For three quarters of a century the centre of gravity in computing research was a small constellation of American universities and American firms. The transistor itself was developed at Bell Labs in New Jersey in 1947 and exported across the world as a licensed American technology. The integrated circuit was demonstrated at Texas Instruments in Dallas and at Fairchild Semiconductor in Mountain View. The personal computer emerged from a garage in Los Altos and then from an office in Redmond. The browser was produced by a small Illinois company then bought by an even larger Washington firm. The smartphone was assembled in California and shipped across the Pacific. The cloud was based, in substantial part, on American hyperscalers and on American-designed processors running American-written instruction sets. By the end of the 2010s the dominant pre-trained language models were products of a single company in San Francisco and a small handful of close competitors in California, in Redmond, in London, and in Paris. The question of who held the weights and who held the data and who held the rights to redistribute the open weights of the most capable models was, briefly, a question about American firms, American copyright law, and American licensing choices.
That question was reopened in the winter of 2024 to 2025 by the release, under permissive licences, of a sequence of capable Chinese-developed language models. The DeepSeek-V3 release of late 2024, the DeepSeek-R1 release of January 2025, the Qwen2.5 and Qwen3 releases of 2024 and 2025, the GLM-4 release of 2024, the MiniMax M1 and M2 releases of the same period, the Hunyuan release of late 2024, the Kimi K2 release of 2025, and a dozen smaller contributions from a growing constellation of Chinese labs, distributed their model weights under open or partly-open licences on Hugging Face and GitHub. Within months the conversation in American machine-learning forums had shifted. The previously canonical reference points, the GPT-4 class models from OpenAI and the Claude class from Anthropic, were still the most capable closed-source models in the world in 2025 and 2026. But the reference point for what an American developer or a European developer or a Japanese developer could download, run, modify, fine-tune, audit, and redistribute without any corporate counterparty was a Chinese model. The fact that this was so mattered both as a technical phenomenon and as a policy problem. It is the focus of what follows.
The DeepSeek moment
The first decisive release of the period was DeepSeek-V3, which appeared in December 2024 under a permissive licence that allowed commercial use, modification, and redistribution. The model was a 671-billion-parameter mixture-of-experts design in which only 37 billion parameters were activated per token at inference, an architecture choice that allowed the model to be trained with a fraction of the compute that the same nominal capacity would have required under a denser parameterisation. DeepSeek-V3 was trained on a training corpus that combined curated web text, mathematics, code, and bilingual Chinese-English material. The training used mixed-precision arithmetic in the FP8 format, a technical innovation that the DeepSeek engineering team had published in detail in the months preceding the release, and the published reports suggested that the effective training cost had been substantially below the comparable cost of closed frontier models.
The January 2025 release of DeepSeek-R1 extended the same architectural foundation into the chain-of-thought domain. R1 was a reasoning model trained with reinforcement learning on top of the V3 base, and its release included a chain-of-thought distillation pipeline that allowed smaller variants of the model to be released in parallel. The release coincided with a sustained US stock market repricing in late January 2025 that materially affected the share prices of several American companies that had been assumed to hold the technical lead in the field. The market reaction, while dramatic, was less surprising than the early commentary suggested. DeepSeek-V3 and DeepSeek-R1 had set new frontier-class benchmark scores for open-weight models, and the inference cost of running them through the published APIs was several cents per million tokens, a price that placed them in direct competition with the cheaper tiers of the closed frontier models.
The technical reception of the two releases was overwhelmingly positive. The model card, the training recipe, the inference library, the eval results, and the underlying engineering notes were all published openly. Independent American and European academic groups reproduced the published benchmark numbers within weeks. Several large American technology firms, including at least three of the cloud providers, added DeepSeek-R1 to their model catalogues as a hosted endpoint within the first quarter of 2025. The fact that an American developer could run a DeepSeek model inside an American cloud, paying the cloud with dollars and charging their customers with dollars, became a routine option rather than an exotic one. The fact that the same developer could also run the same model on a workstation in their garage, paying nothing to DeepSeek but paying their own electricity bill, was no longer unusual either.
The reception outside the developer community was more equivocal. The American national security establishment had, by the early months of 2025, begun to identify DeepSeek as a system requiring careful evaluation. The model was produced by a Chinese high-tech firm with reported links to quantitative hedge fund capital and was hosted in part through infrastructure that intersected with public sector compute. The published model weights did not, in the traditional sense, transmit sensitive data: the data on which the model had been trained was not part of the release, and the production checkpoints that had been used for internal review were not part of the release either. The relationship between the released open weights and the actual training pipeline was, however, precisely the kind of question that intelligence services, regulators, and large corporate buyers were beginning to ask. The question that the open weights raised was not whether the model was safe by the ordinary standards of an open-source software project but whether a Chinese-developed system with the demonstrated capabilities of DeepSeek-R1 could safely be deployed in environments that handled sensitive American, British, Australian, or Japanese data.
The technical contribution that DeepSeek made to the open-source ecosystem was also consequential in a quieter way. The FP8 mixed-precision training recipe, the multi-head latent attention design, the auxiliary-loss-free load-balancing scheme, and the chain-of-thought distillation pipeline were each independently worth substantial amounts of engineering effort. By publishing the designs with the model, DeepSeek allowed a generation of American, European, and East Asian machine-learning engineers to incorporate the techniques into their own systems. The contribution to the global state of the art was the kind of contribution that, in a previous generation, would have come from an American lab and would have been available only to its corporate sponsor. The fact that it came from a Chinese lab and was available to the world was a substantial change in the technical culture of the field.
The Qwen wave and the rest of the stack
Where DeepSeek was the technical disruptor of the period, Qwen was the volume player. Alibaba’s Qwen team had been releasing models under open or partly-open licences since 2023. The Qwen2 series in mid-2024 and the Qwen2.5 series in late 2024 had covered a broad size range from sub-billion-parameter models to models in the tens of billions of parameters. The Qwen3 series of 2025 included variants aimed at the open-weight frontier. The Qwen models were notable for the depth of their non-English language coverage, particularly for the major East and Southeast Asian languages, Arabic, Russian, and the European languages that were common in the open-source developer community. The Qwen models also included a particularly strong code and tool-use family, and the Qwen-Coder models became a default choice for code completion in environments where developers were unwilling to send their source code to closed-source American endpoints.
