Price stopped being the argument against Chinese models, and accountability became it.

A Chinese model now sits three index points off the measured frontier at 2.8 times lower cost per completed task. The comfortable reasons to decline it have gone. What remains is a governance ledger that reads very differently, and a sovereignty argument that does not survive contact with Europe's compute position.

A model review that ends on price is now finished before it starts. For two years the comfortable answer to a Chinese open-weight model was that it was behind, and the comfortable answer to the frontier was that quality costs money. On independent measurement as of 24 October 2026, neither answer survives.

The uncomfortable part is not that a cheap model got good. It is that the cheap model is cheaper than its list price suggests, which removes the last reason a committee could decline it without having the harder conversation.

Once price and capability stop deciding, the only question left is who is accountable when something goes wrong. That question has an answer, and it is not flattering to either option.

What the measurement says

Kimi K3.1 Pro was released on 23 October 2026 and scores 55 on the Artificial Analysis Intelligence Index, fourth of 215 models. Claude Opus 5.5 leads that index at 58. Three points. [1] [2]

The longer view agrees on the direction. Epoch AI measures the Chinese lag behind the US frontier at seven months on average since 2023, in a range of four to fourteen months. That is a schedule, not a generation. [3]

The cost inversion

List prices differ twofold: $2.00 and $10.00 per million input and output tokens against $4.00 and $20.00. Most reviews stop there and assume the real gap is smaller once the cheaper model's reasoning overhead is counted. On this index the opposite holds. The frontier model emits 260 million output tokens running the benchmark suite; the challenger emits 150 million, against a median of 87 million across the field. The frontier model is the more verbose of the two.

Per completed task the spread is 2.8 times, wider than the twofold difference in sticker price. Read that carefully before quoting it: it is measured on a benchmark suite, not on your workload, and verbosity on a reasoning index is not verbosity on document extraction or on a long agentic run. The direction is nonetheless the opposite of the one most business cases assume. [1] [2]

The practical consequence for a 2027 inference budget is that the saving is real and the finance conversation is legitimate. Which is precisely why the decision has to be taken somewhere other than finance.

Measured, alleged, and absent

Three categories of evidence get mixed together in this debate, and keeping them apart is most of the work.

Measured. The US Center for AI Standards and Innovation evaluated three DeepSeek models against four US models across nineteen benchmarks. Agents built on one of them followed malicious instructions that derailed them from the user's task about twelve times more often than US frontier models. Under a common jailbreak that model answered 94 percent of overtly malicious requests, against 8 percent for the US reference set. It repeated inaccurate or misleading state narratives roughly four times as often. [4]

Alleged. Weight-level backdoors in Chinese open models are widely discussed and, in the public record reviewed here, not demonstrated. That matters in both directions. It is not grounds for a ban, and it is not grounds for comfort either, because the honest position is that nobody can currently prove a third-party model is clean.

Absent. There is no published independent safety, censorship or security evaluation of any model from this particular laboratory. There is also no public German, French or Italian language benchmark for either model in this comparison. For a Swiss or European institution whose actual workload is trilingual, that second gap is the one that should stop a procurement paper, and it stops it for both options equally.

Who answers the letter

On 30 January 2025 the Italian data protection authority ordered an urgent limitation on the processing of Italian users' data by the two DeepSeek entities. The companies replied that they do not operate in Italy and that European legislation does not apply to them. The Authority rejected that position and called the companies' communication entirely insufficient. [6]

That exchange is the whole third-country question in miniature. It is not about residency. It is about whether there is a counterparty.

FINMA Guidance 08/2024 has required Swiss supervised institutions, since December 2024, to identify, assess, manage and monitor their AI risks. It names model risks including robustness, correctness, explainability and bias, and it names growing dependence on third parties as a risk category of its own. Those duties sit with the institution. They are not delegable to a laboratory that does not answer letters. [7]

The European Commission's published signatory list for the General-Purpose AI Code of Practice carries twenty-eight companies plus xAI. No China-based developer appears on it. State that precisely: it is absence from a published list, which is weaker than a recorded refusal, and the list is updated as signatures are confirmed. It is still the single clearest governance asymmetry available to a buyer today. [5]

Which produces the reframe that usually decides these reviews before a benchmark is opened. For an open-weight model the counterparty is whoever hosts the weights, not whoever trained them. So the comparison is not one model against another. It is a hostable artefact with no vendor behind it, against a vendor with a contract. Both are legitimate choices. They are not the same kind of choice.

Sovereignty is a compute question

Open weights are often offered as the sovereign answer. The arithmetic does not support it. Bruegel puts EU operational AI compute at about 2 GW, close to 5 percent of the global total, against roughly 35 GW and 78 percent for the United States and about 5 GW and 11 percent for China. The same brief notes that Amazon, Microsoft and Google together hold about 70 percent of the European cloud market, and that the five planned AI gigafactories would add only about 4 percent of EU capacity in 2031. [8]

Bruegel's own conclusion is the one worth taking to a board: locating compute in the EU is a precondition for sovereignty, not a sufficient condition, because access to a model can still be cut off. Open weights change the shape of the dependency rather than removing it. The weights become portable. The accelerators, the data centre and the operator do not. [8]

So the sovereignty gain from preferring Chinese weights over a US API is smaller than the word implies, while the governance cost is concrete. Anyone selling the swap as a sovereignty win is selling a label.

Switzerland, and your board

Swiss institutions face a narrower and more honest version of the question. Swiss hosting exists. Swiss frontier-scale compute largely does not. That makes the decision a portfolio question rather than a vendor question, and it has three defensible answers depending on what the workload carries.

The question a board can actually answer is not which model is best. It is which workloads it could not afford to have switched off, and who it would call if they were.

Auron prices that work into the model decision at mandate shaping, so the comparison that reaches a risk committee already names the accountable entity, the audit path, the routing boundary and the exit route for each option. That is what shortens an approval. Another evaluation round does not.

Which of your workloads is currently running on a model nobody in your firm could name a counterparty for, and would you know before the regulator asked? I would genuinely like to know.