How do Chinese companies sell tokens abroad?

A European research institution submits a question online and, seconds later, receives an English answer from a model developed by a Chinese company. The computation could take place in China, Singapore, or Europe. The Chinese model developer, the company running the servers, the contracting supplier, the people with access to the data, and the business collecting the payment may all be different.

To the researcher using the service, these arrangements may look much the same. To anyone assessing China's AI industry or deciding whether to buy from a Chinese supplier, the differences matter.

That is the starting point for understanding how Chinese companies “sell tokens abroad”: they make AI capabilities available to customers outside China, through arrangements that need to be examined separately. For public authorities, universities, and research institutions studying or purchasing these services, the central question is: which company provides what, from where, to whom, and with what responsibilities?

I. What is a token?

In a large language model, a token is a unit used to process text. Depending on the tokenisation method, it may be a word, part of a word, a character, or another fragment. Different models can divide the same sentence into different numbers of tokens. The term has nothing to do with blockchain tokens in this context.[1]

Many model services charge for the tokens in a customer's input and the model's output. In this article, “selling tokens abroad” is shorthand for Chinese companies selling model inference—the computation that produces an answer—to customers outside China. Other offerings are priced by GPU hours, dedicated clusters, software licences, project fees, or subscriptions. These are different products and business models, even when they support the same AI application.

One technical distinction matters for buyers: turning text into token IDs does not automatically anonymise it. LLM tokenisation prepares text for model processing and decoding; it is not a privacy or security measure. Names, medical histories, or interview records may still identify people after tokenisation. China's Personal Information Protection Law distinguishes de-identification from anonymisation. What matters is whether people can still be identified and whether the transformation can be reversed, rather than whether the data remains readable as ordinary text.[1][2]

For compliance purposes, calling the transmitted material “text”, “vectors”, or “tokens” does not settle the question. Buyers and suppliers need to understand what information it contains and what the recipient can do with it.

II. Three ways Chinese companies serve foreign markets

The first is to run the computation in China and sell the service to customers elsewhere. A customer outside China sends a request through an application programming interface, or API. Servers in China run the model and return the result. The transaction involves a service supplied from China and data moving in both directions; no server or model weights necessarily leave China.

The second is to operate computing infrastructure outside China and serve customers from those facilities. A Chinese company or its affiliate may build, lease, or operate a facility with a local partner. Equipment sourcing, local operating requirements, power and connectivity, data processing, and access by other group companies all become relevant. A facility in Singapore or Europe may improve service delivery, but its location alone does not resolve restrictions on chip supplies, remote access, or procurement requirements in the host market.

The third is to supply a Chinese-developed model for another organisation to run. A cloud provider, university, or business outside China obtains model weights or software and deploys them itself. Weights are the parameters learned during training; access to them does not include the training data or an unrestricted right to use the model. This arrangement can expand adoption of a Chinese model while generating computing revenue for a non-Chinese cloud provider. Whether the Chinese developer earns a licence or service fee depends on the contract.

These are three distinct activities: supplying services from China, operating infrastructure abroad, and distributing models for others to deploy. Use of a Chinese-developed model, computation supplied by a Chinese company, and revenue earned by a Chinese company must be measured separately. Requests from foreign users do not translate directly into China's service-export earnings. Formal trade and balance-of-payments classifications depend on the parties, their residency, the nature of the payment, and the applicable statistical rules.

III. Follow the customer's data through a single request

Suppose a university buys a Chinese company's model service advertised as running outside China. It uploads a draft paper, the model calls a literature-search tool, the platform keeps operational logs, and a support team in another country later investigates an error. The single request has created several data flows: manuscript text, search material, account information, logs, and support access.

The university's data map should identify where the request enters the service, where inference happens, where data and backups are stored, who has remote access, whether information enters human review or model training, and how it is deleted.