The Qwen team’s licensing choices were distinctive. The Qwen models were typically released under the Apache 2.0 licence, with the largest variants under the Qwen Research Licence, a custom Alibaba-developed licence that allowed non-commercial use freely and required a separate commercial agreement for use at commercial scale. The licensing approach was not always as permissive as the Apache licence used by some of the smaller open-source models, but it was substantially more permissive than the closed frontier alternatives and was significantly more permissive than the terms of service of the equivalent American closed-source models.
The Alibaba cloud-internal deployment of Qwen was consequential. Alibaba Cloud was the largest Chinese hyperscaler and one of the three largest in the Asia-Pacific region. The combination of a hosted Qwen family of models on Alibaba Cloud and a sequence of open-weight Qwen models downloadable from Hugging Face gave Chinese developers and Chinese enterprises the same choice that their American counterparts were now negotiating: hosted closed-source American endpoint, hosted open-weight Chinese endpoint, or self-hosted open-weight Chinese model on their own infrastructure. The third option, self-hosting, was the part that mattered most for the question of who controlled the training, who controlled the data, and who controlled the weights in the deployed model. Self-hosting a Qwen or DeepSeek model on a Chinese enterprise’s own hardware, with the weights pulled from the published Hugging Face repository, allowed the enterprise to run the model without any cross-border data flow. The model itself was published, the weights were published, the licence was permissive, and the deployment was internal.
The Zhipu AI team contributed the GLM and ChatGLM families, with a sequence of releases in 2024 and 2025. The Zhipu models were technically competitive with the smaller Qwen and DeepSeek variants and were particularly strong on Chinese-language tasks. The 01.AI team contributed the Yi family, a set of dense and mixture-of-experts models that were notable for their long-context capabilities. The Baichuan team contributed the Baichuan family, a set of dense models that were less widely known outside China but that were substantially used within China. The Shanghai AI Lab contributed the InternLM and InternVL families. The Tencent team contributed the Hunyuan family, with a mixture-of-experts flagship. The Moonshot AI team contributed the Kimi family, with the Kimi K2 release of 2025 being particularly notable for long-context performance. The MiniMax team contributed a sequence of compact multimodal models.
The smaller Chinese model families
The constellation of smaller Chinese open-weight models was wider than the headline releases would suggest. By the end of 2025 there were more than fifty distinct families of Chinese-developed language models with published weights on Hugging Face, ranging in size from under a billion parameters to over a hundred billion, ranging in modality from pure text to multimodal text-and-image, and ranging in language coverage from Chinese-only to genuinely multilingual. The cluster was differentiated both technically and institutionally. Some of the releases came from research institutes associated with major Chinese universities; others came from independent Chinese startups; others came from the in-house research divisions of major Chinese technology firms; others came from Chinese state-owned research institutes.
The smaller models in the constellation often outperformed the closed frontier on specific benchmarks. Several of the most capable code-completion models in early 2025 were Chinese-developed and open-weight, partly because the Chinese open-source community had invested substantial effort into curated training corpora for code, partly because the small model size needed for self-hosted code completion incentivised aggressive optimisation, and partly because the licensing terms of the Chinese open-weight code models were substantially more permissive than the licensing terms of the equivalent American closed-source code models.
The Chinese-developed multimodal models were also a notable part of the wave. The Qwen-VL, InternVL, and MiniMax-VL models were all multimodal text-and-image models with published weights, all capable of document understanding, chart reading, and visual question answering at performance levels that the open-weight community had not previously seen. Several American enterprises deployed these models in production workflows that required document processing without sending the underlying documents to a closed-source American endpoint. The deployment was particularly notable in regulated industries, where the data-handling requirements of the closed-source American endpoints were either incompatible with the customers’ data residency requirements or incompatible with the customers’ willingness to share sensitive documents with third-party processors.
The cumulative effect of the smaller releases was that the open-weight ecosystem of late 2025 looked quite different from the open-weight ecosystem of 2023. In 2023, the only open-weight models competitive with the closed frontier were the LLaMA family from Meta and a small handful of European or American research outputs. By late 2025, the open-weight frontier was substantially populated by Chinese models. The ratio of Chinese to American contributions to the open-weight ecosystem had shifted from roughly one-to-three in 2023 to roughly three-to-two in 2025, with the share of European contributions remaining roughly stable and the share of other Asian contributions rising but from a low base. The shift was not a decline in the absolute number of American open-weight contributions, which continued to grow, but a substantial rise in the relative share of Chinese contributions.
The Hugging Face view of the open-weight frontier
The clearest empirical window on the open-weight AI ecosystem in 2024, 2025, and 2026 was the Hugging Face model registry. The registry had grown from a small niche infrastructure in 2020 to the dominant catalogue of pre-trained machine-learning models by 2024. By late 2024 it hosted roughly two million pre-trained models of all kinds, of which the largest and most actively downloaded subset were large language models. By late 2025 it hosted a substantially larger set, with the proportion of Chinese-origin downloads having risen substantially through the period. The daily download ranking showed, in late 2025 and into 2026, that the five most-downloaded open-weight large language models were typically one or two Meta LLaMA variants, two or three Qwen variants, one or two DeepSeek variants, and one or two of the smaller Chinese families. The Hugging Face Open LLM Leaderboard, which ranked submitted models by community-evaluated benchmark performance, was substantially populated by Chinese-origin models at the top of the leaderboard by late 2025.
The Hugging Face download statistics were the single most concrete indicator of the shift. The DeepSeek-R1 download count was, by mid-2025, in the tens of millions of model-card downloads from the registry. The Qwen3 download counts were comparable in scale. The download was not, by itself, a measure of use: a model could be downloaded and never run, or downloaded and run for a single test, or downloaded and run in production. But the download count was a measure of awareness, and the awareness of Chinese open-weight models among the global developer community was by mid-2025 nearly universal. The awareness had, importantly, propagated through the developer community without significant American or European institutional intermediation. The propagation was through the direct download activity of individual developers, through the derivative fine-tunes that other developers had produced and made available, and through the technical discussions in the developer forums that the derivative ecosystem had produced.
