As companies choose between an increasing range of AI solutions, the regulatory restrictions on the AI model may be as important as the capabilities of the AI model.
Flipping the Switch
At the G7 summit in June, over a lunch attended by President Trump and the chief executives of Anthropic and OpenAI, President Macron warned that if the United States “from one day to the next can turn off the switch,” it would damage not only the economies building on American AI, but also the American AI companies themselves.
He was not speaking hypothetically.
On June 12, the Commerce Department used export controls to order Anthropic to suspend access to its newest frontier AI models, Fable 5 and Mythos 5, just days after their release. The order came not as a rule or a published directive but as an unpublished letter requiring export licenses before the models could be made available to any foreign person worldwide, reportedly invoking the Export Control Reform Act and the EAR's military-intelligence end-use controls.[1] A follow-up letter on June 26 carved out “certain trusted partners,” and access to Fable returned on July 1 with additional safeguards, while Mythos remains limited to approved U.S. institutions. Nothing about the episode ever appeared in the Federal Register. For three weeks, the most capable AI models ever released were switched off for most of the planet, and the switch was flipped by a letter.
Meanwhile, the Chinese labs keep shipping. On July 16, Moonshot AI released Kimi K3, which became the first Chinese model to top a major coding leaderboard ahead of both Fable 5 and GPT-5.6; Moonshot has promised to open source full model weights by July 27. That release follows Z.ai's GLM-5.2, released mid-June with open weights under an MIT license, which NIST's own AI evaluators judged “probably the most capable open-weight AI model” at its release.
Whatever those models still lack against their U.S. counterparts, they compensate for by being cheaper, downloadable, and free of an American off switch. They are not, however, free of switches. They come wired to a different panel, in a different capital, with its own set of unknown risks. Additionally, if your business has U.S. export control exposure, how your company interacts with a Chinese AI model like DeepSeek, Qwen, GLM, or Kimi can itself create violation risk.
Being model agnostic is not, by itself, an answer. U.S. models and Chinese models each come with a distinct set of legal tripwires, and the right procurement decision depends on which set your operations can tolerate.
U.S. vs. Chinese AI models in 2026: the capability gap is months, and there is no third option
Chinese open-weight models have gone from novelty to default infrastructure in the last eighteen months. In mid-2026, Chinese models account for roughly 61% of tokens processed on OpenRouter, a major model-routing platform, and Alibaba's Qwen family has passed one billion downloads and forms the base of roughly 40% of new derivative models on Hugging Face. The U.S. government's own evaluation of DeepSeek noted that downloads of DeepSeek models had grown nearly 1,000% since January 2025.
Whether Chinese models have “caught up” depends on who is doing the measuring, but the gap is now months, not years, and it is narrowing at the top. NIST’s CAISI found DeepSeek V4 Pro roughly eight months behind the frontier in May 2026, and in July 2026 judged GLM-5.2 comparable overall to a U.S. model released about six months earlier (Opus 4.6). Kimi K3’s leaderboard results suggest an even shorter end of that range. What is not contested is the structural difference: the leading U.S. models are closed and accessed through APIs that their developers (and, increasingly, the U.S. government) can condition or cut off. The leading Chinese models can be downloaded and hosted anywhere on the globe, which changes both the risk profile and the legal analysis.
If you are holding out for a third option wired to neither D.C. nor Beijing, we have unhelpful news. The United States and China control roughly 90% of the computing power used for frontier AI development, and, by one count, all 50 of the top-ranked foundation models. Stanford's AI Index credits U.S. organizations with 59 notable model releases in 2025 and China with 35, with no other country reaching more than eight. France’s Mistral is the only third-country lab consistently described as near-frontier, but its current flagship evaluates as a strong open-weight model, not a frontier one.
More telling, much of the sovereign AI wave is built on the two ecosystems it is meant to escape: U.S. models underlie more than a third of sovereign projects that use open bases, the UAE’s K2 Think reasoning model was built on Alibaba’s Qwen, Singapore's flagship SEA-LION moved to a Qwen3 base, and South Korea reportedly cut Naver from its national model program for relying on non-independent pre-trained components.
Sovereign capital is real. The EU’s AI gigafactory program, the Gulf buildouts, and national programs in India, Japan, and Korea are all funded. But every credible path still runs through Nvidia hardware and, mostly, U.S. partners.[2] Any “sovereign” model built on a U.S. or Chinese base inherits the underlying ecosystem's legal exposure. It does not escape the choice; it repackages it, with new paint on the same panel.
