Safe ways to use Chinese AI models in your apps

Chinese open-weight models now sit at the top of most leaderboards your team checks before choosing a model. DeepSeek V3 and R1, Alibaba Qwen3, Z.ai GLM-5.3 and GLM-5.3-Flash, Moonshot Kimi K3 all score within months of the U.S. frontier on coding, math, and agentic tasks, and they ship as downloadable weights at one tenth the API price of a closed flagship. That combination is difficult to ignore when your roadmap needs strong reasoning on a tight budget.

The cost advantage carries a different risk surface. Use a model by calling its China-hosted API and you export data into a jurisdiction with legal access powers and content rules that do not match Western compliance expectations. Use the same weights through a U.S. deployment path and most of those risks shrink to manageable controls. This article maps the risks first, then walks through the deployment ladder from riskiest to safest, with the conditions that make each step appropriate.

The risks are not one risk

Treat Chinese AI risk as five separate questions, not a single verdict on the country of origin.

1. Data jurisdiction. China's National Intelligence Law Article 7 and Data Security Law give authorities broad ability to compel organizations and citizens to support intelligence work and to access data held in the country. The House Select Committee on the CCP documented DeepSeek's backend ties to China Mobile infrastructure and to tracking libraries linked to ByteDance, Baidu, and Tencent. Even with a data processing agreement, a Chinese vendor can face an overriding legal obligation to disclose. If prompts contain regulated or customer-confidential data and the inference endpoint is operated by a Chinese entity or runs on servers in China, the data falls under that jurisdiction.

2. Behavioral alignment. Chinese models are trained under domestic content rules that require alignment with core socialist values and correct political direction, and they must filter categories of illegal and sensitive content and retain logs for inspection. Independent testing shows the effect: one widely cited evaluation found DeepSeek-R1 suppressing or altering responses on politically sensitive topics in about 85 percent of test cases, and recent work found DeepSeek producing vulnerable code more often when prompts contained politically sensitive context, a pattern embedded in the weights that persists after self-hosting. Censorship is not cosmetic. It changes refusal behavior, tool outputs, and safety calibration.

3. Provenance and supply chain. Open weights invite inspection, which helps, but training data and distillation history remain opaque. Multiple U.S. labs have accused DeepSeek and related labs of large-scale distillation from frontier U.S. models, and CSIS notes that export controls push Chinese labs toward distillation and inference efficiency as a necessity. You receive model weights without a complete bill of materials. Integrity checks, version pinning, and reproducible evaluation become your responsibility.

4. Export control and procurement exposure. U.S. export rules treat sending controlled technical data into a China-hosted API as an export to China that can require authorization, with Zhipu AI (Z.ai) on the Entity List since January 2025. The analysis turns on who operates the endpoint; code location alone does not settle it. Procurement law follows the developer: the FY2026 NDAA requires DoD to exclude AI developed by DeepSeek or High-Flyer and bars contractors from using it in performance, and multiple states plus federal proposals restrict Chinese models on government devices even when hosted in the U.S.

5. Cyber capability persistence. Open weights with strong coding and exploit skills cannot be recalled. Anthropic and independent commentary have warned that once weights circulate, safety limits can be stripped and the model repurposed for vulnerability discovery. GLM-5.3 scores 84.5 on CyberGym and over doubles its predecessor on ExploitBench, which illustrates the upside for defenders and the same upside for attackers.

None of this makes a Chinese model unusable. It makes the deployment channel decisive.

Level 0: Direct China-hosted APIs

Calling api.deepseek.com, qwen.ai, or bigmodel.cn directly is the cheapest integration and the highest exposure. Your prompts, retrieved context, and tool outputs cross into Chinese jurisdiction, logs are retained for at least six months under network logging rules, and you rely on the vendor's moderation and audit stack. For non-sensitive workloads with no personal data, no export-controlled content, and no government customer, teams accept this path for experimentation. For anything regulated, including GDPR personal data, HIPAA, or client-confidential information, this path violates the data transfer conditions that Western auditors check first.