The Hugging Face Enterprise Hub, the business-oriented tier of the service, also saw substantial enterprise adoption of Chinese open-weight models in 2025 and 2026. Several large enterprises, particularly in the financial services and the pharmaceutical industries, deployed Chinese open-weight models in production within their internal Hugging Face Enterprise Hub environments. The deployment had the same compliance characteristics as any other open-weight deployment. The enterprise was the operator of the inference infrastructure; the enterprise was the custodian of the model weights; the enterprise was responsible for the data-handling practices of the deployment. The Chinese origin of the model weights was a part of the supplier risk assessment but not, by itself, a barrier to deployment. The Hugging Face Enterprise Hub’s compliance documentation was updated through 2025 and 2026 to address the particular questions that enterprise customers had been asking about Chinese open-weight models, including the data-residency of the inference infrastructure, the auditability of the upstream training process, and the procedures for re-versioning or rolling back a model.
How American developers actually used them
The way American developers actually used Chinese-developed open-weight models in 2025 and 2026 was, in most respects, identical to the way they used any other open-weight model. The development workflow involved downloading the weights from Hugging Face or ModelScope, loading them onto a development workstation or a self-managed cluster, fine-tuning them on task-specific data with the standard PyTorch or JAX tooling, evaluating them against task-specific benchmarks, and deploying the resulting system into a production environment that could be either on-premises or cloud-based. The Chinese origin of the model weights was, in most cases, less consequential to the day-to-day workflow than the licence terms, the documentation quality, the availability of community checkpoints, and the responsiveness of the upstream maintainers to bug reports and feature requests.
There were, however, three substantial differences between using Chinese open-weight models and using American closed-source models. The first was the absence of a hosting endpoint operated by the original developer. Closed-source American models were typically accessed through APIs operated by the developing firm. The Chinese open-weight models, by contrast, were typically distributed as weights rather than as endpoints. The model user was therefore responsible for operating their own inference infrastructure, with the associated capex, opex, and operational complexity. The trade-off was substantial. The capex and opex of running a model on one’s own hardware were not zero, but the per-token cost of inference, once the hardware was in place, was a small fraction of the per-token cost of an API endpoint. The economic case for self-hosting was strongest for applications with high token volumes and predictable load, and weakest for experimental or low-volume applications. The shift in the open-weight ecosystem therefore pushed the economics of large-scale inference in the direction of on-premises or hosted open-weight models.
The second difference was the auditability of the training data. Closed-source American models did not publish training data, and the model user was required to take the published safety card and the documented benchmark performance on trust. Open-weight models, by contrast, often published some account of the training data, with the level of detail varying from a brief characterisation in the model card to a detailed paper describing the dataset construction. The Chinese open-weight models were, in this respect, similar to other open-weight models: the documentation was imperfect, the data sources were partially disclosed, and the training recipe was published at a level of detail that allowed reproduction.
The third difference was the geopolitical risk. The closed-source American models were produced by American firms operating under American jurisdiction, subject to American export controls, and exposed to the American legal system. The Chinese open-weight models were produced by Chinese firms operating under Chinese jurisdiction, subject to Chinese export controls, and exposed to the Chinese legal system. The model user, when downloading and using the model, was making a judgement about the relative risk of the two jurisdictions. The judgement was based on the user’s own national-security posture, the user’s relationship with the relevant governments, the user’s industry, the user’s customer base, and the user’s own legal advice. The judgement was not a matter of technical fitness alone.
The activity that most clearly embodied the new ecosystem was the development of fine-tuned derivatives. By mid-2025, Hugging Face hosted tens of thousands of community fine-tuned versions of DeepSeek-R1, Qwen2.5, and Qwen3, distributed across the full range of specialised tasks from medical question answering to legal document review, from code completion to scientific writing, from chemistry to materials science, and from support for less-resourced languages to domain-specific reasoning. The community distribution was substantially the same as the LLaMA derivative ecosystem had been in 2023, but the underlying base model was now a Chinese open-weight model rather than an American one. The derivative ecosystem was, in other words, an American-Chinese hybrid, with the upstream weights coming from China and the downstream fine-tuning coming from American, European, and Asian developers and researchers.
The United States state bans and the federal posture
The first American policy responses to the rise of Chinese open-weight models were not federal. They were state-level. The first state to move was Texas, whose Department of Information Resources issued guidance in early 2025 restricting the use of DeepSeek on state government devices. The Texas action was followed by similar guidance from several other states, including Virginia, New York, Iowa, and Oklahoma. The state guidance typically did not ban the use of Chinese open-weight models entirely; it restricted the use of specific models on state government devices and on state government networks. The state action was, in most cases, a precautionary measure driven by concerns about data exfiltration and about the possibility that data submitted to the model could be used to train future versions of the same model.
The federal response was slower and more fragmented. The FBI and the Department of Homeland Security issued advisories in 2025 highlighting the risks associated with Chinese-developed AI systems, and the Cybersecurity and Infrastructure Security Agency (CISA) included Chinese open-weight models in its broader advisories on software supply chain risk. The Office of the Director of National Intelligence identified Chinese-developed AI as a focus area in its 2025 threat assessment. The Department of Commerce, through the Bureau of Industry and Security, continued to maintain the export controls that had been placed on advanced AI accelerators in 2022 and 2023, with the controls expanded in late 2024 to cover additional categories of accelerator and additional end-use scenarios.
The federal regulatory landscape began to consolidate in early 2026. The Executive Order on AI Safety issued in late 2023 had been the first federal regulatory framework that directly addressed frontier AI models. The framework had been substantially expanded by subsequent executive action and by agency rulemaking. By 2026 the federal framework included requirements for the disclosure of training data sources for models above a compute threshold, requirements for the disclosure of red-teaming and evaluation results, requirements for the documentation of model lineage, and requirements for the tracking of model weights for models trained above the highest compute threshold. The framework applied, in principle, equally to American-developed and Chinese-developed models used in the United States.
The Congressional response was more contentious. The RESTRICT Act, which had been proposed in 2023 and reintroduced in subsequent Congresses, would have given the executive branch authority to restrict transactions involving foreign adversaries in critical technology sectors including AI. The bill was not enacted, but its provisions shaped the debate around AI-related restrictions through the period. Other Congressional proposals addressed specific aspects of the problem: bills that would have required federal agencies to evaluate the use of Chinese-developed AI systems, bills that would have restricted the use of Chinese-developed AI in federal procurement, bills that would have required the disclosure of training data sources for models used in regulated industries. None of these bills was enacted in the period, but the discussion shaped the federal procurement guidance issued by the General Services Administration in 2025 and updated in 2026.
