Data Security and Compliance Risks of Domestic Secondary Development Using Overseas Large Models

Recently, I've been chatting with many friends building AI applications, and I've noticed a very common phenomenon: everyone almost "by default" chooses overseas large models—calling OpenAI or Anthropic APIs, or pulling down open-source weights like Llama or Mistral for fine-tuning, RAG, knowledge bases, vertical applications... The technical path is mature and the results are good—who would argue with "what works"?

But very few people seriously consider one question: Is this path actually compliant in China?

Let's start with the conclusion. The key to determining whether an application based on an overseas large model is compliant is not whether you use a self-developed model, but whether you open your service to the public within China.

That is: if the model/application is only for internal use by your own team, behind closed doors—in principle, you don't need to go through the entire filing process; but if you plan to package it as a product, SaaS, mini-program, or even just a small feature embedded in a website, open to users within China—then regardless of whether the underlying model is self-developed or calls overseas APIs, it may fall under regulation.

1. Data Security Compliance Risks (Core Risk)

This is the most concentrated and easily underestimated risk in the entire chain, mainly reflected in three aspects:

Cross-Border Data Transfer Red Line: Calling overseas APIs essentially means transmitting user-input prompts, uploaded files, and business data over the network to overseas servers for processing. Legally, this constitutes "cross-border transfer of personal information" or "cross-border transfer of important data," triggering a full set of assessment and reporting obligations under the Data Security Law and the Personal Information Protection Law.

There is a common misconception to highlight: The "separated storage and computing" architecture—where the model is deployed overseas but the application and storage are in China—does not exempt you from cross-border obligations. As long as data is actually transmitted to overseas servers (even if only processed in memory or logged briefly), it counts as cross-border transfer; encrypting data or tokenizing it does not equal "anonymization." The larger the volume of data transferred, the stricter the requirements—from the basic "informing users + separate consent," to signing standard contracts, obtaining certification, and up to the highest level of security assessment filing. The thresholds escalate step by step.

Multi-Level Protection Scheme (MLPS): Once a system is classified as Level 2 or above, you must also complete the MLPS assessment separately. This is another hard requirement for data security compliance and is easily overlooked by business teams during project scheduling.

Unclear Data Retention and Responsibility Boundaries: When calling overseas models, how user data is retained on overseas servers, how long it is kept, and whether it will be used for third-party model training often lack contractual constraints and audit capabilities. In the event of a data breach or regulatory inquiry, it is difficult to prove that you have fulfilled your security obligations.

2. Dual Filing Entry Barriers—Overseas Models Struggle to Meet Them

Domestic generative AI services are subject to dual compliance requirements: "large model filing + algorithm filing." The problem is that overseas vendors like OpenAI and Anthropic do not currently list mainland China as an officially supported region, nor have they established mature channels for submitting training data and security assessment materials to domestic regulators.

This means: if you directly call overseas model APIs and package them into products for external service, you are likely to get stuck at the filing step—not because the process is slow, but because there is simply no viable path to complete it.

There are precedents: Apple's App Store once removed a large batch of "ChatGPT-like" applications in one go; some regional Cyberspace Administration offices have directly summoned domestic platforms that called OpenAI APIs.

3. Content Labeling and Intellectual Property Risks

Starting September 1, 2025, the Measures for Labeling AI-Generated Synthetic Content officially took effect, requiring AI-generated content to have both explicit labels (watermarks, text prompts so users can immediately see it's AI-generated) and implicit labels (markers hidden in file metadata). This is now a mandatory requirement, not a "recommendation." In the second half of this year, multiple apps have been directly removed or penalized for failing to label content or conduct security assessments.

At the same time, copyright issues in training data and output content cannot be ignored: First, if training/fine-tuning corpora include content copyrighted by others, it may constitute infringement (internationally, The New York Times v. OpenAI and Thomson Reuters v. Ross Intelligence are such cases). Second, overseas model service providers' terms of service typically include geographic restrictions and clauses prohibiting the use of output results to train competing models; in September 2025, Anthropic expanded its restrictions to entities with more than 50% Chinese capital. Third, whether generated content itself constitutes a "work" and who owns the copyright is still being explored in domestic judicial practice (the Beijing Internet Court's 2023 "AI text-to-image" case leaned toward recognizing that if users demonstrate original expression during generation, the output may be considered a work protected by copyright law).

4. Evasion Tactics and Overlapping Compliance Obligations

Some companies attempt to bypass overseas vendors' regional restrictions using VPNs, offshore shell companies, or cloud service relays. However, this approach has two major risks: first, service providers may directly ban accounts or suspend services, causing sudden business disruption; second, domestic regulations already impose administrative oversight on "illegally establishing or leasing international networking channels," so evasion often results in bearing risks on both sides.

AI technology is developing rapidly, and the regulatory framework is being refined in parallel—gradually shifting from "regulating models" to "regulating functions and scenarios." For companies, rather than waiting until after a product launches to face regulatory interviews or removal, it is better to lay out this "risk map" at the project initiation stage and examine it carefully.