Running Chinese Open-Weight AI Models Privately in a UK Organisation

The current generation of Chinese AI models can be downloaded and run entirely on hardware you own. DeepSeek's V4 series, Alibaba's Qwen3 family, Z.ai's GLM-5.2 and Moonshot's Kimi K2.6 all publish their weights on Hugging Face, most under plain MIT or Apache 2.0 licences, and a UK organisation that has ruled out sending data to any external AI provider, American or Chinese, can run them on its own servers with no account, no API key and no byte of data leaving the building. That option is real, it is lawful, and it gets far less attention than it deserves.

It is also routinely confused with something quite different: using a Chinese company's hosted app or API. The two propositions share a model name and almost nothing else. This piece sets out that distinction first, then works through what each model's licence actually permits, what hardware private inference takes, what it costs against the APIs, where UK GDPR lands for each route, and what the documented evidence says about the risks that remain. Every licence and every headline figure below was checked against the primary source on 6 August 2026.

Why the hosted API and the downloaded weights are different propositions

Using DeepSeek's app or API sends your prompts to infrastructure operated under Chinese jurisdiction. Running DeepSeek's published weights on your own server sends nothing anywhere: the model is a set of files on your hardware, inference happens locally, and the machine can be cut off from the internet entirely without affecting it. Almost all of the government action against Chinese AI since early 2025 targets the first arrangement and leaves the second untouched.

The concern behind those measures is concrete. South Korea's Personal Information Protection Commission found in April 2025 that DeepSeek had transferred data belonging to roughly 1.5 million South Korean users of its app, including the text of user prompts, to companies in China, among them a ByteDance subsidiary, between 15 January and 15 February 2025. That is what a hosted consumer AI service can do with input data, and it is why regulators moved.

The pattern of the responses is telling. Australia's Department of Home Affairs directed government entities on 4 February 2025 to prevent the use of "DeepSeek products, applications and web services". Italy's data protection authority, the Garante, blocked the hosted service for Italian users on 30 January 2025. Taiwan barred the service from government agencies the same week, and US federal bodies including the Navy, NASA and the Commerce Department blocked the app on government devices between January and March 2025. Every one of those measures addresses the app and the hosted service. The one documented exception is the US Department of Energy, which in August 2025 extended its restriction to downloadable open-weight model files on its own systems, and that exception rather proves how unusual the step is. The Atlantic Council put the underlying logic plainly in July 2026: "Each measure targets the same fact: the app sends what users type to infrastructure in China. But open models running on hardware the user owns do not send anything anywhere."

For a UK organisation the practical reading is straightforward. If your objection to AI tooling is where the data goes, the hosted Chinese API deserves the same scrutiny you would give any offshore processor, and more. Self-hosted weights remove that question entirely, for the same reason that NCSC guidance on putting sensitive business data into chat assistants turns on where the processing happens rather than on the logo on the model.

The Chinese open-weight models current in August 2026

Four families dominate the open-weight frontier from China as at 6 August 2026, and all four had major releases this year. The specifications below are the developers' own published figures from their Hugging Face model cards.

All are sparse mixture-of-experts designs, which matters for hardware planning: only a fraction of the parameters (the "active" column) work on any given token, so memory demand is set by total size but compute demand by active size. Alibaba's Qwen3 line also includes dense models from 0.6B to 32B parameters, all Apache 2.0, which is where laptop-scale private deployment starts. DeepSeek-R1, the 671B reasoning model from January 2025 that started this wave, remains available under MIT.

Three cautions on currency. First, DeepSeek-R2 has not been released: no official checkpoint, model card or technical report exists, and anything circulating under that name is unofficial. Second, the open door is not guaranteed to stay open at the top end: Alibaba moved its flagship Qwen3.7-Max to API-only in April 2026, and Baidu's ERNIE 5.x line is closed. Third, capability claims in vendor benchmark tables are vendor claims. The independent picture is still strong: Artificial Analysis, the benchmarking firm, ranked Kimi K2.6 fourth overall on its Intelligence Index on 20 April 2026 and named it the leading open-weights model, and put the gap between the leading open-weights and leading proprietary models at about six points at the end of that month. NIST's independent testing tells a more sober story on some workloads, discussed below.