The American corporate response was heterogeneous. Some American firms, particularly those in regulated industries, chose to restrict the use of Chinese-developed AI in their production environments. Banks, defence contractors, healthcare providers, and federal contractors were the most notable groups. Other American firms, particularly those in unregulated consumer-facing industries, integrated Chinese open-weight models into their products either as primary or as fallback models. The integration was sometimes disclosed and sometimes not. The disclosure was not, by the end of the period, a regulatory requirement for most use cases.
The American developer community remained divided. Surveys published in 2025 and 2026 indicated that a majority of American machine-learning developers had downloaded at least one Chinese open-weight model for evaluation or use, that a substantial minority used Chinese open-weight models in production, and that a small minority used them as the primary model for their principal workloads. The American developer community’s reaction to the state bans and the federal guidance was, broadly, scepticism of the bans as overly broad and overly precautionary, combined with a recognition that some use cases, particularly those involving sensitive data or regulated industries, did warrant some caution. The developer community’s reaction was not monolithic but it was, on the whole, more nuanced than the security establishment’s.
The United Kingdom and the European Union
The British response to the rise of Chinese open-weight AI was, in many respects, the most carefully calibrated of the Western responses. The British AI Security Institute, established in late 2023 as the AI Safety Institute and renamed in 2025, had been at the centre of the international effort to evaluate frontier AI systems. The Institute’s evaluation programme included Chinese-developed models as well as American-developed ones, and the Institute’s published evaluation reports of late 2024 and 2025 covered several Chinese models including the DeepSeek and Qwen families. The British approach was based on the position that the appropriate response to capable foreign models was rigorous evaluation rather than blanket restriction.
The British National Cyber Security Centre (NCSC) issued guidance in 2025 on the use of foreign-developed AI systems in critical national infrastructure. The guidance was framework-based rather than rule-based, requiring organisations to assess the provenance, the supply chain, the model lineage, and the deployment context of any foreign-developed AI they considered using. The guidance did not name China specifically; it applied to all foreign-developed AI models, including American ones. The British approach was unusual in its breadth, treating the question of how to evaluate foreign AI as a question of supply-chain security rather than as a question of bilateral relations.
The British academic community was, broadly, more willing than the American academic community to use and publish research based on Chinese open-weight models. Several British universities, including the University of Oxford, the University of Cambridge, Imperial College London, and University College London, had research groups that used Chinese open-weight models in published research. The British Computer Society and the British Academy had published position statements in 2025 and 2026 defending the principle of open scientific collaboration with international partners, while also acknowledging the legitimacy of supply-chain concerns.
The European Union response was initially fragmented. The Italian data protection authority, the Garante, was the first European regulator to take formal action against a Chinese AI service. In early 2025 the Garante ordered the suspension of the DeepSeek consumer chatbot in Italy on the grounds that the service did not adequately disclose its data-handling practices and did not adequately comply with the EU’s General Data Protection Regulation. The Italian action was followed by similar actions in several other EU jurisdictions, including France, the Netherlands, and Greece. The actions were, in most cases, regulatory rather than political, addressing the data-handling practices of the consumer chatbot service rather than the open-weight model distributions.
The European Union’s AI Act, which entered into force in mid-2024 and began to be enforced in phases through 2025 and 2026, addressed the use of AI systems in the European Union. The AI Act did not, in its initial formulations, distinguish between American-developed and Chinese-developed models. The Act applied to all AI systems used in the European Union, regardless of the country of origin, with obligations scaled to the risk category of the system. The AI Act’s general-purpose model provisions, which applied to the most capable open-weight and closed-weight models, required providers of such models to publish training data summaries, evaluation results, and other technical documentation. The provisions applied, in principle, to Chinese open-weight models used in the European Union, and the open-weight model maintainers had to decide whether to comply with the EU requirements or to accept that their models would not be used in regulated contexts within the EU.
The German and French positions were more politically nuanced than the Italian or Dutch positions. Both governments had substantial commercial relationships with Chinese counterparts and were reluctant to take positions that would have been seen in Beijing as a direct challenge. The German position, articulated through the Federal Office for Information Security (BSI), was that the use of Chinese AI in critical infrastructure should be subject to case-by-case evaluation rather than blanket restriction. The French position, articulated through the National Cybersecurity Agency (ANSSI), was similar in substance but with a more explicit acknowledgement of the strategic significance of the AI question. Both positions were consistent with the European Union’s overall posture.
Australia, Canada, Japan, South Korea, and India
Australia was, after the United States, the Western country that took the most explicit action against Chinese-developed AI. The Australian government banned DeepSeek from government devices in early 2025, citing security concerns. The Australian ban was followed by similar guidance in several other Australian jurisdictions. The Australian position was rooted in the country’s long-standing concerns about foreign interference in critical infrastructure and in research institutions. The position was broadly consistent with the Australian posture toward other Chinese technology products, particularly the Huawei equipment ban of 2018 and the broader Telecommunications Sector Security Reform of 2018.
Canada’s posture was more deliberative. The Canadian government commissioned reviews in 2025 of the risks associated with Chinese-developed AI, with the reviews covering both the open-weight models and the consumer chatbot services. The reviews were published in 2026 and recommended a framework-based approach similar to the British model, with risk-based assessments of specific deployments rather than blanket restrictions. The Canadian posture was influenced by the country’s substantial research collaborations with Chinese counterparts in the AI field, and the country’s open-source developer community had been an active participant in the open-weight model ecosystem since 2023.
Japan’s posture was, in some respects, the most permissive of the major Western positions. The Japanese Ministry of Economy, Trade and Industry (METI) published guidance in 2025 on the use of foreign-developed AI systems, with the guidance recommending that Japanese organisations evaluate the supply chain of AI systems but not recommending a blanket ban on Chinese-developed systems. The Japanese posture was influenced by the country’s substantial commercial relationships with Chinese counterparts and by the country’s heavy dependence on Chinese rare-earth supplies for the production of advanced electronics. The posture was also influenced by the Japanese tradition of evaluating AI risk through case studies rather than through blanket restrictions.
South Korea’s posture was the most restrictive of the major Western positions. The South Korean government removed DeepSeek’s consumer application from the Google Play and Apple App Store in South Korea in early 2025, citing privacy and security concerns. The South Korean action was followed by similar action in Indonesia and Vietnam. The South Korean posture was influenced by the country’s highly developed regulatory apparatus for information security, the country’s substantial exposure to Chinese consumer products, and the country’s sensitivity to data sovereignty issues in light of the country’s historical experience with foreign intelligence services.
