The race for artificial intelligence is intensifying, with new players emerging at an unprecedented pace. DeepSeek, a Chinese AI startup, quickly made a name for itself with its R1 model. It delivers performance that rivals OpenAI's GPT-4o, at a fraction of the development cost. Meanwhile, Alibaba has entered the race with Qwen 2.5 and claims it outperforms both DeepSeek and OpenAI's offerings.

The rapid success of DeepSeek has, however, raised ethical concerns. Critics argue that the company's ability to develop powerful models with limited resources may rely on using OpenAI's research and outputs rather than fully original progress. This raises serious questions about intellectual property rights, fair competition, and the integrity of AI development.

At the same time, the pace of AI innovation is outstripping the regulatory safeguards, particularly when it comes to data protection, transparency, and user privacy. While DeepSeek and Alibaba push the boundaries of AI efficiency, it remains unclear how these models handle and secure data.

While these developments reshape the AI industry, one key question remains:

What does this mean for data protection and data security?

DeepSeek vs. Alibaba: The Disruptors Shaking Up AI

For years, AI development was dominated by US companies like OpenAI, Google, and Microsoft, which poured billions into training large-scale AI models on cutting-edge hardware. In Europe, companies like Mistral and Aleph Alpha are trying to get a foot in the door.

Then came DeepSeek.

  • DeepSeek's R1 model achieves performance comparable to GPT-4o, but at a fraction of the cost.
  • The model was trained using older Nvidia chips, showing that efficiency can keep pace with sheer computing power.
  • Within days, DeepSeek-R1 became the #1 AI app in the US, overtaking ChatGPT in the Apple App Store rankings.

In response, Alibaba launched Qwen 2.5, positioning it as a superior alternative to DeepSeek and OpenAI. Meanwhile, other Chinese tech companies, including ByteDance, Tencent, and Baidu, are racing to launch their own advanced AI models.

This shift marks a transition from a US-dominated AI landscape to a fiercely competitive global market — but it brings an urgent challenge along with it: ensuring responsible AI development and protecting user data.

The Privacy Dilemma: Who Controls Your Information?

The rapid rollout of AI models raises critical questions about data collection, security, and regulatory compliance. AI models require enormous amounts of data to train effectively, and the lack of transparency around data sourcing has become a major problem.

1. Training data: where does it come from?

AI models are trained on massive datasets, but in many cases it's unclear whether the data was legally obtained or used with proper consent.

  • Some AI companies collect publicly available data without users' explicit consent.
  • Copyright concerns have already led to lawsuits against OpenAI and Google, and similar scrutiny could follow for DeepSeek and Alibaba.
  • In China, AI models are subject to different data protection rules than in the EU or US, raising questions about their compliance with international data protection laws.

2. Security risks in AI development

As AI systems become more sophisticated, they process and store increasingly sensitive user data, making them prime targets for cyberattacks.

  • If security protocols are weak, AI-generated insights and stored data could become accessible to malicious actors.
  • There's only limited information available on how DeepSeek and Alibaba handle user inputs, data storage, and encryption.
  • Without clear governance, companies using these models could unknowingly expose themselves to compliance risks.

3. Do these AI models comply with global regulations?

The European Union has introduced the AI Act, which will impose stricter requirements on AI transparency, data protection, and accountability. AI models developed outside the EU — such as those from DeepSeek and Alibaba — may not meet these standards, however.

  • The GDPR requires explicit consent for the use of personal data, but it's unclear whether AI models from China follow these guidelines.
  • Companies using non-compliant AI tools could face fines, litigation, and reputational damage.
  • Regulators in the US and Europe are still working to establish clear oversight rules for training and deploying AI models.

Without strict data protection regulations and compliance measures, AI innovation could lead to significant legal and ethical challenges.

Related article: Understanding and Implementing Data Protection Basics

How Companies Can Protect Themselves in the Age of AI

As AI technology continues to advance, companies must ensure that the tools they use comply with evolving regulations, especially the EU AI Act.

Key considerations for companies using AI:

  • Transparency: work with AI vendors that disclose how their models handle data and comply with regulations.
  • EU AI Act compliance: identify AI risk categories, document usage, and ensure AI systems meet legal and ethical standards.
  • Proactive AI governance: prepare for upcoming regulatory enforcement by implementing structured compliance roadmaps and continuous monitoring.

"As AI accelerates, compliance can no longer be an afterthought. The EU AI Act sets clear and binding expectations. But with the right tools, many companies find that AI compliance can be achieved within a week!"

 

Philip Heider
Compliance and Technology Specialist, heyData

How heyData Supports AI Compliance Under the EU AI Act

heyData offers companies a structured, automated compliance solution that helps them meet the requirements of the EU AI Act. Rather than directly mitigating AI security risks, AI Comply ensures that companies using or offering AI systems stay compliant with evolving regulations.

How AI Comply helps companies:

  • AI risk assessment and compliance roadmap – classify AI systems, identify obligations, and build a tailored roadmap.
  • Legally compliant documentation – automate AI documentation to align with EU AI Act requirements.
  • Training and continuous monitoring – train teams on responsible AI use and keep them informed of the latest compliance updates.
  • AI trust and transparency – build credibility with an AI trust seal for responsible AI use.

Conclusion: AI Growth Must Go Hand in Hand with Responsible Data Protection

The rise of DeepSeek, Alibaba, and other AI disruptors is reshaping the global technology landscape. These models don't just challenge the dominance of US AI companies — they also push the boundaries of efficiency and accessibility.

Yet AI's rapid development must go hand in hand with responsible data governance. Companies that integrate AI tools without considering the data protection risks must expect significant consequences.

Key takeaways:

  • AI keeps getting more powerful, but transparency remains a problem.
  • Global compliance standards must be enforced to prevent data misuse.
  • Companies must deploy AI responsibly while ensuring security and regulatory compliance.

The future of AI depends not only on technological breakthroughs, but also on ethical and regulatory safeguards. As the AI industry continues to expand, the winners won't just be those with the most advanced models — they'll also be those who put trust, transparency, and data security first.