Running Chinese AI on Your Own Hardware: The Sovereignty Question Nobody Has Answered Yet

DeepSeek V3 and Qwen 2.5 are open-weight models you can download and run entirely on hardware you own, in a building you control, with no network connection whatsoever. If no data leaves your infrastructure, what exactly is the sovereignty risk? The answer is more complicated than either the "it's fine" camp or the "ban it immediately" camp wants to admit.

First, the distinction that almost everyone misses

There are two completely different things people call "using Chinese AI," and conflating them produces bad analysis:

Using a Chinese AI API — sending your queries to DeepSeek's servers, receiving responses back. Your data transits Chinese-controlled infrastructure. China's Cybersecurity Law, Data Security Law, and National Intelligence Law all apply. This is the unambiguous sovereignty risk, and for regulated Canadian workloads, it is a categorical disqualifier.

Running Chinese open-weight model files on-premises — downloading the model weights, running them locally on hardware you control, with no outbound network connection. Your prompts never reach China. Chinese servers never see your data. Chinese law has no jurisdiction over your runtime inference.

These are not the same thing. The policy debate has frequently failed to distinguish them, which has produced both overstated fear (treating any DeepSeek use as a sovereignty violation) and understated risk (treating on-prem deployment as a complete sovereignty solution, which it isn't).

The genuine case for Chinese models on-prem

Let's be honest about the upside, because it's substantial and organizations are acting on it right now.

DeepSeek V3 and DeepSeek R1 perform at or near GPT-4o level on a range of benchmarks — coding, reasoning, multilingual tasks — at a fraction of the training cost. Qwen 2.5 (72B) is competitive with Claude Sonnet on many enterprise tasks. These are not compromised, watered-down models: they represent a genuine step-change in the capability-per-dollar ratio of open-weight AI, and they are available to run on hardware you already own.

For organizations that have invested in on-prem GPU infrastructure — or are considering doing so — the arrival of high-quality open-weight Chinese models significantly improves the economics. A 70B-class model that matches frontier API capability, running on a sovereign rack you own, with inference costs measured in electricity rather than dollars-per-token: that is a compelling offer.

The practical reality is that thousands of organizations worldwide are running DeepSeek on-prem today, including in regulated sectors. The uptake has been fast enough that several Canadian IT security researchers have started treating it as a live question rather than a theoretical one.

The risks that remain — evaluated honestly

Training data provenance

There is credible evidence that DeepSeek's training data included material obtained without authorization from US AI companies, including potentially proprietary output data from OpenAI. OpenAI has stated they detected evidence of distillation from their models — training a model on the outputs of another model in ways that likely violated terms of service. This is primarily an intellectual property and ethics issue rather than a Canadian data sovereignty issue, but it is a real one.

More directly: you do not know what data these models were trained on. For sectors where training data provenance matters — certain government contracts, some financial services regulatory frameworks — this uncertainty is a real compliance question, not a hypothetical one.

The backdoor question

This is where the technical and policy communities most sharply disagree. The concern: could a Chinese AI lab embed hidden behaviors in model weights — behaviors triggered by specific inputs, designed to exfiltrate data, produce subtly wrong outputs for sensitive queries, or perform other adversarial functions?

The honest assessment: there is no confirmed evidence of this in any widely-used open-weight Chinese model. Security researchers including teams at several US universities have audited DeepSeek weights and found no confirmed backdoors. However, this is genuinely difficult to prove in the negative for a model with hundreds of billions of parameters. A sufficiently sophisticated embedded behavior might not be found by current audit methods.

The probability should not be conflated with the consequence. The probability appears low — there are strong incentives against it (discovery would destroy the entire Chinese open-source AI ecosystem's credibility globally). The consequence of a confirmed backdoor in, say, a healthcare or government deployment would be severe. Whether you weight low-probability, high-consequence risk as a disqualifier depends on your threat model.

The model license

DeepSeek's model license contains restrictions that some legal teams flag. It prohibits use for activities that harm China's national interests and requires compliance with applicable Chinese law. Legal interpretations vary widely on whether this clause creates any real obligation on a Canadian entity running weights locally. It is, however, present and unresolved.

What Canadian law actually says — and doesn't

There is currently no Canadian law that prohibits running Chinese open-weight AI models on-premises. There is no federal regulation that classifies Chinese model weights as controlled goods. There is no equivalent of certain US executive orders restricting Chinese AI technology.

What exists is more diffuse:

PIPEDA and Bill C-27 require that personal data be handled appropriately. If your on-prem deployment processes personal information, you are responsible for ensuring the system behaves as claimed. A system that has been manipulated to extract or mishandle personal data could put you in breach regardless of the model's origin. The model origin itself isn't regulated; the data handling outcome is.

