Choosing Your Open Weights LLM: China vs. U.S.

A procurement team at a US regional bank spent nine months standing up Llama 4 Maverick on a private cluster, then discovered during a legal review that the Llama 4 Community License withholds Section 1(a) rights for the multimodal weights from companies headquartered in the EU, where its parent is domiciled. The project was shelved, the GPUs were repurposed, and the sunk cost ran to the seven figures. The mistake was not the choice of Meta's model. It was treating "open weights" as if it meant Apache 2.0 when it did not.

The choice between Chinese and American open-weight model families is now a serious procurement question, not a political one. Capability has largely converged. License terms, embedded behavior, export posture and supply-chain assumptions have not. This piece lays out what a CIO or CISO can defend when the weights, rather than an API endpoint, are what sits on the organization's GPUs.

Capability Parity Is Mostly Real

The 2026 Nature analysis of Moonshot's Kimi K3 release summarised the state of play bluntly: a Chinese-built reasoning LLM can now match or outperform cutting-edge US models on tasks such as coding and spreadsheet manipulation, according to the lab's own benchmarks. CSIS reached a similar conclusion from the other direction, reporting that the gap between the leading U.S. models and DeepSeek V4 Pro is about eight months on the Center for AI Standards and Innovation's open-weight evaluations.

Public leaderboards back the pattern. On the Artificial Analysis Intelligence Index, as checked in late October 2026, DeepSeek V4.1-Flash and GLM-5.3 tie at 45 for the highest open-weight score, with Kimi K3 one point behind. The practical read is that for the general-purpose reasoning, coding and retrieval workloads that drive enterprise RAG and agent builds, model family is no longer the capability bottleneck. Inference stack, context handling and fine-tuning data are. That shifts the decision toward license, embedded behavior and supply-chain risk, which is where the two ecosystems actually diverge.

License Terms Are Where The Real Divergence Lives

The Chinese open-weight headliners ship under permissive software licenses that enterprise counsel already recognize. DeepSeek-R1 is distributed under the MIT License, which permits free distillation and commercial use of the model and its outputs. Qwen3 was released under Apache 2.0, including the MoE Qwen3-235B-A22B and the dense models from 0.6B to 32B. Kimi K2 and GLM both ship under similarly permissive terms.

Meta's Llama 4 is governed by a custom Llama 4 Community License with three provisions that matter for procurement: a 700-million monthly-active-user threshold that requires a separate license from Meta, an incorporated Acceptable Use Policy that Meta can amend unilaterally, and the EU-domicile restriction on the multimodal weights. For a US client that is fine. For a global enterprise with EU subsidiaries that process images or video through Scout or Maverick, it is a legal exposure that an Apache 2.0 model does not carry. OpenAI's gpt-oss-120b and gpt-oss-20b remove part of that licensing exposure on the US side by shipping under Apache 2.0, with the 120B running on a single 80 GB GPU and the 20B fitting in 16 GB.

The upshot is counterintuitive. If the test is "which weights can our general counsel sign off on without a bespoke negotiation," several Chinese model families currently clear the bar more cleanly than the Llama family does. That is not a political statement. It is what the license files say. The private LLM RFP checklist treats license review as a day-one item for exactly this reason.

Embedded Safety Behavior And Audit Depth

Open weights are not open source. The Stanford HAI brief on China's ecosystem is careful on this point, and the Open Source Initiative's 2024 definition makes it explicit: a model is open source only if the training data, code and weights can all be studied and rebuilt. Almost no production LLM meets that bar. What you can actually audit on either side is the weights, the published evaluations and the behavior under your own red-team.

Behavior differs in observable ways. Chinese-trained models carry alignment with Chinese regulatory guidance, embedded through the Interim Measures for the Management of Generative AI Services, which took effect in August 2023 and requires a CAC security assessment and algorithm filing before public release. By March 2025, 346 generative AI services had been filed. That shows up in refusals on politically sensitive prompts and in training-data choices. For a healthcare payer or a defense contractor, those refusals are usually irrelevant, but they must be measured, not assumed away. A pre-deployment LLM security audit and model review is the mechanism; a one-page memo is not.

US-origin models have their own embedded behavior. Llama's Acceptable Use Policy prohibits use for ITAR-controlled materials, nuclear applications and espionage, which is a live concern for the defense-industrial base and for any contractor whose work touches controlled unclassified information under CMMC. A model whose license forbids the mission is not a candidate, regardless of benchmark score.

Export Controls Cut Both Ways

Procurement risk is not one-sided. The National Law Review's 2025 analysis of export control exposure on both sides is the clearest framework for CISOs. US models can be subject to Commerce Department controls that restrict downstream deployment in sanctioned jurisdictions. Chinese open weights can be subject to future restrictions from either government: Beijing has reportedly discussed limiting overseas access to domestic models, and Washington has debated listing specific Chinese labs on the Entity List.

The practical mitigation is the same one that makes private deployment attractive in the first place. Weights downloaded today, mirrored to an internal registry and run on hardware the client controls are not subject to a future API shutoff. That is the architectural case for an LLM appliance or an air-gapped cluster over a hosted model: a change in either country's export posture does not reach into the rack. The ongoing DeepSeek data-storage concerns apply to the hosted service, not to the open weights themselves, which is the distinction the blog post makes.

What A Defensible Selection Framework Looks Like

The Stanford HAI brief notes that between August 2024 and August 2025, Chinese open-model developers accounted for 17.1% of all Hugging Face downloads, and by September 2025 the Qwen family had surpassed Llama as the most-downloaded LLM family. Adoption is not an argument on its own, but it does mean a wider tooling and fine-tuning ecosystem for the Chinese families than many procurement teams assume. Pair that with the capability data above and the following framework holds up to a board review.

• Use case first. If the workload is federal, defense or ITAR-adjacent, Chinese weights are out by policy regardless of score. For most commercial regulated work in finance, healthcare and manufacturing, both ecosystems are candidates.
• License fit. Match the license to the deployment: Apache 2.0 or MIT for anything you intend to fine-tune heavily and redistribute as a derivative; the Llama 4 Community License only if you are comfortable with the MAU threshold, the EU multimodal carve-out and Meta's right to amend the Acceptable Use Policy.
• Behavioral measurement. Red-team embedded refusals and training-data artifacts on your actual prompts before the production decision. Document the results in the model card you keep for SOC 2 and HIPAA.
• Supply-chain insulation. Mirror the weights internally. Pin the version. Keep a secondary candidate from the other ecosystem qualified so a license change on either side does not strand the project.

Related reading on the mechanics: a comparison of vLLM, TensorRT-LLM and SGLang for serving these models in production, and a cost breakdown of on-prem training options for open weights once a family is chosen.

A Short Decision Rule

Choose a Chinese open-weight family (Qwen, DeepSeek, GLM, Kimi) when the license needs to be unambiguously permissive, the workload is commercial rather than federal, and the fine-tuning plan will produce a derivative you intend to redistribute inside the organization. Choose a US open-weight family (Llama 4, gpt-oss, Gemma, Mistral-backed releases) when the workload touches ITAR, CMMC or federal procurement, when the MAU threshold and the EU carve-out do not apply to the deployment, or when an existing Meta or OpenAI tooling investment materially shortens the integration. In every other case, qualify one from each ecosystem, measure behavior on your own corpus, and keep both weights mirrored. The weights stay home either way.