Alibaba Cloud's Model Studio documentation illustrates why these distinctions matter. It distinguishes the Region, which determines the access point and storage location, from the service deployment scope, which determines where inference runs. For Frankfurt, the documentation lists both Global and EU scopes. A buyer therefore needs to check the actual configuration: choosing a European Region does not, on its own, establish that all computation stays in Europe.[3]

For an institution subject to EU data-protection law, the assessment of a transfer of personal data to a third country also depends on who receives the data, how access is provided, and the legal relationship between the parties. Access by a Chinese parent company or a separate support provider deserves specific scrutiny. The server's address is only one part of the assessment; a login from another country does not have the same legal significance in every organisational arrangement.[4]

China's rules make a specific allowance for some processing of foreign data. Under Article 4 of the Provisions on Facilitating and Regulating Cross-Border Data Flows, personal information collected and generated outside China may be sent into China for processing and then provided to a recipient outside China without using three Chinese data-export procedures: a security assessment, a standard contract, or personal-information protection certification. The condition is that no personal information or important data from within China is introduced during processing.[5]

For a foreign customer, the scope of that allowance is crucial. It concerns three Chinese outbound-transfer procedures, rather than a general exemption from privacy law. It does not remove other applicable personal-information protection duties or satisfy the customer's obligations at home. An EU institution sending personal data to China must still address the EU data-protection requirements that apply to that transfer and processing.

IV. Three responsibilities beyond data protection

First, responsibility for content and uses of the service. A data-centre operator, a model API supplier, a model developer, and the operator of a consumer chatbot exercise different kinds of control over the product, its data, and its users. A Chinese supplier selling an API to a foreign business still needs to understand its downstream use: a business customer may incorporate the service into recruitment, lending, education, or healthcare software, changing the rules that need to be considered.

China's Interim Measures for the Management of Generative Artificial Intelligence Services focus on services offered to the public within China. They also distinguish research and application activities that do not provide those services to that public. This territorial scope matters when assessing a Chinese supplier: an internal research experiment and a publicly available product require separate analysis. An activity falling outside these Measures may still be subject to data-protection, intellectual-property, and other laws.[6]

For services offered in the EU, the relevant roles include the provider of a general-purpose AI model, the provider of an AI system, and the organisation deploying it. Where the model-provider obligations apply, a Chinese supplier's cloud-service contract cannot stand in for the required copyright policy, training-content summary, or documentation for downstream providers. Equally, a company renting out GPUs should not automatically be treated as the model developer.[7]

Second, intellectual-property rights and responsibilities. Being able to download a model does not give the buyer the same rights over its weights, code, training material, uploaded documents, and outputs. An openly available paper is not automatically free for unrestricted copying, training, or commercial reuse; subscription databases can add contractual limits. A research team should establish separately what rights it needs for literature searches, model training, publication, and commercial collaboration.[8]

Licences also need to be checked against the version actually used. DeepSeek-R1's official repository sets out licence information for its code and weights and identifies the upstream models and licences behind its distilled variants. A description such as “available for commercial use” is a starting point for review, not a clearance of every derivative model or third-party right.[9]

Third, restrictions affecting equipment and data security. A Chinese company's ability to obtain or receive advanced chips is a separate question from its ability to sell an AI service to a particular customer. Guidance from the US Bureau of Industry and Security (BIS) shows that licensing requirements for advanced-computing items can depend on an entity's headquarters or ultimate parent, even when the entity itself is located elsewhere. The equipment and transaction still need to be assessed under the applicable rules. Separately, the US Data Security Program restricts specified dealings involving particular data and persons. Operating a data centre outside China does not settle either issue; neither framework justifies a blanket claim that every Chinese model service is prohibited for US customers.[10][11]

V. Two research scenarios, different compliance questions

The following hypothetical examples illustrate the issues; they do not determine whether a particular project is compliant.

Scenario A: a university outside China runs a Chinese open-weight model on its own cluster, using publicly available materials cleared for the intended internal research. If inference, logs, and administrative access genuinely remain local, the model's Chinese origin alone does not show that prompts are being sent to China. The university should still check the licence, software dependencies, updates and telemetry, remote support, and how the research results will subsequently be used.

Scenario B: a joint research team sends identifiable participant interviews or health records to an API service operating across several countries. The legal basis for processing, applicable notice and consent requirements, ethics review, purpose limits, international data transfers, and possible use for further training may all become central. A supplier's promise not to train on customer data leaves other questions unanswered: where inference happens, how long records are kept, who can access them, and whether the system calls other tools.

If the same system later contributes to decisions about public funding, admissions, employment, or healthcare that significantly affect individuals, the institution should reassess which rules apply. Calling the original project “academic research” does not create a general exemption for subsequent public services or operational decisions.

VI. Four records for public authorities and research institutions

The following are practical recommendations for industry research, project management, and procurement. They are not an additional statutory filing requirement.

