Z.ai

Z.ai (Beijing Zhipu Huazhang Technology and all subsidiaries) was added to the US Department of Commerce Bureau of Industry and Security Entity List on 16 January 2025, formally designated as advancing the People's Republic of China's military modernisation through AI development under Section 744.11 of the EAR. This is a formal US government national-security determination.

Extensive Chinese state and municipal government investment (multiple state funds are confirmed investors). Company leadership reportedly engages regularly with senior CCP officials and participates in setting China's national AI technical standards. A Chinese government project contract was secured in May 2025.

As a China-incorporated company, Z.ai is subject to China's National Security Law, Data Security Law, and PIPL — all of which can compel access to data and models by Chinese authorities without European judicial oversight or notification to data subjects. This is structurally analogous to CLOUD Act exposure but under PRC jurisdiction.

In May 2025, a Chinese public-security-affiliated centre flagged Zhipu's consumer app for collecting user data beyond what users had authorised — a formal data protection violation finding under Chinese law. No GDPR privacy policy, DPA, DPO contact, or EU data transfer mechanism has been identified.

No EU AI Act compliance statement, GPAI technical documentation meeting Article 53 requirements, or participation in the EU AI Office GPAI Code of Practice has been identified. GPAI obligations have been applicable since August 2025. GLM-5 and GLM-5.1 are frontier-scale models likely in scope.

No Western security certifications (SOC 2, ISO 27001), bug bounty programme, or responsible disclosure policy found. No published security practices for the inference API or model supply chain.

Z.ai experienced a compute shortage and significant share price decline in late February 2026, temporarily restricting new user signups. While the company has since recovered operationally, this episode highlights infrastructure capacity risk at a critical growth phase.

EU enterprises with US parent companies, US-dollar supply chains, or other US nexuses may face re-export control compliance obligations when using Z.ai models or the hosted API, given the company's Entity List designation.