GDPR Chapter V illustrates the gap clearly. China has no adequacy decision, DeepSeek publishes no Standard Contractual Clauses for EU-China transfers, and the Italian Garante banned DeepSeek within 72 hours of review in early 2026, with investigations opened in 13 European jurisdictions. The open-source weights on EU infrastructure solve the transfer problem; the hosted China API does not.

Use this level only for public or synthetic data pilots where you can afford the jurisdiction and censorship traits in the weights.

Level 1: Zero Data Retention as a contract, not a switch

Zero Data Retention (ZDR) is the mechanism enterprise buyers ask for when they cannot afford provider-side storage. It is easy to misunderstand.

On Western providers, ZDR is a negotiated commitment that prompts and responses are not written to durable storage after the response completes and are not used for training. OpenAI enforces it by forcing store=false on eligible endpoints such as chat completions, embeddings, and audio, while stateful endpoints like threads, vector stores, batches, and fine-tuning fall outside coverage. Anthropic enables ZDR per commercial organization and covers eligible APIs and Claude Code via organization keys, with stateful features and code execution containers remaining outside the promise. Even under ZDR, both providers retain narrow exceptions for legal obligations and for CSAM reporting, and Anthropic retains trust and safety classification signals for flagged sessions up to two years.

Chinese hosted providers do not offer an equivalent ZDR toggle on their public APIs. Domestic law requires log retention and content auditability, so the vendor cannot promise zero retention even if it wanted to. That does not mean Chinese models cannot be used under ZDR principles. It means you must obtain ZDR from the layer that operates the inference, not from the original lab. The next two levels do exactly that.

Level 2: U.S. neocloud endpoints

A U.S. neocloud hosts the same open weights in U.S. data centers and serves them under U.S. contracts, with no data shared back to the model provider.

• Together AI hosts DeepSeek R1, V3.1, Qwen3, and GLM-family models on North America-based clusters and documents that DeepSeek has no access to requests or API calls, with opt-out privacy controls and no training on customer data. Dedicated endpoints run single-tenant on isolated GPUs with SOC 2 Type II and ISO 27001, and you select the region for residency.
• Fireworks AI serves DeepSeek and Qwen with the same posture, default ZDR on managed offerings, SOC 2 coverage for the platform, and region pinning available via support request, with a HIPAA BAA available to eligible customers after sales review.
• Other U.S. options follow the same pattern: Groq, Cerebras, Hyperbolic, and SambaNova publish U.S. residency and no-provider-sharing statements, with varying ZDR and BAA maturity.

What changes compared with Level 0:

• Inference stays in the United States. CSIS and Sheppard Mullin assessments note that routing through a U.S. provider that fully manages DeepSeek from U.S. regions eliminates the export-to-China tripwire and removes the data-transfer-to-China analysis, because no transaction with a Chinese party and no data flow to China occurs.
• The contract shifts to a U.S. entity. Your DPA, BAA eligibility, and audit rights attach to the neocloud, not the original lab. Training opt-out and retention terms are governed by the neocloud's data processing documentation.

What does not change:

• Model behavior still reflects training-time alignment. A U.S. host does not retrain the censorship patterns out of the weights. Test refusal and sensitive-topic handling before you put the model on user-facing surfaces.
• Government procurement tests still follow the developer. A U.S. host cures the export analysis but does not cure a contract clause that bans AI developed by a named adversary entity.

Use this level when you need API economics and velocity, handle customer or moderately regulated data, and can accept U.S. commercial terms with auditability. Confirm three items in writing before you rely on it: the hosting region, the retention period for prompts and responses, and the BAA or DPA scope that covers the model.

Level 3: Hyperscaler marketplace deployments

Hyperscalers wrap the same open weights in fully managed services inside your existing cloud trust boundary. They add identity, networking, and compliance controls that neoclouds offer only partially.

Azure AI Foundry. Microsoft hosts DeepSeek V3.2, V4-Pro, V4-Flash and Kimi K2 as first-party Foundry models, available in global, data zone, and regional deployments. You deploy through Foundry with Microsoft Entra ID, pay through Azure, and apply Azure Private Link to keep traffic off the public internet. Private Link secures the network path; the deployment type controls processing geography, so select regional or data zone when residency matters and verify the model card for each version.

