The best AI you can own is Chinese. The West needs to close that gap quickly.
In January, a federal judge in the Southern District of New York ordered OpenAI to produce twenty million de-identified ChatGPT conversations to news organizations suing it for copyright infringement. OpenAI could produce the conversations because they sat on OpenAI’s servers. Cloud artificial intelligence (AI) keeps its records with the provider, and control over those records rests with the provider and, when a court decides, with the parties across the table.
The ruling made visible a cost that Microsoft CEO Satya Nadella has since given a name. In a July 12 essay on what he calls the Reverse Information Paradox, Nadella argues that a buyer of a closed model pays twice: once in money and again in the proprietary knowledge it must reveal to make the model useful. Every prompt, correction, and workflow trace teaches the provider’s systems something about the customer’s business. “In consuming intelligence, you are creating intelligence,” he writes, and what you create should belong to you. The court order is one instance of a broader condition: when the model runs on someone else’s infrastructure, both the record and the learning sit outside your walls. Running the model on infrastructure you control brings them back inside.
A closed model, like Anthropic’s Claude, OpenAI’s GPT, or Google’s Gemini, runs only on the provider’s servers, reached through an account. You send it your data, and it sends back an answer. The model itself never leaves the provider’s control. An open-weight model is one whose trained parameters are released for anyone to download, so you can run it on hardware you own, with the weights in your hands to inspect and fine-tune. Only an open model can be run that way, with the weights under your control; a closed model stays the provider’s even when it runs on your premises. The hardware to do so arrived this year at every scale.
At the Build and Computex shows in May, Microsoft and Nvidia introduced a Windows runtime and the RTX Spark accelerator, a Grace-Blackwell superchip with up to 128GB of unified memory. More than thirty laptops from Surface, Dell, ASUS, HP, Lenovo, and MSI will ship with it this fall, able to run models of roughly 120 billion parameters entirely on the device. One step up, a company can buy or lease GPU servers for its own premises and run far larger systems there, with no hyperscaler in the loop. The spectrum runs from a professional’s laptop to a corporate server room, and in every case the model runs on hardware the user owns.
The open tier is Chinese, and it is now policy
According to the Artificial Analysis Intelligence Index as of mid-July, Moonshot’s Kimi K3, released on July 16 at 2.8 trillion parameters with open weights promised by July 27, ranks fourth among all models worldwide, behind only Anthropic’s Claude Fable 5 and two configurations of OpenAI’s GPT-5.6. Z.ai’s GLM-5.2 leads the open models whose weights are already published, ahead of DeepSeek’s V4 and MiniMax’s M3. Three days after K3, Alibaba previewed Qwen3.8-Max at 2.4 trillion parameters, described it as second only to Fable 5, and said it will be open-weighted. Positions shift month to month, but the pattern has held: since 2025, release by release, the strongest open-weight models have come from Chinese labs.
That lead became explicit state policy this month. Opening the World AI Conference in Shanghai on July 17, President Xi Jinping urged countries to seize the “historic opportunity” of open-source AI, presented China as a provider of international public goods in AI, pledged AI capacity-building for developing countries, and welcomed the World AI Cooperation Organization (WAICO) that twenty-nine countries had established a day earlier, headquartered in Shanghai. Xi tied openness directly to AI “moving from the digital world into the physical world,” the domain where China’s manufacturing and robotics base is strongest. Alibaba had kept its flagship Max models closed and API-only since late 2025 while releasing smaller models openly; days after the speech it returned to open weights at the flagship level.
One distinction matters before drawing conclusions from the leaderboard. The models at the top of the open tier are enormous, and none of them runs on a laptop; even compressed to 4-bit precision, a 2.8-trillion-parameter system needs well over a terabyte of memory. What reaches personal devices is a derivative tier: smaller, distilled, quantized versions of the flagships, prepared for constrained hardware. Microsoft’s Foundry Local, a runtime developers use to ship models inside their applications, illustrates the point. Its catalog is curated to models small enough to distribute to end users, and it lists Qwen and DeepSeek variants alongside Western entries such as GPT-OSS, Mistral, and Phi. Inclusion in a catalog means availability: Microsoft does not preinstall these models, ship them with devices, or endorse them by listing them. On company servers, by contrast, the full open-source flagship itself can run, and Microsoft’s own exploration of Chinese weights sits at that scale. The company told Axios in June that it is evaluating a fine-tuned, Azure-hosted version of DeepSeek V4, or another open model, as a lower-cost engine for its Copilot Cowork agent.
