BEIJING — A lawyer in Shenzhen spent the third week of October reading an annex instead of closing a deal.
The deal was ordinary: a Chinese developer licensing its model weights to a partner that planned to run them in Singapore. In September it needed a contract. In October it needed a registration number first.
Nothing was banned. That is the part most coverage missed.
Key takeaways
- China's commerce and science ministries proposed on 16 October 2026 adding 23 AI technologies, covering models, agents and compute clusters, to the export catalogue.
- A model's core technology is restricted at 2 trillion parameters, 10²⁶ FLOPs of training compute, or a top-10 global ranking (draft annex).
- Serving a model abroad through an API, app or website is outside the rules; moving its weights or source code abroad is inside them.
- Technology already public through open-source release or academic papers is excluded, so published open weights stay exportable.
- Pre-export registration began on 16 October and runs until the catalogue is revised; consultation closes 15 November 2026.
What the notice actually says
Announcement No. 48, issued by the Ministry of Commerce (商务部) and the Ministry of Science and Technology (科技部) on 16 October 2026, proposes adding 40 technologies to the export catalogue: 23 in artificial intelligence, five in biomedicine, twelve in solar manufacturing. Fourteen would be prohibited outright; 26 would need a licence.
The AI tranche is grouped into four blocks — large models (大模型), agents (智能体), compute clusters (算力集群) and information processing — with chip-design entries filed alongside them. Prohibitions fall mainly on models trained on core data, high-risk agents and malicious-code generation; the remaining items need a licence.
- Prohibited: models trained on China's designated core data (核心数据) and then offered as a service; agents built for critical infrastructure, defence or core government at defined performance levels; technology that autonomously generates or mutates malicious code.
- Restricted: models trained on important data (重要数据); models clearing any one of three capability thresholds; agents meeting quantified autonomy or tool-use limits; chip-design technology at 14 nanometres and below; cluster technology above 10,000 accelerators.
Core data and important data are defined by reference to the Data Security Law, not enumerated in the annex, so a foreign buyer cannot settle coverage from the annex alone.
Three thresholds, and what they catch
The model thresholds are the part a reader outside China can test. Core technology — weights, checkpoints, source code, architecture, training and inference optimisation — is restricted when a model meets any one of three conditions: training compute at or above 10²⁶ floating-point operations, 2 trillion or more parameters, or a top-10 position on public evaluations at the time of export.
The third condition is the widest. Rankings may be judged on overall performance, specialised capability, global usage, safety or training efficiency, and parameters measure model size, not the data used to train it.
Because the conditions are alternatives, a small model trained on sensitive data can be caught by the data clause and a mid-sized one by its ranking. A narrow exemption covers runs where important data is 0.1% or less, cannot improve the model, and never appears in outputs.
No regulator has published which models sit above the line; the annex names none.
Where the line is actually drawn
The controls attach to transfer, not to use. The notice lists the scenarios requiring registration: assignment of technology ownership abroad, licensing of domestic technology for use abroad, and a change of owner or actual controller to a foreign entity.
Serving is treated separately. Reuters reported on 16 October 2026 that access through application programming interfaces, websites, apps and software-as-a-service platforms is excluded, and the ministry frames the test as whether restricted technology moves out of China.
The draft also builds a fast lane: automatic licensing — reported in, exported out — for open-sourced releases, Chinese companies running their own compute centres abroad, overseas chip fabrication, joint research abroad and international standards work.
Under the draft, a Chinese lab can serve an overseas customer through an API without an export licence, but moving the weights behind that API to a foreign-operated server brings the transfer inside the regime, with registration required from 16 October 2026 (MOFCOM Announcement No. 48).
Two consequences follow. This is not a sales ban: it protects the ability to produce a frontier model rather than the revenue from serving it, which is why the ministry said most AI technologies remain freely exportable. And publishing has become a compliance decision as well as a commercial one, because technology already in the public domain sits outside the regime: an open-weight release takes a model out of scope once the weights are public, even though the release itself is the export.
What changes for a buyer
- On-premises licensing. A customer-operated deployment outside China implies a technology transfer. Ask for the registration reference and the annex item it maps to.
- Vendor-run cloud regions. A Chinese company operating its own overseas compute centre qualifies for automatic licensing, making the same model easier to buy that way than to self-host.
- API and SaaS. Metered access stays outside the proposal and carries no registration duty for the buyer.
Honest limitations
This is a consultation draft open until 15 November 2026, not a law; thresholds and blocks can change before the catalogue is revised. The interim registration duty is already in force and covers transfers that began but have not finished. The text does not settle whether a third-party cloud marketplace hosting a Chinese model counts as a transfer, and no public register of filings lets an outsider check a vendor's claim. Nothing here is legal advice.
What readers can do now
- Analysts: download annex 1 of Announcement No. 48 and score each Chinese model you track against the three thresholds and its licence — open weights, API-only, or self-hosted. The licence, not the benchmark, decides exposure.
- Procurement and legal teams: for any self-hosted deployment of a Chinese model outside China, ask the vendor in writing which annex item applies and whether a registration was filed on or after 16 October. For API contracts, ask for the hosting jurisdiction instead.
- Newsrooms: diarise 15 November 2026, when consultation closes, and check whether the AI tranche survived intact. Until then, describe the 16 October measure as registration pending a final catalogue, not an export ban.