AWS Bedrock and Bedrock Marketplace. AWS offers DeepSeek V3.2, V3.1, R1 and Qwen3 families as fully managed, serverless models in Bedrock, plus Qwen3-32B class models via Marketplace and SageMaker JumpStart. Bedrock's baseline is the strongest default among the options: customer inputs and outputs are not shared with model providers, are not used to train base models, and are protected with enterprise guardrails. Invocation logging is opt-in only, and PrivateLink is available for Bedrock Runtime. In-region endpoints keep requests in one region for strict compliance, while geo and global inference profiles route more broadly, so check the model card per DeepSeek variant before you choose.

What this level adds beyond neoclouds:

• Procurement and governance fit. Azure and AWS models inherit SOC 2, ISO 27001, HIPAA eligibility, and FedRAMP documentation, with IAM and Service Control Policies to restrict model access centrally.
• Stronger data residency primitives. Bedrock in-region inference and Foundry regional deployments let you pin processing to a single region when a customer contract requires it. That avoids a support ticket for residency.
• Marketplace breadth. Qwen3 is available both as Bedrock serverless and as marketplace endpoints on dedicated instances, which lets you trade managed convenience for instance-type control without leaving the hyperscaler.

The same behavioral caveat applies: the hyperscaler does not fine-tune the politics out of the weights. Evaluate refusals, red-teaming performance, and code vulnerability rates on your own tasks, because the provider's safety wrapper sits around the model, not inside it.

Use this level when you already live in Azure or AWS, need formal compliance artifacts, and want the same open-weight capability with the least additional vendor onboarding.

Level 4: Self-hosted and private VPC

Self-hosting removes the provider layer entirely. You download the weights from Hugging Face or ModelScope, run them in your own VPC, and control logging, patching, and network egress.

• Control. Inference never leaves your network. No cross-border transfer, no provider-side retention policy to audit, and no dependency on a host's uptime or terms change. You own the audit log, the version, and the data residency proof that GDPR Article 30 requires.
• Cost shape. Fixed GPU cost replaces per-token billing. DeepSeek R1 at 671B MoE needs 8 to 16 H100 class GPUs in FP8, Qwen3-32B runs on a single A100 40GB in INT4, GLM-5.3-Flash at 320B needs hyperscaler-class hardware. Size the hardware to the model, not the logo.
• Burden. You operate the serving stack (vLLM, SGLang, Triton), secure the deployment, monitor for vulnerable outputs, and patch when a new weight drop or inference advisory appears. The household-citation for risk is no longer a vendor DPA but your own runbook.

Three controls make self-hosting safe in practice:

1. Isolate egress. Run inference in a private subnet with no outbound internet, pull weights through an artifact registry, and enforce that only your gateway can reach the endpoint.
2. Pin and sign. Record model ID, hash, and license per deployment, test upgrades in staging, and block auto-updates that would swap weights without review.
3. Log and redact. Keep request-level logs with PII redaction, guardrail decisions, and model version for audit, and apply input and output filtering before data reaches downstream systems.

Self-hosting is the right default when data is highly sensitive, when you serve government workloads where the model developer is named in procurement rules, or when you need air-gapped operation. It is the wrong default when your team has no GPU operations capacity and the workload tolerates a managed U.S. endpoint with documented residency.

Choosing the level for your app

App context	Recommended starting level	Why
Public content generation, synthetic data, internal experiment with no personal data	Level 0 direct API or neocloud serverless	Lowest cost, acceptable jurisdiction exposure
Customer-facing product handling EU personal data or business-confidential records	Level 2 neocloud or Level 3 hyperscaler with ZDR and residency	Eliminates China transfer, adds U.S. DPA and audit trail
HIPAA, financial services, or defense-adjacent workload	Level 3 hyperscaler with BAA and PrivateLink/Private Link, or Level 4 self-hosted	Requires formal compliance artifacts and provable data residency
FedRAMP or government supply chain with developer-name restrictions	Level 4 self-hosted on controlled infrastructure	Hosting channel does not cure procurement bans tied to the developer

For mixed estates, run a hybrid: keep the sensitive path on a pinned Bedrock or self-hosted endpoint and route non-sensitive traffic to the cheapest neocloud serverless tier. Most cost savings survive the split.

