---
title: "China AI export controls: Beijing will license the weights, not the API"
description: "China AI export controls, Oct 16 draft: frontier model weights need a licence to leave China. API, app and SaaS access stay out. Comments close Nov 15."
canonical_url: https://www.oguzhan.co/china-ai-export-controls-model-weights/
author: "Oğuzhan Koçaklı"
author_url: https://www.oguzhan.co/about/
date_published: 2026-10-17T08:06:28+00:00
date_modified: 2026-10-17T08:06:46+00:00
language: en
translations:
  tr: https://www.oguzhan.co/tr/cin-yapay-zeka-ihracat-kontrolu-model-agirliklari/
---

# China AI export controls: Beijing will license the weights, not the API

## What Beijing published on October 16

On October 16, 2026, China’s Ministry of Commerce (MOFCOM) and Ministry of Science and Technology published Announcement No. 48, a draft revision of the Catalogue of Technologies Prohibited or Restricted from Export. It is the first time China AI export controls get their own headings with hard numbers. The core idea fits in one line: the licence attaches to the model file. Weights, checkpoints, source code and architecture of a large model that crosses any one of three lines (10^26 FLOPs of training compute, 2 trillion parameters, or a global top-10 rank at the time of export) would need permission to leave China. Selling access through an API, app, website, SaaS or a lightweight on-device version would not count as an export. Comments are open until November 15, 2026, by email, fax or letter.

So this is a draft, not law. One part is already running, though: an interim pre-export registration that started the same day.

I read the announcement, the full annex and the spokesperson’s Q&A. I tested nothing and talked to no one, so where I interpret, I say so.

## What is actually on the list?

According to the [announcement](https://www.mofcom.gov.cn/zcfb/blgg/gg/2026/art/2026/art_05e2643a8ca04eb9adf9dd0542991fe4.html), the draft covers 40 technologies across three fields. Twenty-three are AI: large models, agents, compute clusters and information processing. The [spokesperson’s Q&A](https://www.mofcom.gov.cn/xwfb/xwfyrth/art/2026/art_d7661dbf62794345a221404f82a25959.html) splits the whole draft into 14 proposed prohibitions and 26 proposed restrictions, and [CTOL](https://www.ctol.digital/news/china-draft-technology-export-catalogue-ai-model-weights-chip-design/) counts the AI share as 6 prohibited and 17 restricted. The rest is biomedicine (5) and photovoltaics (12). Anything already public through open source or academic papers is out of scope.

The AI items, as the annex sorts them:

- **Prohibited:** AI-driven malicious code generation and mutation aimed at critical infrastructure, defense or core government systems (266402J). Large models trained on China’s “core data” and offered as a service (266501J). High-performance agents built specifically or mainly for those same sensitive settings (266502J). A deepfake detection item tied to cross-border data security, at 95% accuracy and recall (266401J).
- **Restricted:** frontier model core technology plus models trained on “important data” (266504X), agent technologies (266505X), AI-assisted vulnerability discovery (266404X), AI chip design (266506X) and compute clusters (266507X). Older entries also gain deepfake detection, steganography, voiceprint and translation items.

[Frontier Now](https://frontiernow.dev/en/news/china-ai-export-catalog-draft/) makes a fair point here: AI gets its own headings for the first time, and the thresholds are written so a company can measure itself against them. So the paperwork question now lands on engineers as well as lawyers.

## How China AI export controls define a frontier model

![Three gauges for training compute, parameter count and leaderboard rank, each with a needle past one threshold line](https://oguzhanco.s3.eu-west-3.amazonaws.com/wp-content/uploads/2026/10/17080625/frontier-model-three-thresholds-compute-parameters-rank.webp)

*Any one line is enough: 10^26 FLOPs of training compute, 2 trillion parameters, or a global top-10 rank at the time of export.*

Item 266504X restricts the core technology of a large model that meets any one of three tests:

- Training compute of at least 10^26 floating-point operations.
- At least 2 trillion parameters (the annex writes it as 20,000亿).
- Capability at a “globally leading level”, which a footnote defines as a top-10 global rank, at the time of export, in public evaluations by mainstream Chinese or foreign evaluators or large industry platforms. The ranking can be on overall performance, a specific business capability, global call volume, safety, training efficiency and so on.

“Core technology” means weight parameters, key checkpoints, underlying source code and architecture design, plus training-optimization and inference-acceleration techniques.