Treasury Board's Protected B guidance requires that systems handling Protected B information be assessed under the Government of Canada's security framework. There is no explicit exclusion of Chinese-origin models, but the assessment process for a system using a Chinese open-weight model in a Protected B context would need to address the backdoor risk question with documented rationale. The answer "we assessed it and it's fine" is achievable — but you need to do the work.

CSIS and CSE advisories have consistently warned about the risk of Chinese technology in critical infrastructure and national security contexts. These advisories focus primarily on hardware (Huawei, specifically) and have not been extended explicitly to AI model weights. However, CSE's guidance on software supply chains is directionally relevant and is likely to evolve.

The Communications Security Establishment (CSE) has published guidance on assessing foreign technology risks for government use. Their framework would apply to a government department evaluating whether to deploy Chinese model weights. The framework asks about the developer's relationship with a foreign government, the potential for undisclosed functionality, and the ability to conduct independent security assessment. Chinese AI labs score poorly on the first criterion and ambiguously on the second and third.

The Canadian government's working posture

Canada's official stance on Chinese AI is best described as "concerned but not prohibitive" — a meaningful distinction from the US approach, which has moved toward increasingly specific restrictions.

The Trudeau government's Voluntary Code of Conduct on the Responsible Development of Advanced Generative AI Systems (2023) focused on frontier AI developers, not on deployment practices. It did not address foreign model use.

ISED's Canadian Sovereign AI Compute Strategy (2024–2025) framed the problem primarily as a compute-cost and capacity issue, not explicitly as a Chinese AI exclusion policy. However, the strategic logic — develop domestic sovereign AI capacity to reduce dependency on foreign infrastructure — implicitly points toward skepticism of foreign (including Chinese) model dependence.

The most direct public signals came from the National Security and Intelligence Committee of Parliamentarians (NSICOP), which referenced AI supply chain risks in its 2025 annual report. The report stopped short of policy recommendations on open-weight models specifically, but characterised the broader Chinese technology risk environment as "persistent and multifaceted."

The practical working posture for Canadian federal departments, based on how procurement and security reviews are actually being conducted: Chinese API use is a hard no. Chinese open-weight on-prem use requires a documented security assessment and is effectively unavailable for Protected B and above without significant justification. Below Protected B, in non-sensitive commercial contexts, it exists in a grey zone that security teams are navigating case by case.

What organizations are actually doing

The corporate landscape is fragmented in instructive ways.

Large Canadian financial institutions have largely moved to prohibit all Chinese AI API use. Most have not yet issued formal policy on open-weight on-prem deployment — it either hasn't come up as a live question yet, or their security teams are still working through it. Several major Canadian banks and insurance companies are understood to be conducting internal reviews.

Canadian technology companies and startups are generally more permissive. Running DeepSeek locally for code assistance or internal tooling — where the data involved is not personal or regulated — is common. The developers making these choices distinguish clearly between "using DeepSeek API for customer data" (which they understand is problematic) and "running DeepSeek weights on an air-gapped dev machine" (which they treat as reasonable).

Healthcare and legal sectors are treating any Chinese model use cautiously regardless of deployment model. For sectors where client confidentiality is a professional legal obligation (solicitor-client privilege, physician-patient confidentiality), the risk appetite for novel unresolved technology questions is very low.

Academic and research institutions are largely unrestricted in their use of open-weight Chinese models. The research community has embraced DeepSeek R1 in particular for its reasoning capabilities. This is appropriate for research contexts where the threat model is different — but the research community's permissive stance should not be used to infer safety for regulated operational deployments.

The Taiwan and Singapore middle ground

This is the most genuinely interesting and least-settled part of the landscape, and it deserves careful treatment.

A growing class of AI models exists that might be called "Chinese adjacent" — they carry significant Chinese research DNA (trained by Chinese-origin researchers, built on Chinese architectural innovations, sometimes using Chinese training infrastructure) but are developed, released, or incorporated through non-Chinese legal entities.

Singapore has emerged as the jurisdiction of choice for Chinese AI founders who want international credibility. Several significant AI labs have Singapore incorporation, even when their research teams are primarily in China or staffed by Chinese nationals. ByteDance, which developed the Doubao/Skylark models, has Singapore subsidiaries. The legal question of whether a Singapore-incorporated company with Chinese parent ownership or Chinese government investment is meaningfully different from a China-incorporated company is not settled. Singaporean law does not create the same data-access obligations as Chinese law — but Singapore's relationship with China and its own intelligence-sharing posture are not identical to Canada's.

Taiwan presents a genuinely different picture. Taiwan's legal system is independent of the PRC, its intelligence-sharing posture aligns closely with the Five Eyes, and Taiwanese AI researchers have a long history of working within the international academic community. TSMC's semiconductor manufacturing being located in Taiwan is often cited in discussions about Chinese supply chain risk — but the inference should run the other way: Taiwan's semiconductor industry exists specifically in tension with Beijing, not in collaboration with it. A model trained and released by a Taiwanese entity with no PRC investment or ownership represents a different risk profile than a PRC-trained model.