A short deployment checklist

Use this list at model selection, not after launch.

1. Map the data flow. Write down where prompts, retrieved documents, tool outputs, and final responses are processed and stored. Mark every hop that could see plaintext. The channel matters as much as the model.
2. Confirm the retention promise in writing. Ask for the provider's ZDR or no-retention documentation that covers the specific model and endpoint you will call. OpenAI and Anthropic gate ZDR on eligible endpoints and exclude stateful features; neoclouds and hyperscalers have their own matrices. A sales deck is not a DPA.
3. Verify residency controls. Check whether the endpoint supports in-region inference, regional deployment types, or PrivateLink/Private Link, and whether residency is self-serve or requires a support request.
4. Test model behavior beyond price. Measure refusal rates on sensitive topics, jailbreak compliance, and vulnerable-code generation on your tasks. The Italian Garante action and the NIST CAISI results are signals, but your workload determines the impact.
5. Check procurement and licensing. Confirm the model license permits commercial use, whether the developer is on an Entity List or procurement ban that affects your contracts, and whether fine-tuning or distillation obligations attach.
6. Apply guardrails before production. Enable provider or Bedrock guardrails for PII filtering and sensitive content screening, and keep human review for generated code until review coverage is measured.
7. Plan for weight updates. Track new releases, disclosure ledgers, and safety advisories, and decide in advance whether updates roll automatically or only after staged evaluation.

Chinese open-weight models are now capable enough to justify their place in a production stack. The safe way to use them is to choose the inference channel that matches the sensitivity of the data you send. Host in the United States when you need a U.S. contract and audit path, host inside your hyperscaler when you need enterprise compliance primitives, and self-host when you need full control over data movement. The model may be Chinese in origin, but the risk is determined by where it runs.

Sources

• ZDR and Chinese provider posture - Zhipu/DeepSeek/Qwen private deployment comparison, abubakarsiddik31/zdr. Accessed August 27, 2026.
• Chinese AI compliance risk framework, RedHub. Accessed August 27, 2026.
• What to know about Chinese AI models - CSIS Critical Questions, CSIS, July 2, 2026. Accessed August 27, 2026.
• U.S. vs Chinese AI models export control risks, Sheppard Mullin, July 23, 2026. Accessed August 27, 2026.
• DeepSeek represents a profound threat - Select Committee report, U.S. House Select Committee on the CCP. Accessed August 27, 2026.
• DeepSeek aids China's military and evaded export controls - CNBC/Reuters, June 24, 2025. Accessed August 27, 2026.
• Why domestic AI companies cannot sign ZDR - Huxiu, Huxiu, June 11, 2026. Accessed August 27, 2026.
• Offering Zero Data Retention for frontier models, OpenAI, August 19, 2026. Accessed August 27, 2026.
• Cross-provider zero-data-retention commitments, OpenAgreements. Accessed August 27, 2026.
• DeepSeek and Chinese AI models GDPR data transfer analysis, AI Policy Desk, June 26, 2026. Accessed August 27, 2026.
• Are Chinese AI models safe for business - Layer3Labs, Layer3Labs, August 2, 2026. Accessed August 27, 2026.
• Is DeepSeek safe - Data retention - AWS Bedrock, AWS Documentation. Accessed August 27, 2026.
• DeepSeek - Models in Amazon Bedrock, AWS. Accessed August 27, 2026.
• Qwen models in Amazon Bedrock, AWS News Blog, September 18, 2025. Accessed August 27, 2026.
• Tutorial - Get started with DeepSeek-R1 in Azure AI Foundry, Microsoft Learn. Accessed August 27, 2026.
• Region availability for Foundry Models sold directly by Azure, Microsoft Learn. Accessed August 27, 2026.
• Together AI hosts DeepSeek on private US data centers - FAQs, Together AI. Accessed August 27, 2026.
• DeepSeek via Fireworks AI compliance - AI Provider Trust Registry, AI Provider Trust. Accessed August 27, 2026.
• OpenAI chases Anthropic biz customers with ZDR pledge - The Register, August 20, 2026. Accessed August 27, 2026.