A product lead at a Chinese AI startup reads a ministry notice over morning coffee and feels the floor shift: her team's roadmap — overseas API access, a localized deployment for one multinational client, an open-weights release — suddenly looks like three different legal questions. Is serving a model through an app "exporting technology"? Does hosting it on her own cloud abroad count? Is the open-source release she announced last month now a controlled transaction? For weeks she had treated export control as someone else's compliance niche. The notice in front of her says otherwise.
That notice is real. On October 16, 2026, China's Ministry of Commerce and Ministry of Science and Technology jointly issued Announcement No. 48 of 2026, opening a public consultation on revising the Catalogue of Technologies Prohibited or Restricted from Export (中国禁止出口限制出口技术目录). The comment window runs through November 15. Anyone shipping AI technology out of China — models, agents, compute clusters — should read it now, while the text is still a draft.
What the draft actually proposes
The revision would add 40 technologies across three fields: 23 in artificial intelligence, five in biopharmaceuticals and twelve in photovoltaics. The AI tranche covers four families — large models (大模型), agents (智能体), compute clusters (算力集群) and information-processing technologies.
The proposed controls are tiered. Fourteen technologies across the three fields would be prohibited from export outright — on the AI side, notably, technologies for malicious-code generation and mutation driven by artificial intelligence. Twenty-six would be restricted, meaning they require a license but can be approved; among them is model-driven vulnerability discovery. The precise technical thresholds are spelled out in the announcement's annex, and the ministries stress that products made using a controlled technology fall outside the management scope — the list targets the know-how, not every application built on it.
Crucially, the draft draws a bright line around openness: technologies already in the public domain through open-source release or academic publication are not subject to the controls at all.
The part already in force
The consultation is the headline, but an interim measure is already running. From October 16 until the catalogue's formal revision takes effect, exporters of any listed technology must complete a pre-export registration (出口前登记) on the ministry's unified trade-management platform before transferring ownership abroad, licensing technology to overseas users, or changing an owner to a foreign entity. Registration covers basic information about both parties, destination, purpose and estimated value of the export.
This two-track design — consult on the rules, register in the meantime — matters for timing. If a deal to transfer model weights or license training technology to an overseas buyer is in progress right now, it is already inside the registration perimeter, even though the catalogue itself has not changed yet.
Which "going-global" models are actually covered
The ministry's Q&A, released alongside the announcement, does the most useful work: it maps the control perimeter onto real business formats.
- Not covered: providing API calls, app or web interactions, SaaS services, or lightweight on-device deployments of a restricted large model. Foreign users calling your model through your product are not receiving a controlled technology transfer.
- Covered: localized deployment of a restricted model overseas — shipping the model and its underlying technology to run on someone else's infrastructure abroad falls within technology-export management.
- Covered, but eased: deploying a restricted model on overseas cloud infrastructure you own and operate yourself qualifies for facilitation measures such as automatic licensing (自动许可), which the ministry describes as essentially "report and go."
Other facilitation paths apply to technology exports for open-source projects, overseas compute centers built and operated by Chinese companies, chip fabrication abroad, joint R&D using overseas resources, and participation in international standards-setting. Exports supporting capacity-building cooperation among members of the World Artificial Intelligence Cooperation Organization are also earmarked for support. The ministries frame the whole package as routine practice — the catalogue has been revised repeatedly since 2001 — and say it targets no specific country or entity.
A draft, not a law — yet
For compliance planning, the stage matters as much as the substance. This proposal is at the consultation stage: the text can change in scope, thresholds or policy before finalization, and no revised catalogue has entered into force. The only binding obligation today is the interim registration requirement described above, which lapses once the formal revision is implemented.
That still leaves room for movement in both directions. Commenters have until November 15 to push back on scope definitions, argue for clearer thresholds, or seek expanded facilitation. Companies with unusual deployment architectures — hybrid clouds, partner-operated regions, joint ventures — have a direct interest in submitting comments now, because the final language will define the perimeter for years.
According to Li An, chief scientist at BrainNet (脑机网), the deeper signal is that AI's governance perimeter is following the technology's own migration: from chat products toward weights, agents and the compute they run on. Export-control regimes built for software or semiconductors are being retrofitted for a world where the exportable asset is a trained model file, and where the same model can be a product, a service or a transfer depending on who operates the servers.
Key takeaways
- The draft revision would add 23 AI technologies (large models, agents, compute clusters, information processing) to China's export-control catalogue; 14 technologies across three fields would be prohibited, 26 restricted.
- Open-source and published technologies are exempt, and API/SaaS/on-device services are not treated as technology exports; overseas localized deployment is covered, while self-operated overseas cloud gets automatic licensing.
- The rules are at the consultation stage until November 15, but interim pre-export registration for listed technologies is already mandatory.
Honest limitations
- The final catalogue, thresholds and licensing procedures are not settled; everything here reflects the October 16 draft and accompanying Q&A, and could shift before entry into force.
- The announcement defines categories and facilitation measures at a policy level; how officials will classify specific model architectures or deployment hybrids in individual cases remains to be seen in practice.
- This article is journalistic analysis, not legal advice; affected companies should review the announcement annexes and consult counsel before structuring cross-border technology transactions.
What readers can do now
- If your company transfers model technology abroad in any form — weights, fine-tuning know-how, agent frameworks — verify whether it falls under the interim registration requirement that has applied since October 16, before your next deal milestone.
- If your business model depends on formats near the line (partner-operated cloud regions, joint ventures, on-premise deployments for overseas clients), submit comments before November 15 while the scope definitions are still negotiable.
- For open-source maintainers, document what has already been released publicly: the open-source exemption is a key protection, and clear release records are what make it usable.