Can Chinese Companies Use Overseas AI Models? Five Variables and Three Workable Routes

The model is not the question

Discussions about overseas AI models tend to start with the wrong subject. Whether a particular model is permitted in China is rarely the issue. The issue is what happens to data on the way to it, who the users are, and what the contract says.

Three separate regulatory threads run in parallel, and they are often confused:

• Outbound data transfer, governed by the PIPL, the Data Security Law and the data export provisions.
• Generative AI services offered to the Chinese public, governed by the Generative AI Measures and the filing regime.
• Contract and security obligations toward the vendor, which are commercial but determine what can be evidenced later.

A company can be compliant on one thread and exposed on another. Treating the question as a single yes-or-no produces the wrong answer in both directions.

Five variables

First, what goes into the prompt. Public information carries little risk. Customer records, employee data, unpublished financials and technical documents carry a great deal. The variable is the content, not the tool.

Second, the route. A direct API call from a mainland entity, a call routed through an overseas affiliate, and a model deployed on domestic infrastructure are three different legal configurations. The route determines whether an outbound transfer occurs at all.

Third, the users. Internal employees, domestic customers, and overseas customers sit under different obligations. A tool used only by staff is a workplace question; the same model behind a public product is a service question.

Fourth, the contract. Whether inputs are used for training, retention periods, sub-processing, and the provider’s response to law-enforcement requests all bear on whether the arrangement can be defended.

Fifth, internal use versus public service. This is the dividing line most often blurred. Internal productivity tools generally fall outside the generative AI filing regime; a service offered to the public generally does not.

Three routes that work

Route one: internal use, no regulated data. The model is used by staff for drafting, summarising and analysis, with a written policy excluding personal information, customer data and technical secrets from prompts. Technical controls — enterprise accounts, logging, and blocking of consumer endpoints — support the policy. No outbound transfer of regulated data occurs, so the export regime is not engaged. This is the most common workable arrangement and the least documented one.

Route two: overseas entity, overseas users. A group operates a service outside China through an affiliate, with data generated and stored outside. If the service is not offered to the Chinese public, the generative AI filing regime is not engaged. The boundary is the target of the offering: Chinese-language marketing, RMB payment and domestic distribution can bring the service back within scope regardless of where the entity sits.

Route three: domestic deployment. The model, or a licensed variant, runs on domestic infrastructure, so no outbound transfer occurs. This route is slower and costlier but is the only one that supports serving Chinese users at scale with regulated data. It also brings the service within the filing regime, which should be planned rather than discovered.

Contract clauses worth reading

Vendor terms are usually accepted without reading. Four clauses decide most of the risk.

Training use. Whether inputs may be used to improve the model. A clause permitting training on customer inputs converts every prompt into a disclosure.

Retention. How long inputs and outputs are stored, and whether deletion is available on request. Retention determines the exposure window after an incident.

Sub-processors. Which third parties receive the data, and whether changes require notice. A long sub-processor list is a long transfer chain.

Legal access. What the provider will do when a foreign authority requests data. The answer is often “comply”, which is a fact the buyer needs to price in rather than discover later.

What to document

Documentation is what turns an arrangement into a defensible position. Three items are usually enough:

1. A short assessment recording the data categories involved, the route, and why the export regime is or is not engaged.
2. An internal policy listing permitted and prohibited prompt content, with the enforcement mechanism.
3. The vendor’s data processing terms, with the four clauses above marked and, where necessary, amended.

Red lines

Some categories are not managed by contract or policy.

Important data, state secrets, personal information of minors, and large volumes of personal information should not be transmitted to an overseas model under any arrangement short of a completed security assessment. Where the volume crosses the statutory thresholds, the assessment is mandatory and cannot be replaced by consent or by contractual safeguards.

The practical conclusion is unglamorous: most companies can use overseas models, provided they decide in advance what may be sent, by which route, and to whom — and can show that the decision was made rather than assumed.

Related reading: Data Export: Three Routes and How to Budget, Personal Information Protection Impact Assessment, Enterprise AI Use Policy.