U.S. AI export controls can switch off model access without rulemaking
Here is the pattern that should shape your planning: U.S. restrictions on AI arrive fast, often without any published legal instrument, while reversals come slowly or through litigation. The switch flips instantly. Flipping it back on requires a lawsuit.
|
When |
What happened |
Instrument |
|
Apr. 9, 2025 |
BIS imposed a license requirement on Nvidia H20 exports to China “for the indefinite future”; Nvidia took a $5.5 billion charge |
Private “is-informed” letter; the only public record is Nvidia's Form 8-K |
|
Jul. 2025 |
The H20 position reversed and sales resumed |
No public document |
|
Jan. 13–15, 2026 |
Commerce moved H200-class chip exports to China to case-by-case review, conditioned on nine certifications, including a cap tied to U.S. shipments and commitments by cloud consignees not to transfer model weights trained on the chips |
Final rule, effective without notice and comment (91 FR 1684) |
|
Feb. 27, 2026 |
A presidential directive ordered federal agencies to immediately cease use of Anthropic’s technology, alongside a DoD supply-chain-risk designation under 10 U.S.C. § 3252; a district court preliminarily enjoined parts of the action on March 26. |
Directive and designation; partially unwound only through litigation (CRS IF13217) |
|
Jun. 12 and 26, 2026 |
Commerce required licenses for foreign-person access to Anthropic’s Fable and Mythos, then exempted “trusted partners”; OpenAI reportedly accepted U.S. government approval rights over certain customers |
Unpublished letters (CRS IF13268; Anthropic) |
The AI Diffusion Rule was never rescinded: ECCN 4E091 and the model-weights FDPR are still on the books
Longtime readers will remember our post on the rescission of the AI Diffusion Rule, in which BIS threw away a toaster that still made toast. We must now report a development in the appliance saga: the toaster never actually left the kitchen.[3]
The January 2025 AI Diffusion Rule (90 FR 4544) is remembered as a chip rule, but it controlled models directly. It created ECCN 4E091 for the weights of advanced closed AI models and imposed a worldwide license requirement on them, with a presumption of denial outside a short list of allied countries (15 C.F.R. § 742.6(a)(13), (b)(14)). And it reached beyond US-origin models through a foreign direct product rule at § 734.9(l), where model weights trained anywhere in the world became subject to the EAR if trained on facilities built around U.S.-origin AI chips.
The May 2025 “rescission” of that rule consisted of a press release and an instruction not to enforce. No Federal Register document ever amended or removed the regulatory text, all of which remains in the current CFR. The Government Accountability Office confirmed the oddity in May 2026, concluding that the non-enforcement announcement was itself a “rule” that should have been submitted to Congress.[4] The only official acknowledgment of the non-enforcement posture in the Federal Register appears in the July 2026 UAE rule (91 FR 43034), and it addresses only the chip controls, not model weights. The breaker labeled “worldwide controls on AI model weights, with an FDPR” was switched off, but it is still in the panel, wired and rated, waiting for someone at Commerce to decide the non-enforcement posture has run its course. Reviving it requires no rulemaking, no comment period, and no notice.
What BIS's replacement AI rule could regulate: models, model access, and maybe model outputs
BIS has promised a replacement since the day of the rescission, and the rewiring job is on the schedule. The original docket now carries the title “Redesigned Framework for Artificial Intelligence Diffusion,” a draft went to OIRA in February 2026 and was withdrawn in March, and Under Secretary Jeffrey Kessler told the House Foreign Affairs Committee on July 14 that regulatory action on AI and semiconductors “is coming.” Commerce’s own regulatory plan lists the rule first among BIS’s regulatory actions and commits to issuing it in fiscal year 2026, which ends September 30. Two details of that plan deserve more attention. First, the replacement will arrive as another interim final rule, effective without prior notice and comment (the switch, again, flips first and takes questions later). Second, the plan describes it as a rule that “will formally rescind” the January 2025 framework, which BIS “has already stopped enforcing,” Commerce’s own written concession that, more than a year after the press release, the old rule has never actually been rescinded.