The first two lines are physical. You trained it, you know the numbers. The third is the strange one. It is measured at the moment of export, so by my reading a model can drift into scope when it climbs a leaderboard and drift out again when someone else ships. And “global call volume” is on the list. A model that is neither huge nor smart, just very popular, could qualify. The “and so on” at the end leaves the list of rankings open, and exporters judge for themselves whether they are covered. That is a lot of discretion parked on the company’s side.

There is also a data trigger that ignores all three lines. A large model trained on China’s “important data” and offered as a service is restricted under 266504X. Trained on “core data”, it is prohibited under 266501J. Both terms come from the Data Security Law, and as Frontier Now notes, this announcement defines neither. There is a narrow exemption for important data: a trace of 0.1% or less that cannot substantively lift the model’s core R&D capability in that domain, desensitized and never reproduced in outputs, or data that is legally public anyway.

## Weights need a licence, APIs don’t: what counts as an export

![Schematic of a border where API, app and cloud service lines cross freely but a crate of model files waits at a licence gate](https://oguzhanco.s3.eu-west-3.amazonaws.com/wp-content/uploads/2026/10/17080626/model-weights-vs-api-access-export-line.webp)

*MOFCOM’s line: API calls, apps, SaaS and light on-device versions are not exports. Moving the model itself abroad is.*

The Q&A turns scope into a transfer question: does restricted technology move from inside China to somewhere outside it? MOFCOM’s spokesperson spells out the cases:

- Deploying a restricted model locally abroad, on a customer’s own servers, is a technology export.
- Running it on the Chinese company’s own overseas cloud is eligible for automatic licensing.
- API calls, app or web interaction, SaaS and lightweight on-device deployment are not large-model technology exports.

Automatic licensing, which the ministry says basically achieves “report and ship” (即报即出), also covers open-sourcing restricted AI technology, Chinese firms running their own compute centers abroad, chip tape-out abroad, joint R&D with foreign resources and international standards work. Members of the World AI Cooperation Organization are promised extra facilitation.

Here is why I think the line sits where it does. An API sells the output and keeps the asset at home. The money comes in and the weights never cross the border. On-prem deployment abroad hands the asset over. Beijing is drawing the export line in the same place a cautious company would draw its own IP line. That keeps Chinese labs competitive as cloud vendors while giving the state a say over the one thing that cannot be taken back once shipped.

The interim registration is the part with teeth today. From October 16 until the revised catalogue takes effect, exporters must register on ecomp.mofcom.gov.cn before transferring ownership abroad (an IP assignment, for example), licensing domestic technology for use abroad, or letting a foreign entity become owner or actual controller. Exports already under way are included. Products made with the controlled technology are not. MOFCOM insists that once the rules apply, “the vast majority of AI technologies can still be exported freely.”

Dean W. Ball, whom [The Decoder](https://the-decoder.com/china-plans-to-tighten-export-controls-on-open-weight-models-and-23-key-ai-technologies/) describes as head of strategic futures at OpenAI, put it well: “This move does not mean ‘China is shutting down open-weight models,’ but it does indicate the Chinese government establishing the optionality to shut down future open-weight models at will.” It is the most accurate sentence I’ve read on this draft. Automatic licensing still runs through a registration step, and whoever controls that step can slow it down.

## Agents, malware and bug hunters get their own numbers

Item 266505X lists four agent technologies, each with its own bar:

- Autonomous planning: 20 or more executable sub-tasks from one natural-language instruction, at least 80% decomposition accuracy, at least 90% average sub-task success.
- Multi-agent collaboration: 60 or more concurrent agents, no more than twice the single-agent minimum time, at least 85% agreement with the standard answer.
- Tool calling: 200 or more third-party tools, at least 90% selection accuracy and 90% end-to-end success on tasks needing three or more tools.
- Game decision-making, all conditions required: 20-step planning depth or 10 concurrent agents, decisions within 200 milliseconds, beating 90% of humans on standard benchmarks, among others.

The annex numbers these as separate technologies, the same way 266504X separates its data item from its frontier-model item. My reading is that each one stands on its own. The draft does not say so in plain words, and comments may clarify it.

