China’s open-source AI strategy is building a self-reinforcing competitive advantage that US export controls were not designed to counter, the US-China Economic and Security Review Commission has warned.
“US export controls primarily target the digital loop, restricting access to advanced chips used for frontier model training — but are not well suited to addressing the physical loop of deployment-driven data creation and accumulation across China’s manufacturing base,” the Commission said in a paper. “As open models reduce the compute required for effective deployment, China’s ability to generate proprietary industrial data at pace and scale becomes increasingly independent of access to cutting-edge hardware.”
The paper, titled Two Loops: How China’s Open AI Strategy Reinforces Its Industrial Dominance, argues that Chinese labs have built a global diffusion engine through permissive licensing and pricing that undercuts US rivals and that widespread adoption is generating industrial data advantages that no current policy framework addresses.
Chinese model adoption runs deep
The scale of that adoption is visible in the numbers. Alibaba’s Qwen model family is now the largest ecosystem on Hugging Face with over 100,000 derivative models, the paper said. From November to December 2025, seven of the ten most downloaded models on the platform came from Chinese labs, including derivatives of DeepSeek, whose rapid rise has already unsettled enterprise AI procurement assumptions.
The paper further added that commercial penetration extends deep into US enterprises. One partner at venture capital firm Andreessen Horowitz estimated that roughly 80% of US startups use Chinese base models to build derivative applications, the paper noted. On pricing, Moonshot AI’s Kimi K2.5 costs four times less than OpenAI’s GPT-5.2 while matching it on capability scores, the paper said, citing Artificial Analysis benchmark data.
“Enterprises are no longer making a clear, deliberate choice about which AI model they adopt,” said Sanchit Vir Gogia, chief analyst at Greyhound Research. “Models are entering enterprise environments through copilots, SaaS platforms, API layers, and fine-tuned derivatives. The enterprise is often several layers removed from the original source.”
Traditional third-party risk management was never designed for this, Gogia added. “It does not track model ancestry, fine-tuning chains, training data inheritance, or runtime routing behaviour.”
Security risks outpace governance
The security risks attached to that invisible exposure are documented. The US National Institute of Standards and Technology evaluated DeepSeek’s models in September 2025 and found agents based on DeepSeek’s most secure model were, on average, 12 times more likely than US frontier models to follow malicious instructions, the paper said. In simulated tests, hijacked agents sent phishing emails, downloaded malware, and exfiltrated user login credentials.
The paper also noted that Chinese models are subject to political content restrictions, and that enterprises routing workloads through Chinese-linked providers face data jurisdictional risks — a concern that has drawn regulatory scrutiny across Europe and South Korea.
“CIOs should extend risk frameworks to include model lineage, mandating vendors to disclose model origins and training data,” said Deepika Giri, AVP and regional head of AI, analytics, and data at IDC. “It is not just adequate if models are small — they also must be safe to be enterprise-grade. This becomes extremely critical for regulated industries.”
Gogia said enterprises need to treat AI like a software supply chain. “A Model Bill of Materials must capture base model origin, derivative history, datasets used, and hosting geography — and must be continuously updated, because these systems change in production without triggering traditional procurement events.”
Factory deployment widens the gap
The commission’s deeper concern is that China’s advantage operates through two distinct cycles.
The first is digital: open models drive adoption, adoption drives iteration, and iteration produces more capable models. The second runs through the physical economy — AI deployed across China’s factories, logistics networks, and robotics sector generates proprietary real-world data that feeds back into model improvement. Beijing formalized this in 2020, designating data as the fifth factor of production, and became the first country to allow enterprises to carry data assets on their balance sheets, the commission noted in the paper.
The models most consequential for enterprise deployment, the paper argued, are not frontier large language models but small, task-specific models — a category China’s open ecosystem already dominates. A Nvidia research paper cited by the commission found that small models handle the bulk of operational subtasks in agentic AI systems at costs 10 to 30 times lower than frontier alternatives.
“The real question is no longer which flagship model a vendor uses,” Gogia said. “The real question is which models are actually executing tasks in production — what they are derived from, how often they are updated or swapped, and how they are governed.”
US response remains fragmented
The commission acknowledged nascent steps by US firms, but warned the overall response remains uncoordinated. OpenAI released its first open-weight models since GPT-2 in August 2025, followed by Nvidia’s Nemotron 3 in March 2026. But Meta is reportedly preparing to shift its next-generation model to a closed, API-only approach.
“If sustained,” the paper said, “Meta’s retreat from openness would leave the United States without a major frontier model developer anchoring its open AI ecosystem at precisely the moment China’s state-backed open development is accelerating.”