"It Manages 339 Trillion Won in National Assets"... Turns Out, the AI Employees Use Is Chinese [China Shock, K-Industry on the Brink | AI] (2)

80.2% cite data leaks as a concern over the use of Chinese AI
SW supply chain security risk emerges as a threat

Editor's NoteChinese artificial intelligence (AI) technology is threatening South Korea's industrial ecosystem and national security. Backed by vast capital and infrastructure, Chinese companies are making inroads from the tech industry to the public and financial sectors, using value for money and open-source technology as their weapons. The risk is no longer limited to the simple adoption of foreign technology: software (SW) supply chain security threats are becoming a reality, with data control and national sovereignty potentially slipping overseas from the design stage. This series examines the technological incursion of Chinese AI and explores survival strategies for South Korea's AI industry, including securing an "independent AI foundation model" to protect national data sovereignty.

Warning signs are flashing that the AI ecosystem at South Korean public and financial institutions and IT companies is being infiltrated by Chinese technology with little resistance. Beyond security vulnerabilities in the technology itself, the "software (SW) supply chain security risk" of data control potentially slipping overseas from the design stage is emerging as a national threat.

At a recent parliamentary audit by the National Assembly's Strategy and Finance Committee, the security complacency of the Korea Investment Corporation (KIC), a sovereign wealth fund managing approximately 339 trillion won in national assets, came under scrutiny. Documents obtained by Rep. Kang Min-kuk of the People Power Party showed that all the key components of the AI assistant KIC introduced for all its employees were made in China.

The language model used to handle tasks including summarizing and translating documents, preparing weekly reports, and searching for materials related to lawmakers' inquiries was Alibaba's Chinese model Qwen3. The embedding model used to search internal materials was BGE-M3, developed by the Beijing Academy of Artificial Intelligence (BAAI). BAAI has already been placed on the U.S. Department of Commerce's export control list over allegations that it supported the modernization of the Chinese military.

Dependence on Chinese technology has also surfaced in a government-led national project. Naver Cloud was eliminated from the project to build an "Independent AI Foundation Model," which the Ministry of Science and ICT is pursuing to secure technological sovereignty. Naver Cloud was penalized after it emerged that, contrary to the project's purpose, the company had indirectly used Qwen's weights and other components.

The problem is that the model selection process considers only performance and value for money, without basic security verification criteria such as the developer's country of origin or whether it is subject to sanctions. This creates a situation in which security concerns, such as the overseas transfer of personal information, are inevitable. In fact, it emerged in April 2025 that Chinese AI company DeepSeek had transferred South Korean users' personal information overseas without proper notice or consent. The company was subsequently urged by the Personal Information Protection Commission to take corrective and remedial measures.

In a report, Rockbridge Network Korea said that data leaks were companies' biggest concern about using Chinese AI models, accounting for the largest share at 80.2%. Lack of transparency in the handling of personal information followed at 67.7%. The use of Chinese products was not readily apparent on the surface. In a survey of 102 small and medium-sized businesses, none said they were using Chinese services for work. But when specific models were listed, five said they were using them.

Major economies around the world are reviewing their supply chains as a whole and moving to strengthen regulations. The U.S. Department of Homeland Security reportedly ordered the complete removal of Chinese company DeepSeek's technology from federal civilian agencies' IT systems on October 19 (local time). The scope of regulation was expanded to require the tracking and complete blocking of third-party services and software that use U.S. cloud services such as Microsoft or Amazon Web Services (AWS), or that indirectly incorporate DeepSeek models. The Japanese government also recently introduced a certification system for the security of data centers and cloud services, effectively excluding Chinese products.

South Korean industry voices are calling for the government to provide safety guidelines on the use of AI models. Their position is that, because costs are reduced to one-tenth of those incurred when using U.S. frontier models, companies have little choice but to use Chinese models if they consider only value for money. They have also repeatedly stressed the importance of the Independent AI Foundation Model project. Some, however, say the government may be reluctant to intervene given the competing interests of different countries.

Professor Lee Sang-geun of Korea University's Graduate School of Information Security said, "Code generation is essential for things like weapons development and website creation, and vulnerabilities could arise in this process when Chinese models are used. "The government needs a strategy that both establishes an Independent AI Foundation Model and supports companies and institutions in building their own competitiveness," he said.

This content was produced with the assistance of AI translation services.