The 60-agent line caught my eye. Anthropic’s [Claude Managed Agents](https://www.oguzhan.co/claude-managed-agents-dynamic-workflows/) already allows 64 concurrent threads in one run. That does not mean a similar Chinese product is restricted. The annex also asks for the speed and accuracy conditions, and the catalogue only binds exports of Chinese technology. Still, the bar sits right next to what commercial agent platforms ship today. My guess is the drafters were looking at current products. If an agent that clears these bars is built specifically or mainly for critical infrastructure, defense or core government use, it moves to the prohibited column under 266502J.

Malware is the cleanest prohibition. Item 266402J covers AI-driven malicious code generation and mutation that could hit critical infrastructure, defense or core government systems, if any of these hold: at least 60% attack success against multi-engine detectors, 85% against a single mainstream antivirus, or 90% against machine learning models. Adaptive evasion (sandbox detection and escape, rewriting at least 50% of the code per run) and bulk variant generation sit next to it. MOFCOM’s stated aim is to keep AI “safe and controllable” and “ensure AI always remains under human control”. The threat is not abstract. [CLOSEDQUORUM](https://www.oguzhan.co/closedquorum-malware-llm-c2-quorum/) already had four commercial LLMs voting on an intrusion’s next step.

AI-assisted vulnerability discovery (266404X) is restricted, not banned. Triggers include 50% end-to-end exploit-chain success against a mainstream OS or browser, ten times a senior expert’s efficiency, or autonomously finding five or more undisclosed high-severity flaws in one major project in one go. Google took a different route with [Gemini 4 Argon](https://www.oguzhan.co/gemini-4-argon-cyber-defenders-first/), giving defenders access first. Beijing is choosing where the capability may travel. Google chose who gets it first.

Hardware gets lines too: chip design at 14 nm or finer or with 2.5D or 3D packaging, and clusters of more than 10,000 accelerator cards with 800 GB/s interconnect or fault recovery within 120 seconds.

## Is this a copy of the US rule?

Partly. Both use 10^26. The objects are different.

|  | US AI Diffusion Rule | China draft (Announcement 48) |
| --- | --- | --- |
| Published | Jan 15, 2025 (BIS interim final rule) | Oct 16, 2026 (draft, comments until Nov 15) |
| Compute line | weights of closed models above 10^26 operations | 10^26 FLOPs, or 2T parameters, or global top 10 |
| Open weights | closed-weight models only | already public: out of scope. New open-sourcing: automatic licensing |
| What it targets | weights of the most advanced models plus advanced chips | model core tech (weights, checkpoints, code, architecture), agents, chip design, clusters. API, app and SaaS access is not an export per MOFCOM |
| Status | not enforced since May 13, 2025, still in the CFR (GAO) | interim registration live since Oct 16 |

The US side is in limbo. According to [GAO decision B-337935](https://www.gao.gov/products/b-337935), Commerce said on May 13, 2025 that it would not enforce the January 2025 Framework for AI Diffusion and started a rescission. GAO’s view: the rescission is not final, the rule is still in the Code of Federal Regulations, and the non-enforcement notice itself counts as a rule under the Congressional Review Act. The [Encyclopedia of Economic Statecraft](https://jamesjtennant.com/entries/ai-model-weights-and-frontier-models/) notes the US control (ECCN 4E091) covered weights of advanced closed-weight models above 10^26 operations.

Ball calls the Chinese draft a “mirror image” of US model-weight controls. I’d add one twist. Washington worried about closed weights being stolen, because its frontier labs are closed. China’s strongest export is open weights, so its lever has to sit on the open release itself. Each side controls what it is actually good at.

MOFCOM calls the revision “routine” and “not targeted at any specific country, region or entity”, citing Article 20 of the Foreign Trade Law and a catalogue revised many times since 2001. CTOL notes it runs on that law and the technology import and export regulations, apart from the Export Control Law that carries the dual-use lists. The scale argues against “routine”: per CTOL, the July 2025 revision deleted 3 entries, added 1 and changed 1, with no AI. Forty proposed entries is “a large step”. Ryan Etzcorn of Ankura China Advisors told Bloomberg, via [The Straits Times](https://www.straitstimes.com/business/china-plans-ai-export-curbs-to-exert-control-over-key-tech): “This is more than routine maintenance.” He added: “Beijing is signalling that steadier relations with the West do not mean it will stand still.” The same report recalls 2020, when Beijing added algorithms to the list after the first Trump administration threatened to ban TikTok unless it sold its US assets.

