Overall risk · medium
governancemedium
InternLM is produced by a Chinese state-backed research institute rather than a private commercial entity, meaning strategic direction and disclosure practices may be shaped by government priorities rather than commercial/regulatory incentives familiar to EU enterprises.
compliancemedium
No evidence the organisation has signed the EU GPAI Code of Practice; major Chinese AI labs generally have not signed it, leaving compliance demonstration to alternative (unverified) means.
privacymedium
No discoverable privacy policy, DPA, or DPO contact on the creator's official domain, making GDPR posture unverifiable.
jurisdictionmedium
As a China-domiciled state-affiliated entity, data and models are subject to China's national intelligence and cybersecurity laws rather than CLOUD Act/FISA — a different but non-trivial sovereignty concern for EU regulated customers.
securitylow
No published security certifications (SOC 2/ISO 27001), bug bounty, or disclosure policy could be found for the organisation.
Stav’s assessment
Editorial assessment, not legal advice. Stav's risk ratings, scores, and verdicts are our own analysis of publicly available information and may be incomplete or out of date. Verify independently before making compliance or procurement decisions.