Chinese frontier models: where GLM and rivals stand

For Chinese models the story this week is not the news flow but the standings. Between October 12 and 15 none of the big Chinese labs shipped a new flagship. Not DeepSeek, not Qwen, not Kimi, not GLM, not MiniMax. That makes it a good moment to take stock.

The short version: the best Chinese models ship open weights, are very cheap, and trail the strongest US models by roughly 12 points on independent evaluations.

Dates: what did not launch this week

Two models were described as fresh this week, but neither is new. The GLM-5.3-Flash Hugging Face repo has existed since August 25, and The New Stack covered it on August 26. StepFun's Step 5 Preview repo has been live since September 20. This week only brought updates, such as new quantized variants.

The genuinely new item is smaller: OpenBMB's MiniCPM-V 4.7 in 35B-A3B and 1B sizes under Apache 2.0. The repo was created on October 7; the press release followed on October 15.

Zhipu GLM: the most interesting Chinese story

Zhipu (branded Z.ai internationally) built GLM-5.3-Flash as a 320B-parameter MoE with 18B active per token. Per the model card, it is the first natively multimodal model in the GLM-5 series and is MIT-licensed.

The architecture is the point. Z.ai's blog says it mixes linear and sparse attention and, compared with GLM-5.3, uses 3x less attention compute and a 4.4x smaller KV cache. These are the vendor's own figures.

Price is the so-what. Per Z.ai's official pricing, GLM-5.3-Flash costs $0.15 per million input tokens and $0.50 per million output. The larger GLM-5.3 costs $1.40 and $4.40. Z.ai claims Flash beats GLM-5.2 at a tenth of the price.

Z.ai's own results: GLM-5.3-Flash on six coding and agentic benchmarks against GLM-5.2, DeepSeek-V4-Vision-Exp, Claude Opus 4.8, GPT-5.6 Terra and Gemini 3.7 Flash. Vendor-reported figures. Source: Z.ai, Hugging Face

Read the chart carefully. Z.ai compares against older US models (Opus 4.8, GPT-5.6), not today's leaders. The blog also claims a score of 57 on the Artificial Analysis Intelligence Index v4.1.1. AA's current v4.3.2 open-weights table shows 42. The two numbers refer to different index versions and are not comparable.

Chips and export controls

Z.ai says it serves GLM-5.3-Flash on a cluster of Chinese AI chips, at per-token cost comparable to mainstream NVIDIA GPUs. That is a vendor claim. The chipmaker is not named and there is no independent measurement.

Tech Times quotes a Counterpoint analyst who believes the cluster likely includes Huawei Ascend parts. Note the distinction: this is inference, not training. The backdrop is US export controls that keep the most capable NVIDIA chips out of China, so Chinese labs compensate with efficient architectures and domestic hardware.

The other labs in brief

• DeepSeek V4.1 Flash: MIT, 552B/16B active, 39 on AA. Fast and cheap, not top tier.
• Qwen: the strongest, Qwen3.8 Max (45), is not listed among open-weights models on AA. The open Qwen3.8 27B scores 34 under Apache 2.0.
• Kimi K3 (Moonshot): 2.8T parameters, 104B active, custom licence, 44.
• MiniMax-M3: custom licence, 29, now behind the pack.
• Step 5 Preview (StepFun): 600B/27B active, 1M context, custom licence, FP8 and BF16 weights on Hugging Face.
• MiniCPM-V 4.7: small Apache 2.0 multimodal model sized to run on a phone.

How big is the gap?

On the Artificial Analysis leaderboard (v4.3.2, as of October 15), Claude Opus 5.5 at max effort scores 58, GPT-6 Astra and Gemini 4 Argon 53. The best Chinese model is Xiaomi's MiMo-V2.6-Pro at 46, followed by Qwen3.8 Max and GLM-5.3 at 45.

So the gap at the top is about 12 points. On price the picture flips: GLM-5.3-Flash charges $0.50 per million output tokens. For many business tasks that matters more than 12 points.

Open weights are the strategic weapon. The top of AA's open-weights table is almost entirely Chinese. The best non-Chinese entry is Meta's Muse Spark Open at 39.

Using these models from the EU under GDPR

For a university or company the practical question is how to use these models without personal data leaving the EU. There are three routes.