The architectural question cuts across these distinctions. Many newer open-weight models outside China are built on architectural insights and training techniques published by Chinese labs, and some were initialized from or distilled from Chinese models. Qwen's architectural innovations influenced several subsequent international models. Does using a model that was influenced by Chinese research create a Chinese sovereignty risk? Almost certainly not — that's too broad a definition, and it would implicate most modern AI research. The relevant factor is not academic influence but ownership, training data, and legal obligation.

"The question is not where the math was invented. It is who owns the weights, who trained on what data, under whose legal jurisdiction, and who has the ability to issue an update."

— Paraphrase of the working framework used by several Canadian federal security assessors, as described in industry consultations, early 2026

The open-weight model that threads the needle

Does a model exist that combines frontier-class capability, cost-competitive economics, open-weight deployability, AND a clean sovereignty posture for Canadian regulated use? The honest answer as of mid-2026 is: approximately, but not perfectly.

Mistral (French) and its variants — Mixtral 8x7B, Mistral 7B — are the closest to this ideal from a sovereignty standpoint. French-incorporated, European legal framework, no Chinese investment or research provenance. The capability gap relative to DeepSeek at the same parameter count is real but closing. For many enterprise tasks, Mistral models are adequate. For tasks that require frontier reasoning capability, they currently fall short.

Meta's Llama 3 is US-incorporated, which creates its own considerations for Canadian sovereigntists — specifically, CLOUD Act exposure if Meta were compelled to update model weights or if you're using any Meta-connected infrastructure. Running Llama 3 weights locally avoids the runtime data issue, just as with Chinese models. The US legal entity question is different from the Chinese legal entity question, but it is not zero.

Canada's own AI research output — Vector Institute, Mila, CIFAR — has produced important research but not, as yet, a production-grade sovereign open-weight model at the scale needed to replace frontier APIs. This is the gap that ISED's compute strategy is intended to address, but the timeline to a Canadian-provenance frontier model is years, not months.

The practical hybrid that several Canadian organizations are converging on: deploy Mistral or Llama 3 for sensitive workloads where sovereignty is paramount; use DeepSeek or Qwen on air-gapped infrastructure for lower-sensitivity, high-volume tasks where the cost advantage is significant; use TELUS sovereign cloud or equivalent for burst capacity; route only truly non-sensitive workloads to US frontier APIs. This is messy, but it reflects the actual state of the options.

What the security community actually thinks

There is a real divide, and it maps roughly to professional background rather than being resolvable by evidence alone.

Intelligence and national security practitioners tend toward a precautionary posture: the supply chain origin of a model used in sensitive infrastructure matters regardless of current audit results, because the threat model includes future capabilities and undiscovered vectors. They point to the long history of supply chain compromise in hardware and software — cases where risks were dismissed as theoretical until they weren't.

AI security researchers and practitioners tend toward an empirical posture: show me the backdoor. Current audits of DeepSeek weights have not found confirmed malicious behavior. The precautionary argument, taken to its logical conclusion, would ban any model whose training process you did not personally supervise — which rules out nearly everything.

Canadian IT security professionals working in the private sector are, in the main, navigating by risk category rather than by blanket policy: Chinese API = no. Chinese open-weight for Protected B+ = no without documented assessment. Chinese open-weight for sensitive-but-not-classified commercial use = case-by-case. Chinese open-weight for low-sensitivity internal tooling = generally acceptable.

Where this is going

The trajectory of US policy is toward increasing restriction of Chinese AI model weights — not just APIs. The Commerce Department's Bureau of Industry and Security has been examining whether open-weight Chinese models should be subject to export control or technology restriction frameworks, and congressional pressure in this direction is significant. Canada has historically aligned with US technology security posture with a lag of 12–24 months. The probability that Canada remains silent on this question indefinitely is low.

At the same time, the capability of non-Chinese open-weight models is improving rapidly. The window in which Chinese models offer a unique capability-per-dollar advantage that has no Western alternative is likely narrowing, not widening. The calculus for choosing a Chinese model over a comparable Western alternative will shift.

The most likely near-term outcome for Canadian regulated industries: informal guidance from CSE or ISED that creates a de facto prohibition on Chinese open-weight models in Protected B contexts, without formal legislation, followed by formal policy incorporation into government procurement standards. This would follow the pattern of how Huawei exclusion was handled — precautionary direction ahead of explicit legal framework.

The summary for practitioners

Risk assessments are the authors' synthesis of available evidence as of June 2026. This is not legal advice. Engage qualified Canadian legal counsel and CSE-approved security assessors for regulated deployments.