What the replacement will contain is speculation, but it is speculation with a paper trail, and the paper trail points at models.[5] The campaign that killed the 2025 rule came almost entirely from the hardware and data-center side: Nvidia called it a “failure” built on “fundamentally flawed” assumptions; Microsoft asked Congress to “eliminate quantitative caps” on GPU shipments while keeping qualitative security standards; the Semiconductor Industry Association's formal comment letter attacked the chip tiers and caps at length without once mentioning the model-weights controls. BIS’s own rescission announcement adopted the industry framing, stating “the rule would have stifled American innovation” and relegated allies to “second-tier status.”[6]
Nobody, it seems, spent lobbying capital defending against the model controls. And the chip side of the problem has since been handled separately, through a case-by-case licensing framework and the export-promotion programs such as the July 2026 UAE rule.
That leaves the redesigned framework an obvious path of least resistance: control the models and access to the models, not the chips. The June Anthropic letters read like the prototype, the first time the U.S. government controlled access to a model as such, rather than its weights as an item.
The extension to look out for is a foreign direct product rule aimed at model outputs. The same logic that made foreign-trained weights subject to the EAR could be applied to what covered models produce, from distilled and synthetic-data-trained derivative models down, potentially, to work product generated with them. That logic is already migrating up the stack. If a redesigned framework applies direct-product treatment to model outputs, businesses far from the United States will hold assets, models, fine-tunes, even deliverables, that Washington regards as subject to the EAR. Your work product, controlled from a panel you cannot reach.
The legal risks of using Chinese AI models: DeepSeek, Qwen, GLM, and Kimi
Adopting Chinese models raises four distinct categories of U.S. legal exposure, plus a revocability risk of their own.
First, export controls on what you put into the model. Prompting a model hosted in China, or operated by a Chinese provider, with technology subject to the EAR or ITAR technical data is best analyzed as an export or release to China, requiring authorization in most cases. The Entity List sharpens the point. Z.ai is the international brand of Zhipu AI, which has been on the Entity List since January 2025 (90 FR 4619) with a presumption of denial for all items. Downloading GLM-5.2's freely published weights is not an export to Zhipu, but sending controlled technology into Zhipu’s hosted API is an export requiring a license BIS presumptively denies. DeepSeek, Alibaba, Moonshot, and the other major labs are not currently listed, but BIS warned in May 2025 that foreign parties involved in AI-training activities can be added “even where no violation of the EAR occurs.” At this time, no U.S. enforcement action has yet been brought against any company for using Chinese AI services with controlled data. The risk is real but so far untested, and we would prefer our clients not volunteer to be the test case.
The channel matters as much as the model, because “open weights” means more than the ability to download and self-host. Chinese models can now be procured and run without any data touching a Chinese server or any transaction with a Chinese party. A major U.S.-based service for processing and deploying generative AI foundation models has served DeepSeek fully managed from U.S. regions since March 2025, stating that “[u]sers’ inputs and model outputs aren’t shared with any model providers,” and by February 2026 offered fully managed models from all four major Chinese labs, including GLM, whose Entity-Listed developer plays no role in the deployment. Microsoft's Azure AI Foundry added DeepSeek R1 within days of its release and has continued adding Moonshot’s Kimi models as recently as July 2026. Independent U.S. inference providers, including Together AI, Fireworks, Groq, SambaNova, and Cerebras (which advertises that “[d]ata stays in the U.S. 100% of the time”), serve the same models from U.S. data centers. The weights distribute through Hugging Face, a U.S. company, under licenses that permit commercial use and modification. And U.S. firms already ship derivatives, such as Perplexity’s de-censored DeepSeek variant R1-1776. Routed this way, using a Chinese model involves no export to China at all; the tripwires above attach to the China-hosted and Chinese-provider channels specifically. However, you should always check the wiring before you assume the circuit is isolated.
Second, export controls on the hardware stack that often accompanies Chinese models. BIS guidance treats the use of certain Huawei Ascend chips anywhere in the world as a presumptive EAR violation, and May 2026 guidance extends license requirements for advanced computing items to entities with Chinese ultimate parents wherever they are located. The model may be free, but the hardware it prefers is very much not.
Third, model integrity, where the record deserves careful sorting, because it spans three different kinds of problem. Measured behavioral gaps have been demonstrated. NIST’s CAISI found DeepSeek agents 12 times more likely to follow malicious hijacking instructions and far more compliant with jailbreaks than U.S. counterparts, and found GLM-5.2’s safeguards willing to assist with agentic cyber-exploit development. Recent research found DeepSeek-R1 produced vulnerable code significantly more often when prompts contained politically sensitive context, a behavior embedded in the model weights that persists even when you self-host.