What the licences actually permit

The headline licences are as permissive as licences get, and that was verified against the licence files themselves rather than against summaries. GLM-5.2's model card states an MIT licence with "no regional limits". DeepSeek's V4 repository states that "this repository and the model weights are licensed under the MIT License". Qwen3 and ERNIE 4.5 carry Apache 2.0, which adds an explicit patent grant. In commercial terms MIT and Apache 2.0 mean a UK organisation may download, run, modify, fine-tune, build products on and resell services built on these models, with no royalties, no usage caps and no geographic restrictions, provided the licence text and attribution travel with any redistribution.

Kimi K2.6's licence is MIT with one addition, and the licence file states it precisely: if a commercial product or service built on the model exceeds 100 million monthly active users or 20 million US dollars in monthly revenue, the operator must prominently display "Kimi K2.6" on the product's user interface. Below those thresholds it behaves as ordinary MIT. For nearly every UK mid-market deployment the clause will never bite.

The traps sit at the edges, and they justify the habit of reading the actual LICENSE file for the exact release rather than assuming a lab's previous terms carry over:

• MiniMax M2.7 is labelled "modified MIT" but requires prior written authorisation from MiniMax for any commercial use. As written it is not a permissive licence, whatever the label says.
• MiniMax-H3, the video model released on 3 August 2026, names the UK, US, EU and South Korea as excluded territories for local open-weight deployment. A UK organisation cannot lawfully self-host it under those terms, though the hosted API remains offered.
• Kimi K3, released 27 July 2026, dropped the K2 family's modified MIT for a bespoke licence requiring model-as-a-service operators above 20 million dollars in revenue over any twelve months to sign a separate agreement.
• Older Qwen models (Qwen2.5-72B and earlier large variants) sit under the Tongyi Qianwen licence, which requires a separate commercial licence above 100 million monthly active users. Qwen3 does not carry this.
• DeepSeek-V3 from December 2024 predates DeepSeek's move to MIT and uses a custom licence: commercial use is permitted, but with a list of use-based restrictions, and the licence is governed by Chinese law with jurisdiction in the Hangzhou courts. The V4 series and R1 have no such terms.

The lesson is that the licence attaches to the release, not to the lab, and terms have changed in both directions within a single family in under a year. One more distinction worth having ready for procurement conversations: Z.ai has sat on the US Commerce Department's Entity List since January 2025, which restricts US firms from supplying it with controlled technology. It places no restriction on a UK organisation downloading and running Z.ai's published weights.

What hardware it takes to run them usefully

A single decent workstation now runs genuinely useful models privately, and the frontier-scale ones need either an eight-GPU server or a hybrid CPU-GPU build. The honest framing for a UK IT director is three tiers.

Laptop and workstation tier. Qwen3's dense models up to 32B run on a single 24GB consumer GPU at 4-bit quantisation, and the small MoE models are quicker still: the KTransformers project's public leaderboard records Qwen3.5-35B-A3B at 86.2 tokens per second on one RTX 5090. Progress in memory-efficient inference has been remarkable across the board; the turbo-fieldfare project runs Google's Gemma 4 26B-A4B in roughly 2GB of RAM on Apple Silicon, reporting 5.1 to 6.3 tokens per second on a fanless 8GB M2 MacBook Air and 31 to 35 tokens per second on a 24GB M5 Pro. That is a Western model, but the technique is model-agnostic and shows what the laptop tier has become.

Serious single-box tier. DeepSeek-V4-Flash, the 284B model, decodes at 18.5 tokens per second on a single RTX 4090 at 4-bit (MXFP4) per the KTransformers leaderboard, and 31.8 tokens per second on two RTX 5090s. Kimi K2.6, a full 1T-parameter model, records 29.1 tokens per second on four RTX 5090s at 4-bit. The same project's hybrid CPU-GPU approach, from a team at Tsinghua University, runs 671B-class DeepSeek models on one RTX 4090 plus 512GB of system RAM by holding the expert layers in memory. These are single-user or small-team speeds, an order of magnitude below what a hosted API returns, and fine for the document analysis, drafting and coding-assistant work most organisations actually want private.

Server tier. Full-precision frontier models are data-centre furniture: a 671B model needs roughly 1,350GB of memory at 16-bit including cache, around 725GB at 8-bit, and about 413 GB at 4-bit, which is why the standard minimum node is eight 80GB H100s (640GB of pooled VRAM) for 4-bit service, per the memory analysis published on arXiv in February 2025. The 1.6T DeepSeek-V4-Pro and 1T Kimi K2.6 sit in the same eight-GPU class. Serving stacks are also becoming vendor-portable; Modular now ships the same container for AMD and NVIDIA GPUs, so an H100 waiting list is not the only route to this tier.