The trend toward smaller, bespoke models
Almost no organization needs a generalist AI. A logistics firm’s model does not need to design rockets, annotate Byzantine history, or write screenplays. Fine-tuning a smaller open model on the organization’s own data produces a system that outperforms a hosted generalist at the organization’s actual work, fits on hardware the organization can own, and keeps the training signal (the corrections, the traces, the accumulated judgment) inside the company.
The Western open ecosystem has begun to move in this direction. On July 15, Thinking Machines Lab, founded by former OpenAI chief technology officer Mira Murati, released Inkling, a 975-billion-parameter open-weights model under an Apache 2.0 license, with a lighter 276-billion-parameter variant. It is the largest open-weights release from a Western lab and, on independent testing, the strongest, and it still trails the Chinese open flagships on raw capability. The demand side is moving in parallel. Palantir recently announced an engine with Nvidia for running open-weight Nemotron models in sovereign environments for US government agencies and critical infrastructure, with agencies retaining ownership of the resulting weights.
What the controls miss
Western policy responses to Chinese models have targeted hosted services. In 2025, Germany’s federal data protection authority found that DeepSeek’s app unlawfully transfers German users’ data to servers in China and asked Apple and Google to remove it. Italy’s regulator blocked DeepSeek from processing Italian data, and Australia and several US agencies barred the app from official devices. Each measure targets the same fact: the app sends what users type to infrastructure in China. But open models running on hardware the user owns do not send anything anywhere.
Export controls approach from the other direction: they are built to keep advanced chips out of Chinese data centers, and how they apply to a Chinese model file already residing on a server in Frankfurt or Dallas is unsettled at best. The distribution channel is also expanding beyond downloads. Through WAICO, capacity-building programs, and AI partnerships with the Association of Southeast Asian Nations, the Arab League, the African Union, and the BRICS grouping of emerging economies, China is promoting its open models directly to governments. App-store restrictions can block an app, and chip export controls can stop hardware shipments. Neither prevents a government, backed by Chinese training and technical support, from choosing Chinese models as the foundation of its national AI infrastructure.
None of this describes wrongdoing by the companies building the hardware or the platforms; it describes controls designed for cloud services and data centers meeting a computing architecture that has moved past them.
What remains: provenance and lineage
Once data movement is off the table, what remains is the model itself: its provenance, meaning the origin, lineage, and modification history of the weights. The risks usually bundled under that word are distinct and deserve separation. Embedded model censorship and manipulation are training-time behavior risks, set by whoever chose the data and the content rules. Security weaknesses are quality risks; the US Center for AI Standards and Innovation downloaded DeepSeek’s weights in 2025, evaluated them on its own servers, and documented shortcomings on both counts. Tampering and poisoning are supply-chain risks that arise after release, as weights are copied, quantized, and fine-tuned on the way to deployment. Each risk has a different owner and a different mitigation.
Lineage is the thread that connects these risks, and it runs through distillation. Distillation is training a new model using a stronger existing model as a teacher. The model on a laptop is the end of a chain, distilled from a flagship, quantized by a platform, sometimes fine-tuned by a vendor, and no one tracks that descent. The dependency is deeper than it looks. Western frontier labs forbid distillation in their terms of service, but Chinese labs face little effective enforcement when they do distill, while Western open-weight builders, who do follow the terms, are shut out of the same teachers and left to progress at the slower pace the ban imposes. So they turn to Chinese open models instead; Thinking Machines has disclosed that some of Inkling’s training drew on Moonshot’s Kimi K2.5. The result is a chain in which Western open models learn from Chinese ones, which learned from the American frontier that Western builders are barred from using directly.
