Overall risk · medium
jurisdictionhigh
As a PRC-incorporated entity, 01.AI remains subject to China's National Intelligence Law, Cybersecurity Law, and Data Security Law, which can compel cooperation with Chinese state authorities — a structural, non-waivable sovereignty risk distinct from but comparable to CLOUD Act exposure.
governancemedium
01.AI has pivoted from foundation-model development to selling enterprise decision-AI products and 'Sovereign AI' government infrastructure, including a June 2026 joint venture with the Government of Kazakhstan to build national AI capability and integrate government data systems — raising governance and neutrality questions given the company's own PRC incorporation and state-access obligations.
compliancemedium
No EU AI Act compliance statement, Article 53 GPAI transparency documentation, or GPAI Code of Practice engagement was found; the current website contains no EU-facing regulatory content at all.
privacymedium
No GDPR-facing privacy policy, Data Processing Agreement, or DPO contact could be located on 01.AI's official domain; a candidate privacy-policy URL simply serves the homepage.
governancemedium
The Yi model series, 01.AI's only open-weights product line usable by EU customers, now appears entirely absent from the company's own marketing and product pages, raising doubt about continued maintenance, security patching, or further releases.
securitylow
No published security certifications (SOC 2, ISO 27001), bug bounty programme, or vulnerability disclosure policy were found for 01.AI.
Stav’s assessment
Editorial assessment, not legal advice. Stav's risk ratings, scores, and verdicts are our own analysis of publicly available information and may be incomplete or out of date. Verify independently before making compliance or procurement decisions.