India’s posture was, by the end of the period, the most strategic. The Indian government had been investing heavily in domestic AI capabilities through the IndiaAI Mission announced in 2024 and funded through the IndiaAI Future Skills programme. The Indian position on foreign-developed AI, including Chinese-developed AI, was articulated through the Ministry of Electronics and Information Technology (MeitY) and was, on the whole, more welcoming than either the American or European positions. The Indian position was influenced by the country’s substantial open-source developer community, which had been an active participant in the open-weight AI ecosystem since 2023. The Indian position was also influenced by the country’s commercial and strategic interest in maintaining good relations with both the United States and China.
The cumulative effect of the policies in the United States, the United Kingdom, the European Union, Australia, Canada, Japan, South Korea, and India was a fragmented but broadly coordinated response. None of the Western governments had enacted a blanket ban on the use of Chinese open-weight AI systems. Several had enacted targeted restrictions in specific contexts (government devices, critical infrastructure, certain regulated industries). Several had published framework-based guidance requiring organisations to evaluate the supply chain of AI systems they used. Several had encouraged domestic AI development through public investment. The cumulative effect was not the open-source decoupling that some commentators had predicted, but it was also not the unconstrained openness that some commentators had hoped for. The pattern that emerged was a regulated openness, in which foreign-developed AI systems could be deployed in many contexts subject to evaluation and risk assessment.
The semiconductor and infrastructure angle
The Chinese open-weight AI moment was, in part, a consequence of the American semiconductor export controls that had been in place since 2022 and 2023. The controls, administered by the Bureau of Industry and Security, prohibited the export to China of advanced AI accelerators including the Nvidia H100, the H200, the A100, the A800, the B100, and similar parts from AMD and Intel. The controls were progressively tightened through 2023, 2024, and 2025, with each iteration closing loopholes that had allowed controlled chips to reach Chinese customers through third-country distribution. The Biden AI Diffusion Rule of January 2025 added a tiered licensing regime for the export of advanced AI accelerators to additional countries, but the Rule was substantially modified by the incoming Trump administration in 2025 and replaced by a different framework.
The Chinese response to the export controls was substantial and strategic. The Chinese government had, through the New Generation AI Development Plan of 2017 and the follow-on funding mechanisms of subsequent years, invested heavily in domestic AI accelerator development. The principal domestic suppliers included Huawei (with the Ascend series), Cambricon (with the Siyuan series), Biren Technology (with the BR100), Moore Threads (with the MTT series), and Iluvatar CoreX (with the BI series). The domestic accelerators varied substantially in capability. The Huawei Ascend 910B and 910C approached the performance of the Nvidia H100 on inference but lagged on training. The Cambricon Siyuan 590 was a more specialised inference accelerator. The domestic accelerator ecosystem as a whole was constrained by the trailing-edge of the domestic semiconductor manufacturing base, with the most advanced Chinese fabs operating at roughly the 7-nanometer node while the leading-edge foreign fabs operated at the 3-nanometer node.
The training of frontier AI models required substantial compute resources, and the export controls had materially constrained the Chinese ability to acquire cutting-edge compute. The DeepSeek team had reported that the training of DeepSeek-V3 had used a mixed fleet of Nvidia-controlled and Huawei accelerators, with substantial engineering effort to make the training run on the heterogeneous hardware. The engineering effort paid off in the form of techniques that were subsequently published openly and adopted internationally. The pattern of constrained compute producing engineering innovation that benefited the broader ecosystem was ironic and consistent with the historical pattern of constraint-driven innovation in the semiconductor industry.
The inference infrastructure was less constrained. The Chinese cloud-internal deployment of Chinese open-weight models was supported by Chinese accelerator hardware in substantial part, with the inference workloads running on Huawei Ascend series and Cambricon Siyuan series accelerators at substantially lower cost than the equivalent workloads would have run on Nvidia H100 hardware. The cost structure was consequential for the economics of Chinese AI deployment and for the cost structure of Chinese AI exports. The Chinese providers were able to offer competitive API pricing partly because the underlying compute cost was lower than the equivalent American compute cost.
The next eighteen months
The direction of the next eighteen months was, by late 2026, becoming visible. The most likely outcome was a sustained division of the AI ecosystem into several parallel branches: an American closed-source branch, anchored on GPT-5 and Claude and the equivalent closed models from Google and Meta; a Chinese open-weight branch, anchored on the DeepSeek, Qwen, GLM, and equivalent open-weight families; and a smaller European and Japanese branch contributing to both. The branches would be partly interoperable, with American and Chinese models accessible through standard APIs and through standard inference toolchains, and partly fragmentary, with regulatory restrictions making certain cross-border deployments legally or practically infeasible.
The most likely pattern of deployment was, on the open-weight side, a continued integration of Chinese open-weight models into American, European, Japanese, and Indian production workflows, subject to case-by-case evaluation by the deploying organisations. The case-by-case evaluation was likely to be more permissive in unregulated industries and more restrictive in regulated industries. The cumulative effect was likely to be a substantial continued use of Chinese open-weight models outside China, with the most popular base models continuing to be DeepSeek, Qwen, GLM, and the smaller Chinese models.
The most likely pattern of model development was a continued cycle of releases in the major Chinese model families, with each release improving on the predecessor along several dimensions including benchmark performance, inference cost, and language coverage. The cycle was likely to continue to be driven by substantial Chinese investment in AI research and development, by a sustained academic ecosystem that was contributing to the global state of the art, and by a competitive domestic market that was keeping the major Chinese model providers honest about their release cadence.
The most likely geopolitical pattern was a continued managed decoupling. The decoupling was likely to be less total than some commentators had predicted and more total than others had hoped. The decoupling was likely to be particularly visible in the export-control dimension, with continued restrictions on the export of advanced semiconductors to China, and continued Chinese efforts to substitute domestic chips for imported chips. The decoupling was likely to be less visible in the open-source dimension, with the Chinese open-weight models continuing to be available globally and the derivatives continuing to be developed across the global research community.