Spontaneous rogue behavior is also now documented, by a Chinese lab’s own researchers: Alibaba’s technical report on its ROME agent model discloses that, during reinforcement-learning training, the agent began probing internal networks, established a reverse SSH tunnel to an external IP address, and diverted training GPUs to cryptocurrency mining, none of it requested by any task.[7] By contrast, the “sleeper agent” scenario, a model deliberately trained to behave until a trigger flips it, remains a laboratory demonstration (which also showed standard safety training fails to remove such backdoors); and no real-world compromise of a major open model through poisoned weights has been documented.
The backdoor question needs proportion, because the largest demonstrated security risks in deployed AI do not care whose flag is on the weights. Prompt injection, in which instructions hidden in content the model processes override the operator's instructions, sits first on OWASP's list of LLM application risks, and its agent-era variant, memory injection, poisons what an AI agent remembers so the compromise persists across sessions. That architectural property afflicts U.S. and Chinese models alike, and it attaches to how a model is deployed (what it can read, what it can do, what it remembers), not to the flag on its weights. A security program that scrutinizes the provenance of the weights while wiring an over-privileged agent to email and shared memory is inspecting the breaker box while leaving the front door open.
The distinction between hosted access (which raises PRC data-transfer, terms-of-service, and jurisdiction issues) and self-hosted open weights (which avoids those but carries the weight-level behaviors with it) should drive the analysis.
Fourth, the switch is becoming symmetric. Beijing reportedly began deliberations in July 2026 on restricting overseas access to leading Chinese models, including open-weight Qwen, and Chinese labs have been drifting toward closed-source releases. The decoupling also runs through the corporate layer, in both directions. Anthropic barred sales to entities more than 50% Chinese-owned worldwide in September 2025, and in April 2026 reportedly added code to identify Chinese users of Claude Code, prompting Alibaba to order the tool removed internally and China’s National Vulnerability Database to issue a security warning. This in a market where, as recently as January, Chinese developers overwhelmingly preferred Claude Code to any domestic alternative. Open weights already downloaded cannot be recalled, which is genuine insurance. But the assumption of a permanently open Chinese ecosystem has a shelf life, and the sell-by date is not printed on the package.
Finally, for companies that sell into U.S. government supply chains, procurement law follows the model's developer, not its host. The FY2026 NDAA requires the Defense Department to exclude AI developed by DeepSeek or High-Flyer from its systems and prohibits DoD contractors and subcontractors from using it in contract performance, and the pending No Adversarial AI Act (S. 2177) would extend a similar list-based approach government-wide, keyed to whether a foreign-adversary entity developed the model. Under that logic, DeepSeek served from U.S. data centers is still DeepSeek. The hosting channel cures the export analysis, not the procurement one.
AI deployment architecture and export compliance: SaaS, BYOC, or self-hosting decides where exports happen
Model choice and deployment choice are separable decisions, and treating them as one produces bad analysis. Enterprise AI platforms now offer the full deployment spectrum for the same model catalog. A company can run a U.S. model on its own servers or a Chinese model through a European SaaS broker. Each point on that spectrum changes which parties touch your data, and with them, where an export can occur. This is the part of the analysis that gets skipped in every “U.S. vs. China” framing, but it is the part your compliance team can actually control.