First, map the business and where the money goes. Identify who owns the facilities, develops the model, runs inference, serves the end user, signs the contract, and receives payment. Record customers outside China, actual inference volume, attributable revenue, continuity of service, and local partnerships separately. Comparisons of token prices should hold the model version, language, input/output mix, quality requirements, and service commitments constant. Otherwise, an apparently simple price comparison may compare different products.

Second, map the data and who can access it. Record where research materials, personal information, logs, and backups are held, along with access by staff, group companies, and subcontractors. For confidential information or data subject to disclosure restrictions, establish whether it can lawfully enter the service before weighing cost or convenience.

Third, document rights and allocate responsibilities. Record the permissions for training and research materials, the model-licence version, rights in research outputs, and conditions for publication and reuse. Specify who handles individuals' data-protection requests, content complaints, security incidents, and intellectual-property disputes.

Fourth, keep evidence of how the service is delivered. Preserve regional settings, evidence of actual routing and access, version histories, evaluation methods, and arrangements for deletion and exit. Where a use depends on timeliness or accuracy, or supports public decisions, identify who reviews the results and how errors are corrected.

These records give regulators, procurement teams, research administrators, and technical staff a common set of project facts. Certifications, contracts, and standards can contribute useful evidence, provided their scope, verifier, and period of validity are clear. A certification alone cannot establish that the entire service and its intended use comply with every applicable requirement.

VII. International cooperation should make evidence easier to verify

Chinese companies selling AI services abroad encounter different languages, legal requirements, and review practices in their customers' markets. Cooperation between China and those markets can help clarify data-processing terms, improve model documentation, align evaluation methods, and support incident reporting and regulatory training.

The joint ASEAN–EU guide to model contractual clauses offers an example of what this kind of cooperation can achieve. It explains the relationship between two contractual tools and can help organisations coordinate their terms. Using one set of clauses does not automatically meet all the requirements of the other jurisdiction.[12]

Public authorities and academic institutions can contribute by developing transparent, reproducible evaluations, comparable descriptions of service delivery, and research into how different international data-transfer mechanisms fit together. Regulatory and technical teams can then examine the same evidence. Pilot projects still need to operate within existing law and their actual authorisations; participation in a cooperation initiative does not itself create an exemption.

Conclusion: turning a request into a dependable service

Chinese companies sell tokens abroad by connecting their models and computing capacity to customers outside China. Whether they can sustain that business depends on a service chain that buyers and regulators can understand and verify: who supplies the capability, where data goes, which rights support its use, what the results are used for, and who answers when something goes wrong.

For researchers assessing China's AI business abroad, models and data centres are only part of the picture. Revenue attribution, the supplier's ability to operate the service, and delivery conditions in the customer's market also matter. Examining them together makes it possible to distinguish use of a Chinese model from a durable commercial relationship with a Chinese supplier.

Sources and references

This general compliance explainer is written for public authorities, universities, and research institutions outside China. It draws on the research dossier on Chinese AI infrastructure suppliers in overseas markets. The principal citations were rechecked on 25 September 2026. Its recommendations and hypothetical examples are analytical, not regulatory findings or substitutes for project-specific legal, ethics, or procurement review.

1. Hugging Face: Tokenization algorithms. Explains text tokenisation; it should not be used to infer anonymisation.
2. Personal Information Protection Law of the People’s Republic of China, including Articles 4 and 73.
3. Alibaba Cloud Model Studio: Regions and endpoints. A vendor’s dynamic product document; it shows the public configuration description, not an independent compliance certification.
4. EDPB: Guidelines 05/2021. Explains the relationship between GDPR territorial scope and third-country transfers.
5. Provisions on Facilitating and Regulating Cross-Border Data Flows, Article 4.
6. Interim Measures for the Management of Generative Artificial Intelligence Services, Article 2.
7. European Commission: Questions and answers on the guidelines for obligations for providers of general-purpose AI models. Application still depends on the model, role, and relevant transitional arrangements.
8. WIPO: Generative AI—Navigating intellectual property. A guide to intellectual-property issues in organisational adoption of generative AI.
9. Official DeepSeek-R1 repository: licence and distilled-model information. The deployed version must be checked in each case.
10. US BIS: guidance on advanced computing, 31 May 2026. The specific equipment and transaction must still be checked against current rules and licensing requirements.
11. US Department of Justice: Data Security Program. A framework for specified data, persons, and transactions.
12. ASEAN–EU Joint Guide on Model Contractual Clauses. A comparison of contractual tools, not mutual legal recognition or a general market-access licence.