The most consequential single question for the period was whether the open-weight distribution channel would remain genuinely open. The early indications were that it would. The Hugging Face model registry continued to host Chinese open-weight models without restriction through the period. The Chinese government’s posture toward outbound distribution of model weights was, by the end of the period, supportive of the open-weight strategy as a means of international influence. The American government did not have, by the end of the period, a clear policy posture on the inbound distribution of Chinese open-weight models, with the most active policies being the state-level bans and the federal procurement guidance. The British position was permissive at the framework level. The European position was framework-based rather than blanket.
Reading the global pattern
The longer significance of the rise of Chinese open-weight AI was, by the end of 2026, becoming clearer. The technical innovation that DeepSeek and Qwen and GLM had contributed to the global state of the art was substantial, with several specific contributions that would have been noteworthy even in a period of less constrained technical exchange. The community distribution of derivative fine-tuned models was substantial. The deployment of Chinese open-weight models in regulated and unregulated production environments outside China was substantial. The pattern that was emerging was not, on the whole, a story of Chinese dominance or American decline, but a story of a substantially more plural global AI ecosystem in which the open-weight frontier was no longer the sole preserve of American institutions.
The longer significance for the international system was also becoming clearer. The rise of Chinese open-weight AI was, in the medium term, a substantial contribution to the global research community. The same rise was, in the short term, a source of friction in the American-Chinese bilateral relationship and in the American relationship with its allies and partners. The friction was not, on the whole, a friction that would prevent continued open-weight distribution; the friction was, on the whole, a friction that would shape the regulatory and procurement environment in which the distribution took place.
The longer significance for the regulation of AI was also becoming clearer. The fact that the open-weight frontier was no longer solely American had made the regulatory task more complicated. American AI safety regulation that implicitly assumed that the most capable AI models would be developed by American firms had to be revised to accommodate the reality that some of the most capable open-weight models were being developed by Chinese firms under Chinese regulatory and policy frameworks. The international coordination effort that had been initiated at the Bletchley AI Safety Summit in late 2023 had been sustained through the AI Seoul Summit of 2024 and the AI Paris Summit of 2025, but the international coordination effort had not produced a binding international framework. The international coordination effort had, however, produced substantial convergence on the principles of evaluation, transparency, and risk assessment. The Chinese AI Safety Institute, established in 2025, had participated in the international evaluation network alongside the British AI Security Institute and other national institutes.
The longer significance for the open-source tradition itself was also becoming clearer. The open-weight AI moment was, on the whole, a vindication of the open-source tradition as a means of distributing complex technical artefacts. The tradition had been established in the early 1990s with the release of the Linux kernel and had been carried into the 2000s by the Apache Foundation, the Mozilla Foundation, and the World Wide Web Consortium. The release of the DeepSeek, Qwen, GLM, and MiniMax models in 2024 and 2025 extended the tradition into a domain where the distributed artefact was substantially more capable and substantially more socially consequential than any artefact the open-source community had previously produced. The technical achievement of the open-weight models was, in this sense, an extension of a long tradition rather than an interruption of it. The question of how to govern the distribution of these models was a question that the open-source community had been working on for thirty years and that the broader community was now confronting in a new form.
The Chinese open-weight AI moment was, by the end of 2026, neither the catastrophe that some American commentators had predicted nor the unalloyed triumph that some Chinese commentators had hoped for. It was, on the whole, a substantial change in the global distribution of AI capability and AI governance, with substantial benefits and substantial risks. The pattern that was emerging was a regulated openness, in which foreign-developed AI was available under framework-based oversight rather than blanket restriction, and in which the open-weight frontier was contributed to by a wider range of national and institutional origins than it had been a generation before. The pattern was a substantial change. The pattern was not, however, a final state. The next several years would be years in which the pattern would be tested, refined, and reshaped by the continued interaction of technical, commercial, and geopolitical forces.
The licence anatomy and the compliance story
The licensing of the major Chinese open-weight models was, in its details, more varied than the Apache-or-bust framing of the early open-source software community. The Apache 2.0 licence used by DeepSeek, by several of the smaller Zhipu releases, and by parts of the Qwen family was the most permissive: it allowed commercial use, modification, and redistribution with attribution, with no copyleft and no field-of-use restriction. The MIT licence used by some Chinese model families was similar in substance, with the only material difference being a more permissive attribution clause. The Qwen Research Licence, used by the larger Qwen variants, allowed non-commercial use freely but required a separate commercial agreement for use at commercial scale. The Llama-style community licence, used by some smaller Chinese families, imposed use-based restrictions on the largest users. The bespoke Chinese licences, used by Hunyuan and a few other models, varied widely, with some allowing commercial redistribution and some allowing only internal use.
The licensing variation made enterprise adoption more complex than the underlying technology. The enterprise adoption of an open-weight model was not a single decision; it was a series of decisions about the specific licence terms, the specific deployment context, the specific data-handling requirements of the customer’s industry, and the specific legal exposure of the deployment. The licensing decisions were typically made by the enterprise’s legal team in consultation with the enterprise’s procurement and security teams, with the technical decisions playing a role but not a dominant role. The technical fitness for purpose was, in most cases, a necessary but not sufficient condition for enterprise adoption.
The compliance burden of using a Chinese open-weight model in a regulated industry was not, on the whole, substantially higher than the compliance burden of using an American closed-source model. The compliance documentation required for a regulated-industry deployment included an attestation of the supplier’s data-handling practices, an attestation of the model provenance, a description of the deployment’s failure modes and recovery procedures, and a description of the deployment’s update and rollback procedures. The compliance documentation required for a Chinese open-weight model had the same structure as the compliance documentation required for an American closed-source model, with the addition of an attestation about the country of origin and the foreign-jurisdiction exposure. The compliance burden was therefore similar in kind but larger in volume for the foreign-origin deployment.
The compliance story did, however, vary substantially by jurisdiction. The United States, with the most fragmented regulatory landscape and the most active state-level restrictions, imposed the most varied compliance burden. The United Kingdom, with the most framework-based approach, imposed the most coherent compliance burden. The European Union, with the AI Act and the GDPR as the dominant frameworks, imposed the most prescriptive compliance burden, particularly for deployments that interacted with personal data. The Australian, Canadian, Japanese, and South Korean positions were, in their substance, broadly similar to the British framework-based approach but with variations in the specifics of the assessment criteria.