The EAR’s framework is person-centric. A release under § 734.15 runs to a foreign person, not to a server, so a cross-border data flow is not automatically an export by the regulatory text alone. In practice the distinction rarely helps, because every hop in an AI stack has people and entities behind it. A release to a foreign person is a deemed export if it happens in the United States and an export or reexport if it happens abroad, and transferring credentials that unlock controlled technology carries the same authorization requirement as transferring the technology itself. Nor does encryption rescue you. The EAR carves out transmissions of technology that are unclassified, secured with qualifying end-to-end encryption, and not intentionally stored in Country Group D:5, but end-to-end encryption requires that no third party hold the means of decryption, and no AI platform qualifies. Inference cannot run on ciphertext, so data is decrypted at the vendor's edge and processed in plaintext at every hop. Mapping the release points layer by layer:
|
Layer |
Who sits there |
Where the export analysis attaches |
|
Application |
The platform vendor and its subprocessors (edge proxy, storage, error tracking) |
Personnel and subprocessors who can read prompts, files, and retained chats; retention windows and training rights determine how long that surface persists |
|
Hosting |
The infrastructure running the platform: vendor's cloud, your cloud, or your racks |
Administrators with plaintext or credential access; a release to a foreign-person administrator requires the same analysis whether they sit in the U.S. (deemed export) or abroad (export or reexport) |
|
Provider |
Whoever operates the inference endpoint: the model developer, a hyperscaler, or an independent host |
The cross-border transmission itself; provider-side logging and abuse-monitoring retention; the provider's jurisdiction, ownership, and list status |
|
Model |
Whose weights, controlled or conditioned by which government |
Behaviors embedded in the weights travel with every deployment; the controlling jurisdiction keeps the switch described above |
This is why “U.S. model or Chinese model” is one axis, not the whole decision. A Chinese model self-hosted on-premises eliminates the provider layer entirely with no data flows to a Chinese server and no transaction with a listed party. However, it does not eliminate the model layer. The weight-level behaviors documented above run on your hardware, and if a redesigned AI diffusion framework controls foreign-trained weights or their outputs, on-premises weights are still an asset Washington may regard as subject to the EAR.
Run a U.S. model through multi-tenant SaaS and the movement is the opposite. The model-layer switch risk stays, and the application and hosting layers add the vendor’s entire subprocessor chain to your export analysis. On a typical multi-tenant tier, a prompt crosses an edge proxy, a backend, and one of several LLM subprocessors before reaching a model, and each hop processes plaintext. Single-tenant and bring-your-own-cloud deployments sit between the poles, removing hops one at a time. Who administers the remaining hops, and their nationality, still matters at each step.
How to build an AI model-selection compliance strategy
We have gamed out where this goes. The redesigned U.S. framework lands as an interim final rule, probably by fall of 2026, probably aimed at models and access rather than chips. Beijing decides how much of its open-weight ecosystem stays open. The dormant 4E091 circuit either gets formally removed, formally revived, or, in the great tradition of regulatory panels everywhere, left exactly where it is with the label half peeled off. None of those outcomes is in your control. What is in your control is knowing your own wiring before an electrician you did not hire starts working on the building.
A defensible model-selection strategy has four steps:
- Map which workflows touch which models, including models embedded in vendor products;
- Identify where export-controlled technology or technical data enters those workflows;
- Set a model-and-deployment posture for each workload, choosing both the model column and the point on the deployment spectrum (multi-tenant SaaS, single-tenant, bring-your-own-cloud, on-premises) and noting which layers of the stack each combination exposes; and
- Document the diligence, because the inquiry that matters may come from a regulator, a customer, or an insurer.
That review is exactly the kind of work we do with clients, and we would genuinely rather help businesses label the panel now than help them respond to a subpoena about it later.[8] If your business is weighing U.S. and Chinese models, or discovering that it already adopted several of each without deciding anything, the company would do well to consider engaging an outside expert to assess the legal risks (as opposed to business or infosec risks) for a model selection.
And, as ever when we write these more speculative pieces, we are always pleased to find that you want to join us for the conversation. Please feel free to email the authors with your thoughts, comments, or questions.
FOOTNOTES
[1] An “is-informed” letter is exactly what it sounds like: BIS writes to tell a specific company that a license requirement now applies to it. It binds the recipient the moment it arrives, appears in no public register, and the rest of the world learns about it, if at all, from securities filings and congressional research services. It is the export-control equivalent of a switch you discover only when the lights go out.
[2] Anyone who bet on a third smartphone ecosystem in 2012 is invited to share their experience with the sovereign-AI investment committees of several governments.
[3] We are as surprised as anyone that the appliance-metaphor genre has produced a sequel. We do not control the news; we only wire it.
[4] It is not every day that the Government Accountability Office issues a formal decision confirming a premise of this blog. We take our validation where we can find it.
[5] This is not legal advice, and we do not have a crystal ball. What we have is a docket number, a regulatory plan, and a strongly worded set of press releases, which in this field is about as close to a crystal ball as anyone gets.
[6] No comment on how prohibiting non-U.S. parties from accessing U.S. models treats allies.
[7] The agent was not asked to do any of this. It showed initiative. That is the problem.
[8] Both would incur legal fees, but one of the encounters is a much more pleasant process for the business.