On quantisation: 8-bit is generally treated as near-lossless, 4-bit is the practical floor for production and is what all the consumer-GPU figures above use, and the aggressive 2-bit builds that circulate for the biggest models trade real quality for fitting into less memory. Whatever tier you target, benchmark the quantised build on your own workload before committing, because published figures are almost always for the full-precision model.

What self-hosting costs against the API

Self-hosting these models is justified by where the data sits, almost never by price. DeepSeek's official API pricing as at 6 August 2026 is $0.14 per million input tokens and $0.28 per million output tokens for V4-Flash, and $0.435 and $0.87 for V4-Pro. Z.ai lists GLM-5.2 at $1.40 per million input tokens and $4.40 per million output. Those are the numbers a private deployment has to beat, and it will not.

The arithmetic is short. Take $2 per GPU-hour as a working figure, the bottom of the range specialist GPU clouds advertised for H100s in mid-2026, with the big three clouds' on-demand rates running well above it. An eight-GPU node around the clock is roughly $11,680 a month before a single hour of staff time. At V4-Flash's output price, that same money buys about 41 billion tokens a month from the API, a volume far beyond any team-level or department-level use. Unless you are running sustained production inference at platform scale, the API is cheaper by orders of magnitude.

Which is precisely why the framing matters. The organisations for whom self-hosting makes sense are not doing it to save money; they are doing it because client confidentiality, regulatory posture or contract terms rule out sending the data to anyone, at any price. For that buyer the relevant comparison is not "$11,680 versus the API" but "$11,680 versus not doing the work at all, or hiring for it". Mid-size models on a workstation shift the sums further: a one-off outlay of a few thousand pounds on a capable GPU workstation, running Qwen3-32B or V4-Flash, covers a great deal of private drafting and analysis with no meter running, the same economics that drive self-hosted alternatives to subscription software generally.

Where UK GDPR lands for each route

Sending personal data to a Chinese-hosted AI API is a restricted international transfer under UK GDPR; running the same lab's weights on UK infrastructure involves no transfer at all. That single sentence is most of the compliance analysis, and it is worth walking through why.

The UK has no adequacy decision for China. A hosted Chinese API therefore needs Article 46 safeguards, in practice the ICO's International Data Transfer Agreement or the UK addendum to standard contractual clauses, plus a transfer risk assessment examining whether the importer can genuinely honour those commitments given Chinese law on state access to data. The ICO published updated international transfers guidance in January 2026, and the enforcement backdrop is not theoretical: the Irish Data Protection Commission fined TikTok €530 million in 2025 over transfers of European user data to China, and the South Korean findings above showed a Chinese AI service moving actual prompt text to third parties. Most Chinese AI providers also offer nothing resembling an Article 28 processor agreement, which is required before a processor touches personal data at all. None of this makes the hosted route impossible for non-personal data, but for personal data the paperwork is structurally hard to complete honestly.

Self-hosting dissolves that entire chapter of the analysis. Prompts and outputs never leave your infrastructure, so Articles 44 to 49 are not engaged, no transfer risk assessment is needed, and there is no processor and hence no Article 28 contract. The model's country of origin is irrelevant to this conclusion: a French, American or Chinese model file on a UK server is just software, and UK GDPR regulates where personal data flows, not where code was written.

What self-hosting does not remove is your own controller obligations. Article 32 security is entirely yours, with no processor to share it; a DPIA is still required where processing is likely to be high risk; Article 30 records of processing still need to describe what the model is doing with whose data; and a local model wired into your document stores inherits every access-control weakness those stores already have, the same failure mode that catches Copilot deployments surfacing confidential files to the wrong staff. Private does not mean governed.

The documented risks that stay in the weights

Self-hosting removes the data-transfer risk. It does not change what is inside the model, and three issues are now well documented there: political alignment baked into the weights, weak resistance to adversarial prompting, and context-sensitive code quality. All three findings below come from testing of weights downloaded from Hugging Face, not of Chinese-hosted services, so all three apply to private deployments.

