firms should embrace open source and open-weight AI models.

“The same safety guardrails that keep frontier models from being misused for attacks can also block defenders from using those models to investigate an active one, leaving organizations without a tested open-weight fallback, at a disadvantage exactly when it matters most,” according to the CSA.

Chinese AI models are highly capable and cheaper than many US alternatives. They often perform on par with closed-source models, as ITPro reported in November last year.

Yet experts are cautious about the risk they pose. Should businesses consider these models and, if so, which applications can they be used for?

Model benefits

Chinese models include Moonshot AI's Kimi, Alibaba's Qwen, DeepSeek, and Z.ai’s GLM. In most cases, these are best described as open-weight rather than open source, meaning they can be used by anyone and model weights and inference code are publicly available for download, but the complete training datasets and foundational code remain private.

Experts think Chinese model capabilities are impressive and improving all the time. “Their reviews and ratings show their capacity is moving toward matching the biggest and best of US frontier AI models,” says Amanda Brock, CEO at OpenUK.

At the same time, the industry is recognising the biggest frontier models are “not necessarily the best for particular tasks”, says Brock.

“The open models have reached a point where they are freely sharing some of the tech equivalent to what the closed model companies charge a subscription for and are also freely available to be iteratively developed upon.”

Capability-wise, the latest generation of Chinese AI models are “genuinely impressive”, says Assaf Morag, cybersecurity researcher at Flare.

“Based on the benchmarks and independent evaluations available today, many of these models are performing at a level comparable to other leading frontier AI models while often offering lower deployment costs and more open access.”

Among the benefits, they offer “strong reasoning, coding capabilities and large-context windows”, says Oliver Simonnet, lead cybersecurity researcher at CultureAI. He believes open-weight – and in some cases open source – models also provide better control over deployment, customisation and data residency when hosted within an organization's own infrastructure.

Chinese labs have said directly that market share matters more than near-term revenue, releasing full weights and technical reports so developers worldwide can adopt and adapt the models freely.

At a time when enterprises are weighing up the often hefty cost of AI, Sai Molige, senior manager of threat hunting at Forescout, says models such as these now cost between 60% and 90% less to run. “That price gap, not parity on trust or security, is what's driving a real shift in where US developers send their workloads.”

Weighing up the risks

Yet some critics have suggested the tools could be used as a ‘backdoor’ for Chinese intelligence services.

Axios previously reported that the White House could consider imposing restrictions or tight conditions on US firms working with these models. The US government has already restricted the use of home-grown AI in other countries.

Nvidia’s Huang thinks firms shouldn’t be put off by security “misconceptions” around Chinese open-weight and open source models.

Yet beyond the obvious scare-mongering, these models do pose some risks around data privacy and national security.

Simonnet thinks data privacy is a valid concern: Chinese data-storage laws, political censorship and bias, and training-data uncertainties “remain prominent issues”, he tells ITPro.

The largest risks are often around data governance, supply-chain trust, compliance obligations, and operational security – and this is not necessarily the model weights themselves, says Morag.

“From a cybersecurity perspective, every external AI service introduces another third-party dependency. The same due diligence applied to cloud providers or SaaS platforms should also apply to AI models, regardless of whether they originate in China, the US or Europe.”

Self-hosting the models can reduce some of these privacy risks. However, this doesn't remove the risk of model biases or technical vulnerabilities. Indeed, it requires organizations to further secure and maintain the model themselves, which “adds an extra layer of security challenges”, according to Simonnet.

However, when assessing the risks, the discussion should move beyond simply asking whether a model is Chinese, says Morag. “Organizations need to evaluate where inference occurs, what data leaves their environment, who operates the infrastructure, how updates are delivered, and whether the model can be independently audited.”

The verdict

Despite posing some risks, experts say Chinese models are an option in many cases when compared to frontier alternatives. Open-weight models offer organizations “substantially more control”, says Morag.

“They can be deployed inside private infrastructure, reducing the need to move sensitive corporate information outside the boundaries of the organization to third-party providers. They also enable independent security testing and auditing, which is difficult or impossible with closed commercial APIs.”

Closed models, however, generally provide stronger vendor support, as well as managed security controls and predictable service levels, according to Morag. “For many enterprises, the decision should be based on governance requirements and operational maturity, rather than geography alone.”

Overall, Simonnet has a positive view of Chinese models. He points out they can deliver “strong performance with fewer restrictions at a smaller price”, citing the example of the Hugging Face incident.

Open-weight models do provide greater control and a way to keep sensitive data within an organization when they are privately hosted, says Simonnet. However, self-hosting requires additional technical expertise and security oversight, he concedes.

At the same time, he warns that confidential, regulated, or other sensitive data “should not be entered into these services without the proper security, privacy, and governance controls being in place”.

But for general-purpose, non-sensitive work at scale, the cost case is strong, provided the deployment is self-hosted and audited, says Molige.

“For code headed for production or government-adjacent systems, companies should scan generated code regardless of which model wrote it, rather than trusting output by source.”