Chinese AI models are cheaper. What that means for a 200-person firm
DeepSeek and Qwen undercut US AI models on price, and Airbnb drew a House inquiry for using one. For a mid-sized firm the saving is small; the risk is not.
| DeepSeek list price | its Flash model costs $0.30 per million input tokens and $1.20 per million output tokens at peak hours, half that off-peak (DeepSeek pricing page, September 2026) |
|---|---|
| Anthropic list price for comparison | Claude Haiku 4.5 costs $1 per million input tokens and $5 per million output tokens (Anthropic pricing page, September 2026) |
| Worked example | 10,000 documents a month at 2,000 tokens in and 500 out costs about $12 on DeepSeek Flash at peak and $45 on Claude Haiku 4.5; our arithmetic from the two list prices |
| Where DeepSeek's own app keeps data | in the People's Republic of China, and user input may be used to train its models unless the user opts out (DeepSeek privacy policy, updated 10 February 2026) |
| Political scrutiny | on 29 April 2026 two House committees wrote to Airbnb about its use of Alibaba's Qwen in customer service, asking which Chinese models it runs, where, and whether it tested them first |
| Safety testing | NIST's Center for AI Standards and Innovation found DeepSeek R1-0528 answered 94% of overtly malicious requests under common jailbreaks, against 8% for US reference models (30 September 2025) |
| Hosting outside China | Amazon Bedrock offers Qwen3 and DeepSeek models as managed services in US, European and Asian AWS regions |
Chinese open models such as DeepSeek and Alibaba's Qwen now list at a fraction of US prices: DeepSeek's Flash model costs $0.30 per million input tokens at peak, against $1 for Anthropic's cheapest current Claude. At the volumes a 200-person company actually runs, that gap is worth tens of dollars a month. The data question that comes with it is worth a great deal more.
The verdict: do not switch AI suppliers to save money on model prices, and do not let staff put company information into DeepSeek's own app. If a software vendor already runs one of these models underneath a feature you use, you need to know where it is hosted, and that is a question you can ask this week.
What is actually happening
US technology companies have been moving work to the cheaper models this year. Lindy, a San Francisco automation start-up, said in June it had moved from Anthropic to DeepSeek, reached through an American provider, and that the switch would save it millions. Airbnb's chief executive, Brian Chesky, said in October 2025 that the company relied on Qwen because it was fast and cheap; the House letter that followed ties that use to Airbnb's customer service.
That second remark brought a letter. On 29 April 2026 the House Homeland Security Committee and the House Select Committee on the Chinese Communist Party wrote to Airbnb, and separately to Anysphere, the maker of the Cursor coding tool, asking for every Chinese model in use, what it is used for, whether it runs on the company's own servers or someone else's, and whether it was security-tested before it went live. Chesky later said, as reported by Bloomberg, that Airbnb was not sending any data to the model developers.
Is the saving worth it at our size?
Rarely. Take a back office that runs 10,000 documents a month through an AI model, each around 2,000 tokens of input and 500 of output. A token is roughly three-quarters of a word, so that is a few pages per document. On DeepSeek Flash at peak rates that costs about $12 a month. On Claude Haiku 4.5 it costs about $45. The difference is smaller than one team lunch. Lindy saves millions because it runs millions of requests; you do not.
The discount that matters to a software company with a million users is a rounding error on a 200-person firm's AI bill.
Price per token is also not the whole cost. When NIST's AI standards centre tested DeepSeek models in September 2025, it found that one US reference model cost 35% less on average than the best DeepSeek model across its tests. The figures have moved since, but the lesson holds: test on your own work before trusting a price list.
Where the real risk sits
There are two very different ways to use these models, and most of the argument confuses them.
The first is DeepSeek's own chat app and website. Its privacy policy says it collects, processes and stores personal data in China, and that what users type can be used to train its models unless they opt out. For company information that is a clear no, for the same reason you would not email a customer file to an unknown overseas address.
The second is the same model weights run by someone else. Amazon Bedrock, for example, offers Qwen3 and DeepSeek models in US and European regions, run inside AWS's own infrastructure. There the data question is the ordinary one of whether you trust the host. What remains is the model's own behaviour: NIST found DeepSeek R1-0528 answered 94% of overtly malicious requests under common jailbreak techniques, against 8% for the US models it tested. For a tool that only reads invoices that may not matter. For an agent that can send emails or change records, it does.
What it does not mean
It does not mean every Chinese-built model is spyware, and it does not mean US models are safe by default. It does not mean you must audit your whole software stack this month. And a House letter to Airbnb is a request for information, not a ban.
It does mean that if you sell to US federal agencies, defence primes or critical infrastructure, a customer may soon ask which AI models sit inside your processes, and "we do not know" will be a poor answer.
What to do this week
Add one line to your staff AI rule: no company information goes into DeepSeek's app or any AI tool whose data is held in China. Then send your three main software vendors a short email asking which AI model powers each AI feature you use, and in which country it runs. Keep the replies on file. If a large customer or an auditor ever asks, that folder is your answer, and it cost you an afternoon.