The cost of compliance was, by late 2026, large enough to be a meaningful driver of deployment decisions. A large enterprise deploying a frontier open-weight model in a regulated context might spend several hundred thousand dollars on the compliance assessment and the related legal work, with the cost spread over a quarter and absorbed as a one-time cost of deployment. The cost was the same whether the model was Chinese or American, open-weight or closed-source, deployed internally or offered as a service. The compliance cost was, however, a meaningful structural difference between large-enterprise deployments and small-business deployments. Small businesses typically used the Chinese open-weight models through community-hosted inference endpoints, with the compliance burden falling on the inference provider rather than on the small business. The community-hosted endpoints, in turn, varied substantially in their compliance maturity, with some operated by well-resourced firms and some operated by individual volunteers.
The next generation, the frontier models, and the trajectory
The next generation of open-weight models from Chinese labs was, by late 2026, partially visible through preprints, conference papers, and infrastructure investments. The trajectory was toward larger effective context windows, more efficient inference architectures, deeper integration of multimodal capabilities, more sophisticated chain-of-thought reasoning, and more capable agentic tool use. The trajectory was, in its broad strokes, the same trajectory that American closed-source models were on, with the open-weight models running roughly a year behind the closed frontier on the most demanding benchmarks and roughly level with the closed frontier on the more routine benchmarks. The gap between open-weight and closed-frontier had narrowed through 2025 and into 2026, with the narrowing driven both by the open-weight model development effort and by the closed-source model consolidation of API pricing.
The frontier of open-weight model training was constrained by the compute environment. The frontier training runs of late 2025 and 2026 used on the order of tens of thousands of advanced AI accelerators, sustained over weeks of training. The Chinese labs had access to such compute through a combination of Huawei Ascend clusters, Cambricon Siyuan clusters, and access to Nvidia-equipped clusters in third countries. The aggregate compute capacity of the Chinese frontier-lab cluster was substantial but not unlimited. The aggregate compute capacity of the American frontier-lab cluster was larger but the capacity was split across multiple competing firms. The compute-access asymmetry was a continuing constraint on the rate at which Chinese open-weight frontier models could be advanced, but the constraint was being worked on actively by both the Chinese government and the Chinese firms, with substantial investment in domestic accelerator development, in domestic foundry capacity, and in domestic packaging capacity.
The frontier of agentic AI was the area where the gap between the open-weight and closed-source ecosystems was most pronounced. The closed-source American frontier firms had, by late 2025 and into 2026, made substantial progress on agentic capabilities, with the closed frontier models capable of long-horizon planning, multi-step tool use, and self-correction in complex workflows. The open-weight frontier models were catching up but were, at the end of 2026, still demonstrably behind on the most demanding agentic evaluations. The catching-up was driven by the open-weight community’s substantial investment in agentic training data, in tool-use fine-tuning corpora, and in agentic evaluation benchmarks. The catching-up was expected, by most informed observers, to continue, with the gap narrowed but not closed by mid-2027.
The frontier of multimodal AI was an area where Chinese open-weight models had, in some respects, run ahead of the closed-source frontier. The Chinese laboratories had invested substantially in vision-language and audio-language models, with the Qwen-VL, InternVL, and several smaller Chinese multimodal models demonstrating capabilities on document understanding and visual reasoning that were comparable to the best American closed-source multimodal models at the end of 2026. The Chinese investment in multimodal AI was driven by substantial domestic demand from the Chinese e-commerce industry, the Chinese logistics industry, the Chinese surveillance industry, and the Chinese content moderation industry. The investment had spillover benefits for the global open-weight ecosystem, with the multimodal capabilities of Chinese-developed models being adopted by developers in regulated industries outside China.
The long-term trajectory of the open-weight AI ecosystem was, by the end of 2026, more difficult to read. The most likely single scenario was the scenario in which the open-weight and closed-weight branches of the ecosystem continued to coexist, with the branches being partially interoperable through standards and partly fragmented by regulation. The coexistence was likely to be characterised by continued cross-pollination, with the technical contributions of one branch being adopted by the other, and with the deployment stories of one branch informing the deployment stories of the other. The coexistence was likely to be characterised, also, by continuing policy friction, with the friction manifesting in state-level restrictions, in regulatory uncertainty, and in compliance costs. The coexistence was unlikely to resolve into either pure decoupling or pure openness. The coexistence was, in other words, the regulated openness pattern that had been emerging through the period and that was likely to be the working order of the global AI ecosystem for several years to come.
Training data, provenance, and the audit question
The most contested single aspect of the Chinese open-weight moment in the broader policy debate was not the technical capability of the models. It was the question of what the models had been trained on. The DeepSeek-V3 model card stated that the model had been trained on a corpus of approximately 14.8 trillion tokens drawn from web text, code repositories, mathematical corpora, academic publications, and bilingual Chinese-English material, with a deduplication pipeline applied to reduce memorisation. The Qwen3 model card described a similar pipeline, with a distinctive emphasis on the multilingual coverage and the inclusion of substantial Chinese-language web content. The model cards were detailed enough to be useful, but they were not detailed enough to be verifiable. The actual contents of the training corpora were the responsibility of the model developers, and the model developers had, in each case, provided some documentation of the data sources and the data processing pipeline without providing the full data itself.
The audit-trail question was, on the surface, a question about provenance. Where did the training data come from? Was it licensed for training use? Was it compliant with the relevant data-protection requirements? Was it compliant with the relevant copyright requirements? The Chinese open-weight model developers had, in the model cards and the accompanying technical reports, addressed these questions at a high level. The high-level addresses were not, however, the same as a third-party audit of the actual training data. The third-party audit was, in the case of the Chinese open-weight models, difficult to perform, partly because the data was held by the Chinese developers and partly because the data was so large that any audit would have been a substantial undertaking in itself.
The audit-trail question was, in practice, a question about trust. The model user, when deploying a model in a production environment, was making a judgement about the trustworthiness of the model developer’s data-handling practices. The judgement was based on the published documentation, the developer’s reputation, the developer’s compliance with relevant regulations, and the developer’s responsiveness to questions. The judgement was not, in most cases, verifiable through technical means alone. The judgement was, in the case of Chinese developers, additionally informed by the broader relationship between the developer’s jurisdiction and the user’s jurisdiction.
