You're right on this point. But there are ways to build interfaces that sidestep this.

Run a sanitized VDI with no local storage --> offshore independent entity (e.g. a Hong Kong Company) that holds the AI service contract and API license --> GLM-Legal.

Somebody ought to set this up for pro se work.