Why Businesses Are Betting on Chinese AI Despite the Warnings

Here's a number that should make every CFO sit up. A customer service chatbot handling, say, 200,000 conversations a month — a realistic month for a mid-sized bank or telco, not a hypothetical — generates somewhere in the region of 100 million output tokens. At Claude Opus 4.8's list price, that output alone costs roughly $2,500 a month. The identical output volume through DeepSeek V4 Flash costs around $28. That's before input tokens, caching discounts, or infrastructure costs are factored in — but on output alone, it's a roughly ninety-fold difference. That's not the kind of gap a business absorbs quietly — it's the kind that gets a line item questioned in the next budget review.

A word on how that bill actually gets built, because the pricing has two halves that most people conflate. Every AI model charges separately for what you send it and what it sends back. Take a customer typing "My order #48213 hasn't arrived, can you check?" into a support chatbot — that question is the input, and it's cheap to process because the model reads it all in one pass. The chatbot's reply — "I've checked your order, it's at the regional hub, expected in 2 days, and here's what happens if it's late" — is the output, and it's the expensive half, because generating a response requires the model to produce it sequentially, one piece at a time, rather than reading it all at once. That's why output tokens are almost always priced several times higher than input tokens: on Claude Opus 4.8 it's $5 for a million tokens in versus $25 for a million tokens out. For a chatbot, the bill is really a function of how long-winded the answers are, not how long the questions were.

That gap is why Chinese open-weight models — DeepSeek, Alibaba's Qwen, Moonshot's Kimi, Zhipu's GLM — have gone from a curiosity to a significant share of usage on model marketplaces such as OpenRouter (a platform that routes API calls across different AI providers), with US developers and companies increasingly among the adopters, drawn by the price and the openness. The exact market-share number varies by source and definition — API requests, tokens and revenue all tell slightly different stories — but the direction is not in dispute. This has stopped being a China story. It's a procurement story. And it's worth a quick translation of the terms, since they get thrown around loosely: an "open-weight" model means the company publishes the actual trained model file, and anyone can download it and run it on their own infrastructure rather than paying a provider for every API call. An "API model" means you send your questions over the internet to the company's own servers, they run the model for you, and you get charged per use. Same underlying technology, completely different question of whose infrastructure processes your data — and what happens to it afterwards.

Because the pitch is genuinely compelling. Cheaper training methods let Chinese labs build frontier-class models for a fraction of what US labs spend, and that saving shows up directly in the price per query. And because many of these models are released as open weights, a business doesn't have to send its data to Beijing to use them — it can download the file and run it entirely on its own AWS account or its own servers in Singapore.

That last sentence is doing a lot of work, so it's worth slowing down on. The concern that has led governments and public-sector organisations in countries including the US and Australia to restrict or scrutinise DeepSeek on official devices isn't really about the model's intelligence — it's about where a query physically goes when you use the free app or the standard API. Data sent to DeepSeek's own hosted service sits on servers in China, and Chinese national security and data laws give the authorities significant powers to require companies to cooperate with state security and intelligence activities. Security researchers have also reported infrastructure concerns, including code found in DeepSeek's web platform that referenced China Mobile, a state-owned carrier, and a 2025 database exposure that left more than a million records — including chat logs and API keys — publicly accessible before it was secured.

Self-hosting the open-weight version can eliminate the specific risk of prompts going to the provider's own hosted service — provided the deployment is genuinely isolated, with no external telemetry, logging, or plugins quietly phoning home. What it does not fix is anything baked into the model itself: independent testing has found some of these models more likely to refuse, redirect, or soften answers on topics that are politically sensitive in China, which matters if you're relying on one for anything where a confident, unfiltered answer is the whole point, whether that's a legal question or an internal risk memo. Downloading the file solves the plumbing problem. It doesn't solve the personality problem.

That's the calculation businesses across the region seem to be making already: use the cheap, self-hosted, open-weight models for the bulk, low-stakes work — code generation, first-draft writing, internal search — and keep anything touching customer data or regulated processes on a provider whose data handling can actually be checked, whether that's hosted in Singapore, the EU, or the US. Cost isn't the only variable in that tiering decision either — the cheapest model still has to be good enough at the task, so it's worth testing accuracy and reliability before assuming "low-stakes" automatically means "any model will do."

For Singapore specifically, this arrives amid an increasingly active AI governance environment. The PDPC has proposed advisory guidelines on the use of personal data in generative AI, MAS continues to set expectations around AI model risk management for financial institutions, and IMDA's Model AI Governance Framework for Agentic AI guides organisations deploying more autonomous systems. Taken together, they point toward a practical question every business will eventually have to answer: not which flag the model flies, but whether you can demonstrate you understood the data, the technology, and the risks involved — and made a deliberate, defensible choice. A cheap model nobody thought to check is not a bargain. It's a liability with excellent unit economics.

Pricing figures above are per Anthropic's and DeepSeek's official API pricing pages as of July 2026: Claude Opus 4.8 at $5/$25 per million input/output tokens, DeepSeek V4 Flash at $0.14/$0.28. Token pricing changes frequently across all providers, so treat these as a snapshot rather than a permanent gap.

What to do about it

For businesses: This doesn't need to live in your annual report or be disclosed anywhere public — it's an internal control, not a marketing claim, and most companies genuinely don't have this written down yet. The realistic first step is smaller than "map your data flows": get IT or whoever owns your AI tools to write a one-page list of every AI tool currently in use across the company (including the free ones staff signed up for themselves), whether it's an API call to someone else's server or something running on your own infrastructure, and what kind of data goes through each one. That list gives you something concrete to show if auditors, your risk team, or a regulator ever ask how AI is being used and where sensitive data is going. Once it exists, the tiering decision — cheap model for low-stakes work, vetted model for anything sensitive — becomes obvious rather than theoretical.

For individuals: If you're using a free Chinese AI app for personal or work tasks, assume anything you type may sit on a server outside Singapore's jurisdiction, governed by a different country's laws. Fine for asking it to summarise a news article. Not fine for pasting in a client contract or your company's financials. The canary here isn't the model's country of origin — it's whether you actually know where your input goes after you hit send.