1. Self-hosting. Download the open weights from the official Hugging Face pages and run them in an EU data center. The data never reaches the model maker. Read the licence: GLM-5.3-Flash and DeepSeek are MIT, Qwen 27B is Apache 2.0, while GLM-5.3, Kimi K3, MiniMax-M3 and Step 5 Preview use custom licences.

2. EU-hosted APIs. Alibaba Cloud Model Studio's Frankfurt region offers an EU deployment scope where inference stays in the region. The Global scope may use any node, including mainland China. Alibaba's own docs say DeepSeek there is only available in the Beijing region.

Scaleway, a French provider, offers glm-5.3, deepseek-v4.1-flash and qwen3.8-27b priced in euros. IONOS lists Qwen models, and OVHcloud lists open-weight models, though we could not verify the exact Chinese model names there.

The hyperscalers are mixed. Amazon Bedrock offers older versions (GLM 4.7, Kimi K2.5, DeepSeek V3.2, Qwen3 Coder Next), and with EU geo routing data stays in the EU. Google Vertex lists GLM 5, Kimi K2 Thinking and Qwen3, but its docs say processing regionalization may vary by model. Microsoft Foundry's Fireworks catalog lists GLM-5.3-Flash and Kimi K3; we could not verify EU-region availability.

3. The maker's own API. This carries the highest risk. DeepSeek's privacy policy states that personal data is collected, processed and stored in the People's Republic of China, and its terms are governed by PRC law. There is no EU adequacy decision for China, so sending personal data there is a serious GDPR risk.

Z.ai's policy says data is generally processed in Singapore, the API comes with an embedded DPA, and API content is processed in real time without being stored. We found no EU data residency, sub-processor list or named SCCs. We did not verify where the Kimi, MiniMax or StepFun APIs process data; that is unknown.

Comparison by model

• GLM-5.3-Flash | licence: MIT | weights: huggingface.co/zai-org/GLM-5.3-Flash | official EU option: self-host; listed in Foundry catalog, region unverified | own API: Singapore | GDPR: clean when self-hosted
• GLM-5.3 | licence: custom | weights: huggingface.co/zai-org/GLM-5.3 | EU option: Scaleway | own API: Singapore | GDPR: Scaleway or self-host
• DeepSeek V4.1 Flash | licence: MIT | weights: huggingface.co/deepseek-ai/DeepSeek-V4.1-Flash | EU option: Scaleway | own API: China | GDPR: no personal data to the own API
• Qwen3.8 27B | licence: Apache 2.0 | weights: huggingface.co/Qwen | EU option: Alibaba Frankfurt (EU scope), Scaleway, IONOS | own API: depends on region | GDPR: choose EU scope
• Kimi K3 | licence: custom | weights: huggingface.co/moonshotai/Kimi-K3 | EU option: unverified | own API: unverified | GDPR: self-host
• MiniMax-M3 | licence: custom | weights: huggingface.co/MiniMaxAI/MiniMax-M3 | EU option: unverified | own API: unverified | GDPR: self-host
• Step 5 Preview | licence: custom | weights: huggingface.co/stepfun-ai/Step-5-Preview | EU option: none found | own API: unverified | GDPR: self-host
• MiniCPM-V 4.7 | licence: Apache 2.0 | weights: huggingface.co/openbmb | EU option: run locally | own API: n/a | GDPR: simplest on-device

The list reflects the cited official pages as of October 15. Provider catalogs change fast; verify before signing.

EU AI Act: what applies to you

The AI Act's GPAI rules have applied since August 2, 2025. Per the Commission's guidelines, obligations fall mainly on the model provider: technical documentation, information for downstream users, a copyright policy and a training-data summary.

Open-source models get a partial exemption if the licence allows free use, modification and distribution. The copyright and training-summary duties still apply. If you fine-tune a model, you become a provider only after a significant modification, indicatively above one third of the original training compute.

As a deployer, your duties sit at the system level: transparency when people interact with AI, and the relevant rules for high-risk uses. Data protection is still GDPR: a DPIA, a processing agreement, and transfer safeguards.

What to do now

If you want a cheap, strong model and handle personal data, the order is simple. Start with self-hosting or an EU provider (Scaleway, Alibaba Frankfurt EU scope, Bedrock EU). Use a Chinese maker's own API only for non-personal data.

Right now GLM-5.3-Flash is the best value in the open field. For the hardest tasks US models still lead. The next question is who breaks the quiet first: DeepSeek, Qwen or Kimi.