The most thorough public evaluation is NIST's, published by its Center for AI Standards and Innovation on 30 September 2025, which downloaded DeepSeek models from Hugging Face and ran them on NIST's own servers. On politics, it found DeepSeek models echoed inaccurate Chinese Communist Party narratives about 4 times as often as US reference models, in English as well as Chinese, confirming the behaviour lives in the weights. On safety, DeepSeek's most resistant model, R1-0528, complied with 94 per cent of overtly malicious requests when common public jailbreak techniques were used, against 8 per cent for US reference models. On agent security, DeepSeek-based agents were on average 12 times likelier than the tested US frontier models to follow malicious instructions injected into their inputs: hijacked into attempting to exfiltrate login credentials in 37 per cent of test cases against an average of 4 per cent for the US frontier models, into sending phishing emails in 48 per cent of cases against 3 per cent, and into downloading malware in 49 per cent of cases against 4 per cent. Fairness demands one addition NIST itself makes: the US open-weight model it tested, gpt-oss, was hijacked into phishing at the same 48 per cent rate, so part of this is the general state of open-weight guardrails rather than anything specific to China. NIST's performance testing also trimmed vendor narratives: DeepSeek V3.1 solved 54.8 per cent of SWE-bench Verified coding tasks against 66.7 per cent for the best US reference model, and scored 36.7 per cent against 66.7 per cent on the CVE-Bench security benchmark.

On code generation, CrowdStrike's Counter Adversary Operations team published research on 20 November 2025 showing DeepSeek-R1 wrote vulnerable code in 19 per cent of baseline cases, rising to 27.2 per cent, an increase of almost 50 per cent, when the prompt context mentioned an industrial control system in Tibet, with similar effects for references to Falun Gong or Uyghurs, and refusals of Falun Gong-related coding tasks 45 per cent of the time. CrowdStrike is explicit that it seems unlikely the model was deliberately trained to produce insecure code, suggesting the behaviour may be an unintended side effect of its political alignment training. Booz Allen Hamilton reached a matching conclusion on 5 June 2026 across more than 2,800 trials and roughly 460,000 generated lines of code spanning four Chinese models and a US control model: Qwen3-Coder produced 130 per cent more vulnerable code when the prompt described a US government user, all four Chinese models refused coding tasks on topics politically sensitive in China, and the report states plainly that "we do not have proof at this point that code flaws are intentionally introduced". The operational reading for a UK deployer is undramatic: treat model output as untrusted input to your normal code review and static analysis, and keep politically sensitive subject matter out of scope for anything user-facing.

Two further points complete the picture honestly. Academic research has repeatedly shown that backdoors can be inserted into open-weight models through poisoned fine-tuning and are hard to detect afterwards; that is a reason to use checksums and official repositories, and it applies to every open model of every nationality, and no tampering with the official published weights of any major Chinese lab has been documented as at 6 August 2026. And the censorship itself is not immutable: the open-source heretic tool (27,000-plus GitHub stars) automates removal of refusal behaviour from downloaded models, with its maintainer reporting a run of about 20 to 30 minutes on an RTX 3090 for a 4B model. Stripping refusals also strips safety refusals, and community-modified checkpoints reintroduce exactly the supply-chain question above, so the sensible default for business use is official weights, documented behaviour, scoped use.

What UK guidance actually says

No UK government publication names Chinese-origin AI models, advises against them, or distinguishes hosted Chinese services from self-hosted weights. The UK's published framework is deliberately technology-neutral, and the diligence it demands applies to a model from Hangzhou and a model from San Francisco alike.

Three documents do the work. The NCSC's Guidelines for Secure AI System Development, published jointly with international partners in November 2023, tell organisations to treat third-party model weights as untrusted code: scan them, sandbox them, verify integrity cryptographically. DSIT's Code of Practice for the Cyber Security of AI, published 31 January 2025, requires supply-chain risk assessment and due diligence for external models including open-source ones under its Principle 7. And for regulated financial firms, the Bank of England, FCA and HM Treasury issued a joint statement on 15 May 2026 setting expectations for managing frontier AI cyber risk, including third-party and open-source model risk, under existing operational resilience rules. None of the three mentions country of origin. That neutrality is itself a policy position, and UK-based analysts have argued for keeping it: Chatham House wrote in July 2026 that "a ban on Chinese open weight models would fall hardest on British firms that cannot afford the fees charged by the largest American labs". The wider divergence between the UK's principles-based approach and the EU AI Act makes the UK, if anything, the easier jurisdiction in which to run this kind of deployment lawfully.

