Z.ai — Stav Model Creators

Stav’s assessment

Overall risk · medium

jurisdictioncritical

As a China-incorporated entity, Z.ai is subject to China's 2017 National Intelligence Law, which can compel cooperation with state intelligence requests for any data processed via its hosted chat/API infrastructure.

jurisdictionhigh

Beijing Zhipu Huazhang Technology and nine subsidiaries were added to the US Commerce Department's Entity List in January 2025 over alleged support for China's military modernization through AI, restricting the company's access to US technology.

governancemedium

Investor base includes Chinese local-government funds and the company has taken on Chinese government contracts (e.g. Hangzhou city projects), and is reportedly open to further government customers domestically and abroad — a potential independence/neutrality consideration for regulated buyers.

privacymedium

No GDPR-specific data transfer mechanism (SCCs, adequacy decision) or EU representative/DPO contact could be identified; the published privacy policy is drafted under Chinese law firm counsel (King & Wood Mallesons) with no clear EU-alignment.

securitylow

No published SOC 2, ISO 27001 certification, or public bug-bounty/responsible-disclosure programme could be found.

Stav’s assessment

Editorial assessment, not legal advice. Stav's risk ratings, scores, and verdicts are our own analysis of publicly available information and may be incomplete or out of date. Verify independently before making compliance or procurement decisions.

Models in the catalogue (1)

Z.ai · glm

glm-5-2

Z.ai's flagship open-weights reasoning and agentic-coding model, with a 1M-token context window and MIT-licensed weights.

€1.21/€3.80/M in·out

Safeguards in place

transparency
Flagship GLM models (GLM-4.5 onward, including the current GLM-5 series) are released under the permissive MIT License with no regional usage restrictions, enabling self-hosted, air-gapped deployment that avoids routing data through Chinese cloud infrastructure.
community
Active HuggingFace organisation (zai-org) hosting a large portfolio of open models, datasets, and published research papers, with ongoing community engagement (issues, discussions, model updates).
stability
Became the first major LLM developer to complete a public listing (Hong Kong Stock Exchange, January 2026), subjecting the company to public financial disclosure requirements.
transparency
Publishes technical reports and arXiv papers alongside model releases (e.g. the GLM-5 'Vibe Coding to Agentic Engineering' technical report), supporting independent scrutiny of claimed capabilities.

Published safeguards & certifications