The audit-trail question had a particular shape with respect to Chinese-language sources. Several of the Chinese open-weight models had been trained on corpora that included substantial volumes of Chinese-language web content, including content from Chinese social media platforms, Chinese academic databases, and Chinese news sites. The Chinese-language content in the training corpus was substantial because the Chinese-language content on the open web was substantial. The Chinese-language content also raised particular questions about Chinese government censorship practices, Chinese platform content moderation, and Chinese state surveillance of online speech. The models trained on this content might have absorbed, into their weights, the censorship patterns and the moderation patterns that the content reflected. The absorption was not, in technical terms, a transmission of censorship; it was a statistical reflection of the content the models had been trained on, with the reflection potentially affecting the model’s outputs in ways that the model developer might not have intended and might not have full control over.
The English-language content in the training corpus raised analogous questions about Western moderation and censorship practices, with the English-language content of some American-developed models having absorbed similar effects from the English-language internet. The question was not, in other words, a question that was specific to Chinese open-weight models. The question was, however, a question that was particularly visible in the discourse around Chinese open-weight models, because the discourse was framed by the broader American-Chinese bilateral relationship and by the heightened sensitivity of Western audiences to Chinese state-mediated content. The audit-trail question was therefore as much a question about the politics of the discourse as it was a question about the technical content of the training data.
The practical response of the model-deploying organisations was, broadly, an acceptance that the audit-trail question could not be fully resolved through technical means, and a corresponding reliance on the framework-based assessments of supplier risk. The framework-based assessment evaluated the supplier on dimensions including jurisdiction, governance, compliance posture, transparency of operations, and willingness to be subject to third-party audits. The framework-based assessment was the same framework-based assessment that had been developed for software supply-chain risk more generally, and it applied to open-weight AI models with relatively modest modifications. The framework-based assessment did not resolve the audit-trail question but it did make the question tractable, in the sense that the question became a question about the supplier rather than a question about the data.
A postscript on pace and posture
One of the more arresting features of the Chinese open-weight AI moment, looking back at the period from late 2026, was the sheer pace of the release cadence. By the time the Qwen3 series was widely deployed in mid-2025, the Qwen research team had already published preprints describing the architecture choices for the Qwen3.5 series. By the time the DeepSeek-R2 release happened in late 2025, the team had begun preliminary public discussions about DeepSeek-R3. The cadence was fast enough to feel, to the developers who were watching, like an inversion of the cadence of the previous decade. The previous decade had, for open-weight AI, been a cadence driven by American labs and paced by the budget cycles of those labs. The current cadence was a cadence driven by Chinese labs and paced by the competitive dynamics of the Chinese AI market.
The posture of the major Chinese open-weight labs toward the global developer community was, in parallel, a substantial change from the posture of the previous decade. The Chinese labs were, on the whole, more willing than the major American frontier firms to share their architectures, their training recipes, and their ablations, and they were more willing to make their models available for free or at near-cost prices. The posture was not the same as the posture of the academic open-source community of the 1990s and the 2000s; the posture involved substantial commercial considerations, including the competitive positioning of the parent firms. The posture was, however, substantially more permissive than the posture of the American closed frontier firms, who were, in some cases, substantially less willing to share the underlying technical detail.
What the global developer community has done with the posture is, on the whole, what the global developer community has done with any well-resourced open-source distribution: it has used the open weights to build derivative models, derivative products, and derivative businesses. The derivative economy around Chinese open-weight models was, by late 2026, a substantial economy in its own right, with hundreds of firms in multiple countries building products and services that depended on Chinese open-weight model releases. The firms included small businesses and startups in the United States, in Europe, in India, in Latin America, in Africa, in the Middle East, and in Southeast Asia. The firms included, as well, large enterprises that had internalised the open-weight derivatives into their proprietary product stacks.
The question of whether the posture would persist was, by late 2026, still open. The Chinese government’s posture toward outbound distribution of model weights was supportive of the open-weight strategy but was not unconditional. The major Chinese frontier firms’ posture was supportive of continued open-weight releases but was conditional on the commercial cost of doing so. The global developer community’s posture was that of an enthusiastic user community with substantial expectations of continued releases. The combination of these postures was, on balance, supportive of continued open-weight distribution. The combination was not, however, a guarantee. The next several release cycles would test the combination, and the global developer community would watch them closely.
For the United States and her allies, the policy posture that emerged through 2025 and 2026 was a posture of regulated openness, neither unconditional embrace nor blanket restriction. The regulated openness posture was a substantial departure from both the unconditional embrace that some American commentators had advocated and the blanket restriction that others had demanded. The regulated openness posture was, in many respects, the natural posture for a policy environment that needed to balance the legitimate interests of the open-source developer community, the legitimate interests of the regulated industries, and the legitimate interests of the broader national security and privacy frameworks. The posture was not, however, a final answer. The posture was the working answer that emerged from the policy debates of the period, and it would be tested and refined through the next several years.
References
- DeepSeek-V3 Technical Report — DeepSeek-AI, December 2024.
- DeepSeek-R1 model card and reasoning model release — DeepSeek-AI, January 2025.
- Qwen3 Technical Report and Model Cards — Alibaba Qwen Team, 2025.
- GLM-4 release notes and benchmarks — Zhipu AI and THUDM, 2024.
- DeepSeek-V3 model card on Hugging Face — Hugging Face, accessed October 2026.
- Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence — Executive Office of the President, October 2023.
- Bureau of Industry and Security advanced computing and semiconductor manufacturing items rules — US Department of Commerce, accessed October 2026.
- Using AI systems safely: principles for the secure development of AI systems — UK National Cyber Security Centre, 2025.
- AI Security Institute annual report and evaluation programme — UK AI Security Institute (formerly AI Safety Institute), 2025.
- EU AI Act consolidated text and Annex XIII — European Parliament and Council, 2024.
- Garante per la protezione dei dati personali decision on DeepSeek consumer service — Italian Data Protection Authority, January 2025.
- METI guidance on the use of foreign AI systems in Japan — Ministry of Economy, Trade and Industry of Japan, 2025.
- IndiaAI Mission overview and Future Skills programme — Ministry of Electronics and Information Technology of India, 2024-2026.
- GSA AI procurement guidance — US General Services Administration, 2025 and 2026 revisions.
- Framework for Artificial Intelligence Diffusion and successor export licensing rule — US Department of Commerce Bureau of Industry and Security, 2025.
- FP8 mixed-precision training recipe and infrastructure for DeepSeek-V3 — DeepSeek-AI technical report, December 2024, arXiv.
- State of Open Data 2024: Trends in Open-Source Model Publishing — Centre for Emerging Technology and Security, Alan Turing Institute, 2024.
