Can Your Company Legally Use Chinese Open-Weight LLMs? What the Rules Say Now

Look, here is the straight answer, because most coverage buries it. As of July 23, 2026, no law in the US or EU prohibits a private company from using Chinese open-weight models like DeepSeek, Qwen, Kimi K3, or GLM. The bans you have read about apply to government agencies and government devices, not to your startup or your enterprise.

But "legal today" is doing heavy lifting in that sentence. This week alone: Axios reported the White House is reviving a push to ban Chinese AI models outright after Kimi K3's launch, the Treasury Secretary said the US can sanction overseas models built on IP stolen from American companies, and a drafted executive order would reportedly hold US companies liable for security breaches involving hosted Chinese models. And the EU's enforcement powers over all general-purpose AI models switch on August 2.

So the real question is not "is it legal." It is "under what conditions, and for how long." Here is the map.

Who can and cannot use Chinese AI models right now?

Private companies can. Government agencies in a growing list of countries cannot. Your position on that spectrum, plus how you deploy the model, decides your actual risk.

Two notes on that table. The bans and proposals are moving weekly, so treat it as a snapshot dated July 23, 2026. And none of it distinguishes the thing that matters most technically, which is the next section.

Does it matter if you use the API or self-host the weights?

It changes almost everything. Calling a Chinese-hosted API sends your data to servers in China. Self-hosting downloaded weights on your own infrastructure keeps your data in-house. These are different risk categories wearing the same model name.

• Chinese-hosted API: your prompts and data cross into another jurisdiction's legal system. Security researchers documented data flows from DeepSeek's consumer service toward Chinese state-linked infrastructure back in early 2025, and that finding drove many of the government bans. For any regulated data, this route fails most privacy reviews on its face.

• Self-hosted open weights: the data-transfer problem largely disappears, which is exactly why US enterprise adoption has grown. It also cuts inference costs for heavy sustained use. What remains is model risk: behavior you have not tested, licenses you have not read, and guardrails you have not added.

• Via a Western cloud or intermediary host: the middle path many enterprises take. Data residency improves, but your vendor-diligence duty just moved to the host, and your procurement contract needs to say who carries which risk.

• The wildcard: Reuters reported in July that Chinese authorities have discussed restricting overseas access to their most advanced models. The report is contested and nothing is signed, but the practical advice stands either way: if your stack depends on specific open weights, mirror them now.

Why are US companies suddenly under scrutiny for using them?

Because the fight moved from government devices to the private market, and this week it got specific. A reported push to ban the models. A Treasury sanctions threat over IP theft. A drafted executive order putting breach liability on the US companies that host them.

Understand what that means legally. None of these is law yet. Using Kimi K3 in your product remains lawful while Washington debates. But the direction is unmistakable, and two of the proposed mechanisms would hit companies, not just models.

The measures on the table, in rough order of likelihood:

1. Federal procurement bans, extending agency-level bans government-wide. Most likely, already partially reality.

2. Sanctions or Entity List designation of the labs behind the models. Treasury Secretary Scott Bessent said on July 21 that the administration supports open-source models but can sanction overseas models that steal IP from US companies. Separately, Commerce has previously considered adding leading Chinese AI labs to its Entity List, which could prohibit Americans from possessing or using those models without a license. This is the mechanism that would touch enterprises directly.

3. Company-facing liability rules. Per Axios, officials drafted an executive order that would hold US companies liable for security breaches involving hosted Chinese models, and considered a joint NSA advisory discouraging their use. Paused earlier over market concerns, revived after Kimi K3.

4. An outright ban on the models themselves. Also the hardest to pull off. Policy experts note that banning freely downloadable weights is close to unenforceable, critics including Nvidia's Jensen Huang publicly oppose it, and legal scholars have raised First Amendment problems with prohibiting published model weights. Expect friction, not a clean switch.

There is a counter-current too, and it is genuinely strange. When Hugging Face investigated last week's breach of its infrastructure, it ran the forensics on a Chinese open-weight model because US commercial models' guardrails refused the analysis. That detail is now cited inside the US policy debate as evidence that guardrail asymmetry hurts defenders. We covered the incident in our agentic breach report. The point for you: this debate is not one-sided, and the rules could move in either direction.

What does the EU AI Act say about Chinese models?

Nothing about China specifically, and that is the point. The AI Act regulates by risk and role, not by flag. But from August 2, 2026, the Commission can enforce GPAI obligations with fines, and your Chinese model vendor's compliance posture becomes your problem.

Here is the mechanism, dated and sourced against the official EU AI Act materials:

• August 2, 2025: GPAI provider obligations took effect for new models: technical documentation, copyright policy, training-data summaries, information for downstream providers.

• August 2, 2026: the Commission's enforcement powers switch on. The AI Office can demand documentation, evaluate models, order corrective measures, restrict a model from the EU market, and fine GPAI providers up to 3 percent of global turnover or 15 million euros.

• What that means for you as a deployer: if a Chinese provider has not engaged with the EU regime, the enforcement risk sits upstream, but a model restricted or withdrawn from the EU market takes your product feature down with it. Ask any provider, Chinese or otherwise, for their AI Act documentation. Silence is an answer.

Our framework keystone piece covers how these duties map across NIST AI RMF and ISO/IEC 42001 if you operate in multiple regimes.

How do you vet a Chinese open-weight model before production?

The same way you should vet any open-weight model, plus two extra checks for jurisdiction risk. Treat the model as an untrusted supply-chain component until your own testing says otherwise.

Your pre-production checklist:

1. Read the actual license. Open weight does not mean open ended. Each model family ships its own terms, and some restrict commercial use cases or redistribution. Legal reads it, not engineering.

2. Decide the hosting mode in writing. Self-hosted, Western intermediary, or Chinese API, with the data-flow consequences documented. This single decision drives most of your privacy exposure.

3. Red team it before it touches production. Run Garak or PyRIT against it like an attacker would. Our one-sprint red team plan works for any open-weight model. For continuous coverage, Mindgard and Enkrypt AI automate it.

4. Wrap it in your own guardrails. The model's built-in behavior is not your policy. NeMo Guardrails or Lakera Guard enforce yours at runtime, whatever the underlying model believes.

5. Monitor it in production. Lasso Security and HiddenLayer watch for data leakage and anomalous model behavior; Noma Security covers the supply-chain posture.

6. Register it in your governance system with an owner and a review date, via Credo AI, Holistic AI, or IBM watsonx.governance. A model nobody owns is a finding waiting to happen.

7. Mirror the weights you depend on, given the reported possibility of Chinese export restrictions. Cheap insurance against a policy decision you do not control.

Filter all of these by framework and certification in the directory, or let the Finder shortlist for your stack in three questions.

Your Action Plan

The legal answer is yes, for now, with conditions. Your job is making "for now" survivable:

1. Inventory where Chinese models already run in your company, including the ones engineering adopted without asking. That is a shadow AI problem first; start with our inventory walkthrough.

2. Kill any Chinese-hosted API path carrying regulated data. Move it to self-hosted or a compliant intermediary.

3. Run the seven-step vetting checklist on anything staying in the stack.

4. Assign one owner to track two dates: the EU enforcement start on August 2, and the US measures, which will produce either rules or a retreat within months.

The next move belongs to Washington and Brussels, not to you. What you control is whether a rule change becomes a migration plan or a fire drill.