Loading the catalogue…
Loading the catalogue…
Qwen is not a standalone company but Alibaba Cloud's model brand, developed by the Tongyi/Alibaba Token Hub unit and governed entirely by Alibaba Group. Smaller and mid-size models are released under Apache 2.0 with a large derivative ecosystem, but flagship models are proprietary and served only via Alibaba's own cloud. EU enterprise customers should note China's data and national-security laws apply to the hosted service, Alibaba has not signed the EU GPAI Code of Practice, and Alibaba was recently added to a US Department of Defense list of Chinese military-linked companies — all relevant to sovereignty and reputational risk assessments, even though CLOUD Act/FISA exposure does not apply.
Qwen's hosted services and parent company are subject to Chinese jurisdiction, including generative-AI content-filing and cybersecurity/data laws; the privacy policy allows disclosure to Chinese government/law-enforcement agencies.
Alibaba (Qwen's parent) was added to the US DoD's 1260H list of entities identified as Chinese military companies in June 2026, prompting retaliatory Chinese export-control measures against US firms.
Alibaba/Qwen is not a signatory of the EU GPAI Code of Practice; China-based providers are a noted general exception among signatories.
Independent security researchers found Qwen models vulnerable to prompt-injection/jailbreak attacks capable of producing harmful content (malware, phishing), comparable to issues found in DeepSeek models.
The principal technical lead behind Qwen's development, Junyang Lin, departed Alibaba in March 2026, shortly after a major internal AI reorganisation.
Stav’s assessment
Editorial assessment, not legal advice. Stav's risk ratings, scores, and verdicts are our own analysis of publicly available information and may be incomplete or out of date. Verify independently before making compliance or procurement decisions.
Alibaba Cloud publishes a dedicated training-data disclosure statement describing data curation and labelling methodology for Qwen and Wan models.
Alibaba Cloud's Data Processing Addendum incorporates the EU Standard Contractual Clauses and a UK Addendum, and the company holds ISO 27001/27017/27018 and German C5 certifications covering EU-relevant locations.
The Qwen privacy policy names a specific Data Protection Officer and contact address for data-subject queries.
Qwen's open-weight releases (Apache 2.0 for models up to ~32–35B) have generated one of the largest derivative-model ecosystems on Hugging Face.
Alibaba released Qwen3Guard, a dedicated safety-classification model, in September 2025 as part of its broader Responsible AI framework.
Published safeguards & certifications