Loading the catalogue…
Loading the catalogue…
ByteDance is a privately-held, Beijing-headquartered technology group whose in-house Seed team develops both proprietary (Doubao, Seed) and openly-licensed (Seed-OSS, Seed-Coder, Seed-X) AI models. For EU regulated customers, the standout concern is not the models themselves but the parent group's data-governance track record: its subsidiary TikTok was fined €530M by Ireland's DPC in 2025 for unlawfully transferring EEA user data to China and for providing inaccurate information during the inquiry, and ByteDance does not appear on the EU AI Act's GPAI Code of Practice signatory list. Open-weight Seed models carry permissive licences and reasonable technical documentation, but the group's China-jurisdiction ties and unresolved US divestment/national-security saga add jurisdictional complexity worth factoring into any deployment decision.
Ireland's DPC fined TikTok (ByteDance group) €530M in 2025 for unlawful EEA-to-China data transfers and inaccurate information given during the regulatory inquiry, including a later admission that EEA data had in fact been stored on Chinese servers.
The DPC found that Chinese laws (Anti-Terrorism Law, Counter-Espionage Law, Cybersecurity Law, National Intelligence Law) preclude a finding of data-protection equivalence with the EU, directly relevant to any ByteDance group entity processing EU data from China.
ByteDance does not appear on the EU AI Act GPAI Code of Practice signatory list, alongside other Chinese AI developers, meaning it has not committed to the Commission's streamlined compliance pathway.
US DOJ referred to ByteDance's founder as a CCP 'mouthpiece' in 2020, and a Chinese state-backed fund holds a small equity/board stake in a domestic ByteDance subsidiary — relevant to concerns about government influence.
ByteDance's Seedance video model was publicly denounced by the US Motion Picture Association for large-scale copyright infringement, indicating potential Copyright-chapter compliance gaps under the AI Act.
Reports indicate ByteDance lacked a formal corporate document retention policy for years, with internal staff flagging possible FTC Act and GDPR compliance risk.
Stav’s assessment
Editorial assessment, not legal advice. Stav's risk ratings, scores, and verdicts are our own analysis of publicly available information and may be incomplete or out of date. Verify independently before making compliance or procurement decisions.
ByteDance's Seed team publishes several open-weight model families (Seed-OSS-36B, Seed-Coder, Seed-X, BAGEL) under permissive Apache-2.0/MIT licences with published benchmarks and technical detail on HuggingFace/GitHub.
ByteDance operates an active bug bounty and coordinated vulnerability disclosure programme, and has demonstrated fast incident response (remediating a reported GitHub Actions supply-chain issue within an hour).
Seed-OSS-36B was well received in the open-source AI community for its 512K context window and state-of-the-art open-source benchmark results, positioning ByteDance as a credible open-weights contributor.
Published safeguards & certifications