The trust-intelligence-power (TIP) triangle, a framework I use for weighing sovereign AI strategies, explains why this is more than a licensing concern. It scores countries across three layers: power, the physical base of grids, chips, and export licenses; intelligence, the model, its data, and its talent; and trust, whether the system and the jurisdiction behind it can be relied on. The West has competed on intelligence, treating the best model as the prize. But when the model can be downloaded and run on hardware anyone owns, intelligence stops being scarce, and advantage moves toward the layers that remain scarce: the power beneath the model and the trust the model carries. The West still leads on power and on the closed frontier. What it does not yet govern is the trust layer of the open models that organizations can own outright, and those are Chinese.
What the West should do
- Compete for the intelligence layer on open models. The US administration’s July 2025 AI Action Plan encourages open-source and open-weight AI. A year on, Inkling and Nvidia’s Nemotron line are the first substantial Western entries, but a structural handicap still stands: frontier labs’ terms of service forbid distillation, so a Western open-weight builder that wants a strong teacher must either breach those terms or learn from Chinese models that distilled the American frontier anyway, importing the very lineage problem this article describes. The best solution, as proposed by Stratechery’s Ben Thompson and Nadella, is legislation that makes collecting data for model training explicitly fair use and bars terms of service that forbid distillation, at minimum for US companies. Nadella calls it ironic that labs claim fair use to train on public data and then impose restrictive distillation terms, and he expects enterprises to insist on the right to fine-tune their own models on the outputs of the models they pay for. The change would cut against the frontier labs’ commercial interests, but it would let Western open models learn from the Western frontier directly, at the source.
- Strengthen governance to reinforce the trust layer. The catalog is a natural control point, and it already carries some of the machinery. Foundry Local curates, tests, versions, and quantizes the models it distributes; extending catalog listings to disclose lineage (what a model was distilled from, who quantized or fine-tuned it, what it was evaluated against) turns the catalog into a governance surface. In the United States, the Center for AI Standards and Innovation is tasked with assessing the adoption of foreign AI systems and would be the natural author of a provenance and disclosure standard. Binding operational directives, the instrument that removed Kaspersky products from federal networks in 2017, can keep unvetted weights off federal systems, and FedRAMP-style authorization can extend the requirement through procurement. In Europe, the European Commission’s AI Office already collects training-content summaries from general-purpose model providers under Article 53 of the AI Act, documentation a lineage regime for self-hosted models can build on directly.
- Move safeguards from the network to the model to secure the power layer. This means independent evaluation and red-teaming for embedded behavior, security weaknesses, and tampering, before a model is cleared for sensitive work. The machinery is already running. CAISI’s 2025 evaluation of DeepSeek set the template; the United Kingdom’s AI Security Institute runs the equivalent capacity for frontier systems, and Microsoft announced expanded evaluation partnerships with both bodies in May 2026, covering adversarial assessment and the detection of compromised models. The point of control becomes the model’s behavior, examined once and documented, in place of packets watched continuously.
For years, sovereign AI has been governed at the central facilities: a data center that can be located, a chip that can be licensed, a cloud account that can be subpoenaed. Those instruments still matter, but a growing share of intelligence now runs beyond them, on hardware that organizations own precisely to keep their data, their outputs, and their learning loop to themselves. That motive is sound. The gap is that the models best suited to fill it today carry a provenance the West has neither measured nor governed. The answer is to compete for the tier that organizations own: Western open models, tuned to the work, running on servers inside the company, with lineage that can be read. Every organization will own its AI. The West should make sure that what gets owned is something it helped build.
Ivan Ferrari is a nonresident senior fellow at the Atlantic Council’s GeoTech Center.
The views expressed are solely those of the author and do not necessarily reflect the views of the Atlantic Council.
The GeoTech Center champions positive paths forward that societies can pursue to ensure new technologies and data empower people, prosperity, and peace.
Further reading
Image: Credit: Jonakoh via Unsplash