Overall risk · medium
jurisdictionmedium
As a PRC-incorporated company, MiniMax is subject to China's Cybersecurity Law, Data Security Law, and PIPL, which include data localisation and government access provisions for national security purposes; China has no EU adequacy decision, so cross-border transfers require SCCs or equivalent safeguards.
governancemedium
Active US copyright infringement lawsuit (Disney, Universal, Warner Bros. Discovery) alleging MiniMax's Hailuo AI service was trained on and generates unauthorized copyrighted characters; MiniMax's motion to dismiss was denied in May 2026 and the case is proceeding to discovery.
governancemedium
Anthropic publicly accused MiniMax of running a fraudulent-account campaign to harvest over 16 million Claude interactions for model distillation (February 2026), raising questions about MiniMax's data-sourcing practices and potential downstream model quality/safety concerns.
compliancemedium
Newer 'open-weight' model licences (e.g. M2.7/minimax-community) restrict commercial/enterprise use and require direct permission from MiniMax, creating licence-compliance uncertainty for enterprise deployments despite being marketed as open weights.
compliancelow
No published EU AI Act compliance statement, GPAI training-data summary, or Code of Practice engagement was found for MiniMax, despite EU AI Act GPAI transparency obligations beginning to bite in 2026.
Stav’s assessment
Editorial assessment, not legal advice. Stav's risk ratings, scores, and verdicts are our own analysis of publicly available information and may be incomplete or out of date. Verify independently before making compliance or procurement decisions.