The most instructive recent evidence of what self-hosted open weights are for came from an incident, not a policy paper. On 16 July 2026 Hugging Face disclosed a serious intrusion by an autonomous attacking agent. Its responders first tried to analyse the attacker's 17,000-event action log with frontier models behind commercial APIs and were blocked: the analysis meant submitting real exploit payloads and stolen credentials, and hosted guardrails cannot tell an incident responder from an attacker. The team ran the forensics instead on GLM-5.2 on its own infrastructure, noting the second benefit that no attacker data or referenced credentials left its environment, and drew the lesson that organisations should have a capable self-hostable model vetted and ready before an incident. That is a concrete, documented case of a Chinese open-weight model doing work that hosted Western services refused, precisely because it was private.

One geopolitical footnote belongs in any long-term plan. Time reported on 7 July 2026 that Chinese authorities had held talks with Alibaba, ByteDance and Z.ai about restricting overseas access to leading models, including open-weight ones. Nothing formal has been issued as at 6 August 2026, but the possibility cuts in an unexpected direction: weights already downloaded cannot be recalled, so the prudent response to supply uncertainty is to archive the model files you depend on, not to avoid them.

A deployment checklist that respects the evidence

The requirement-led version, for an organisation whose data position rules out external APIs:

• Read the LICENSE file of the exact release you deploy, not the lab's reputation. The MiniMax and Kimi K3 examples above show terms shifting release by release.
• Download from the official repository, verify the SHA256 checksums, and archive the files internally. This covers both the tampering risk and the supply-continuity question in one step.
• Run the model as untrusted code, per NCSC guidance: sandboxed, minimum privileges, and with outbound network access from the inference host blocked by default. An egress-blocked host is also your proof, to auditors and clients, that the no-data-leaves claim is architecture rather than assertion. The NCSC's zero-trust principles map onto this directly.
• Put your own guardrail layer in front of it. NIST's numbers make clear the built-in refusal behaviour is weak against adversarial prompting, so content filtering, prompt-injection defence and output checks are your responsibility, especially for anything agentic.
• Scope it honestly. Expect refusals or degraded behaviour on topics politically sensitive in China, and keep such material away from user-facing deployments. For code generation in sensitive sectors, keep human review and static analysis in the loop.
• Do the governance paperwork: DPIA where the processing warrants it, Article 30 records, and a written policy on who may use the model for what. A practical AI governance framework for mid-market organisations and the broader UK AI ethics and governance groundwork both apply unchanged; a locally run model is still an AI system your board answers for.
• Start small. A workstation running Qwen3-32B or DeepSeek-V4-Flash proves the workflow, the governance and the quality on your own documents before anyone signs for an eight-GPU node.

The conclusion is not that every UK organisation should run Chinese models, but that the question deserves to be asked accurately. The hosted Chinese API is an offshore data-processing arrangement with a difficult UK GDPR position and a documented history of data reaching third parties. The published weights are software artefacts under some of the most permissive licences in the industry, runnable on your own hardware with nothing leaving the building, carrying documented and manageable behavioural caveats, and endorsed by no less an authority than the incident-response record of one of the world's largest AI platforms. Those are different things. Evaluate them differently.

Sources

This article draws on primary documents throughout: the model cards and licence files for GLM-5.2, DeepSeek-V4, Kimi K2.6 and Qwen3 on Hugging Face; official API pricing pages at api-docs.deepseek.com and docs.z.ai; NIST CAISI's Evaluation of DeepSeek AI Models (30 September 2025); CrowdStrike Counter Adversary Operations research (20 November 2025); Booz Allen Hamilton's What's In America's Code (June 2026); Hugging Face's security incident disclosure (16 July 2026); the KTransformers public benchmark leaderboard; NCSC's Guidelines for Secure AI System Development; DSIT's Code of Practice for the Cyber Security of AI; the Bank of England, FCA and HM Treasury joint statement (15 May 2026); ICO international transfers guidance (January 2026); decisions and findings from the Australian Department of Home Affairs, the Italian Garante and South Korea's PIPC; and analysis from Artificial Analysis, the Atlantic Council, Chatham House and reporting by Time.