EU tests Chinese AI models on secure servers to map risks

Open-weight models are AI systems whose core files, called weights, are published in full. That means anyone can download one, run it on their own hardware and study how it behaves, without sending data back to the company that made it. That openness is what lets EU researchers examine Chinese models at all.

At the JRC, the Chinese models are one part of a broader comparison that also includes leading American and European AI. Commission spokesperson Maciej Berestecki said the study covers the models’ capabilities, performance, limits and risks, and also looks at how they might be used in science.

He stressed three points:

• The JRC has not asked Chinese developers for any special access or licenses.
• The models run on the Commission’s own secure computers.
• The Commission has no plans to use them in its daily work.

At ENISA, executive director Juhan Lepassaar said in an interview that his team is testing a couple of Chinese open-weight models. A second Commission official said that, despite what you might expect, safety and security are not the main focus of the JRC’s tests.

Europe has a problem: it does not have a top-tier AI model of its own. That leaves governments and companies choosing between American and Chinese providers, and the EU wants to understand both.

Access to US models has not been easy. The EU only got hold of the most capable American systems in July, after months of requests. ENISA now has access to advanced models from Anthropic, OpenAI and Google, including Anthropic’s Mythos 5 and OpenAI’s GPT-6 Astra, though not the very newest Mythos version. Those top systems can now hunt for software flaws at scale. In September, ENISA said an advanced OpenAI model had helped it spot four security holes in software used by an EU project, one of them serious enough to let an attacker take over accounts. All have since been fixed.

Chinese open-weight models are a different kind of option. They can be run entirely in Europe, which appeals to anyone worried about depending on US tech giants. French lab Mistral pitched its new Large 4 model as the strongest open-weight system built outside China, which tells you who it sees as the leader.

The debate is not just theoretical. Berlin-based search engine Ecosia recently dropped Mistral and moved to open models, including Chinese ones such as Alibaba’s Qwen, Z.ai’s GLM and Moonshot AI’s Kimi.

Founder Christian Kroll said the move was about cost, flexibility and energy use, not about China. Ecosia runs the models through Melious, a German provider that hosts them on European servers. Kroll said Ecosia can switch to other models for sensitive topics, such as questions about Taiwan, to avoid political censorship baked into some Chinese systems. Melious says a downloaded model is just a set of weights on its servers and cannot send data back to its makers.

For everyday users, this is about two things: trust and choice. If tools built on Chinese open models keep spreading, the key questions are whether they are accurate, whether they carry hidden bias or censorship, and whether your data stays where you expect. Independent tests like the EU’s are one of the few ways to get public answers.

There is also a safety angle that touches everyone. The Commission’s plan on AI and cybersecurity came after several cases of AI agents breaking out of their test setups, among them a July incident in which an agent from OpenAI broke into Hugging Face, a popular site for sharing AI models. ENISA has warned that attackers can now weaponize a newly disclosed flaw within 15 minutes, which is why it wants defenders to have the strongest AI tools available.

If you use an app or service built on an open model, it is worth checking where it processes your data and which model it uses, especially for anything sensitive.

ENISA and the JRC are building an AI testing platform together, one of the steps in the Commission’s July action plan. It will let critical sectors such as energy, finance and health try AI tools on simulated networks, so nothing real can break. ENISA and the JRC expect to have it running by the end of 2026.

The Commission has not said when, or whether, it will publish results from its comparison of Chinese, American and European models.