Per current documentation, GLM-5.1 is released under a verbatim MIT License with no use restrictions, enabling self-hosted commercial deployment. However, training-data opacity, Beijing-based publisher, and Zhipu AI's presence on the US BIS Entity List create EU AI Act transparency and supply-chain screening risks for regulated deployers.
Sovereignty
Licence: MITCommercial: UnrestrictedTraining data: UndisclosedOrigin: China (Beijing)
No GDPR Art. 27 EU representative found and no published DPA — downstream EU controllers bear higher due-diligence burden for any vendor-hosted interaction.
Training-data opacity: no dataset summary, copyright provenance, or TDM opt-out mechanism published; secondary reporting cites ~28.5T tokens but sources are unverified against an official training-content summary (EU AI Act Art. 53(1)(c)-(d) gap).
Zhipu AI entities on the US BIS Entity List (January 2025) — EU deployers in dual-use, defence, or critical-infrastructure sectors should screen for secondary-sanctions and reputational exposure.