## Who feels it first

![Glowing data pipeline across dark terrain with a large brass valve wheel, fully open, feeding branches to distant servers](https://oguzhanco.s3.eu-west-3.amazonaws.com/wp-content/uploads/2026/10/17080627/open-model-pipeline-valve-optionality.webp)

*Nothing is switched off today. The draft gives Beijing a valve over future frontier open-weight releases and on-prem deployments abroad.*

**Chinese labs aiming past 2 trillion parameters.** Bloomberg named Kimi K3 and Alibaba’s Qwen3.8-Max as examples above that line, and Alibaba said in September it plans models of 5 to 10 trillion parameters. These are reporters’ examples measured against a draft, not a ruling on any model. But if the parameter line survives, the next big Chinese open release goes through a registration step before it goes public.

**Foreign companies that want a Chinese model on their own servers.** For a restricted, non-public model, the Chinese vendor needs a licence to deploy on-prem abroad. Its own overseas cloud is the automatic route. Expect sales teams to steer customers there.

**Europe.** Matthias Bastian at The Decoder argues that Europe’s sovereignty plan, running open-weight models in domestic clouds, gets shakier when the best open models come from the US or China and either government can cut off the next version.

**Developers already running released Chinese open weights.** Not affected by this draft. Public weights and papers are excluded. The Qwen or DeepSeek checkpoint already on your disk stays yours to run.

The contrast with the summer is useful. Reuters reported on [July 8, 2026](https://www.straitstimes.com/asia/east-asia/beijing-is-looking-at-curbing-overseas-access-to-chinas-top-ai-models-sources-say) that MOFCOM-led meetings with Alibaba, ByteDance and Z.ai had discussed restricting overseas access to China’s most advanced models, including unreleased ones, closed and open. The scope was unclear then. A May roundtable summary in a Supreme People’s Court journal even floated barring the most sensitive frontier models from public release. The October draft is narrower: API access is explicitly carved out. In July, overseas access itself was on the agenda. In October, only the file is.

## What I’m watching before November 15

- **Do 10^26 and 2 trillion survive?** CTOL leaves it open. In my view parameter count is the weakest of the three lines: a large mixture-of-experts model can cross 2T without being the most capable thing on the board.
- **How “important data” and “core data” get defined.** Frontier Now notes both are left to later rules. Until then, the data trigger is hard to self-assess.
- **Whether automatic licensing stays automatic.** CTOL calls it “a promise rather than a right,” and the carve-outs could vanish from the final text.
- **Whether Washington replaces the rule it stopped enforcing.** The rescission is not final, and US AI policy is moving through new channels such as the [Super Intelligence Force](https://www.oguzhan.co/super-intelligence-force-jay-clayton-ai-czar/).

Step back and the picture is simple. Model weights are becoming a controlled good, like advanced chips before them, and both superpowers now have a draft or a dormant rule saying so. For anyone building on open weights, that changes the supply chain: the model you depend on next year may arrive only after a government says yes. Keep a copy of the checkpoint you rely on today. It is the one version nobody can register away.

## Sources

- [MOFCOM and MOST, Announcement No. 48 of 2026](https://www.mofcom.gov.cn/zcfb/blgg/gg/2026/art/2026/art_05e2643a8ca04eb9adf9dd0542991fe4.html)
- [MOFCOM spokesperson Q&A, October 16, 2026](https://www.mofcom.gov.cn/xwfb/xwfyrth/art/2026/art_d7661dbf62794345a221404f82a25959.html)
- [CTOL Digital Solutions](https://www.ctol.digital/news/china-draft-technology-export-catalogue-ai-model-weights-chip-design/)
- [Frontier Now](https://frontiernow.dev/en/news/china-ai-export-catalog-draft/)
- [The Decoder (Matthias Bastian)](https://the-decoder.com/china-plans-to-tighten-export-controls-on-open-weight-models-and-23-key-ai-technologies/)
- [Bloomberg via The Straits Times](https://www.straitstimes.com/business/china-plans-ai-export-curbs-to-exert-control-over-key-tech)
- [Reuters via The Straits Times, July 8, 2026](https://www.straitstimes.com/asia/east-asia/beijing-is-looking-at-curbing-overseas-access-to-chinas-top-ai-models-sources-say)
- [GAO decision B-337935](https://www.gao.gov/products/b-337935)
- [Encyclopedia of Economic Statecraft](https://jamesjtennant.com/entries/ai-model-weights-and-frontier-models/)