In the AI race thus far, openness has been China’s secret sauce. As fast followers to the frontier, Chinese AI companies have gained trust by publicizing their weights and architectures. And at the cost of revenue, they have achieved global adoption, brand recognition, and a truly competitive dynamic with American labs.
Last week, China’s Ministries of Commerce (MOFCOM) and Science and Technology (MOST) jointly proposed expanding China’s catalogue of export-controlled technologies, with most of the proposed regulations taking aim at subsets of China’s AI industry. Regulators will spend a month taking comments on the draft before anything becomes law, but we can already learn a ton from this announcement in its current form.
Does Beijing want to hold back the tides of open models? Why is MOFCOM writing these rules now, and what does this say about the Chinese government’s appetite for AI-enabled risks versus growth?
To find out, we spent three days poring over the draft regulations — so you don’t have to!
What’s ahead:
How these rules came to be — and how this draft is already affecting the Chinese AI industry;
What the proposed rules mean for frontier models, chip design, memory, cybersecurity, AI content detection, and even China’s minority languages;
Who actually decides which export licenses get approved, and the balance of power between provincial and central authorities;
What these rules tell us about Beijing’s expectations for AI development.
Today, we’re just focusing on the AI-related regulations, but a future piece tackling everything else — from this announcement’s proposed restrictions on PV cells and gene therapies, to other recent announcements on port dredgers and tunnel borers — is in the works! Subscribe so you don’t miss it:
The Road to a Rule
Since 2001, MOFCOM has made regular additions to the Catalogue of Technologies Prohibited or Restricted from Export 中国禁止出口限制出口技术目录. In recent years, this catalogue has basically served to list the technologies for which China’s dominance in global production affords them leverage over the rest of the world — a toolbox of weaponizable dependencies, if you will. In the last several years, this has mostly meant processing and manufacturing technologies for rare earths, magnets, and battery materials.
Now China has decided AI models belong on that list as well. On October 16, MOFCOM released Announcement 48 of 2026, detailing 40 new additions to the Catalogue and, effective immediately, requiring pre-export registration of all 40 additions in the interim. Of these 40 additions, 14 are outright export prohibitions (J codes), while 26 are export restrictions requiring licenses (X codes).1
While these 40 additions have garnered the majority of public attention, equally important is the section of the announcement creating an interim pre-export registration system. From last Friday to the date that the revised Catalogue takes effect, any technology exporter must register any exports of technologies among the above additions prior to export, including exports that have already begun but not yet completed (已经开始但尚未完成). There is no precedent in any earlier catalogue revision for the creation of an interim registration regime announced with draft additions. Beijing is creating a better dataset so that it can make an informed final decision on what to license.
Under Announcement 48, registration is required for a Chinese company hoping to: 1) assign ownership of the technology abroad, like in the case of an IP sale, 2) license domestic technology abroad, 3) change the owner or actual controller of domestic technology to a foreign entity, or 4) do anything else that MOFCOM later decides to specify. The triggers for registration also suggest that MOFCOM is testing what mechanisms will ultimately be used for classification of an AI export. An AI model is not a physical item like a gallium ingot, so the question of what constitutes export is less clear.
This third trigger effectively codifies the Manus case. In December 2025, Meta signed a deal to purchase Manus, a Chinese agent startup that had moved to Singapore, but following MOFCOM review, a security review led by the NDRC led to the deal being reversed. Now, rather than relying on investment review authority, similar deals would require a license on export control grounds, and redomiciliation would not let a company escape Chinese jurisdiction.
In the registration form provided with the announcement, MOFCOM asks for standard information like the recipient, technology code, user and end use, and secrecy grade. It also asks for specific circumstances of exports not made under contract (不依据合同出口的具体情形). This forces exporters to judge for themselves whether they should report a potential action, and may point to open-sourcing and sharing code within a group.
IP and National Security
These rules fall into two categories: controls that protect intellectual property (IP), and controls that protect state security.
To Xi Jinping, these are not separate justifications. As he explained during a 2020 study session speech, “Intellectual property protection weighs on national security; only by strictly protecting intellectual property can we effectively safeguard our country’s independently developed key core technologies and prevent and resolve major risks.” (“知识产权保护工作关系国家安全，只有严格保护知识产权，才能有效保护我国自主研发的关键核心技术、防范化解重大风险。”)
We’ll start with the controls that seem primarily IP-focused (frontier models, AI chip design, memory chips, and clusters), then move on to controls in the middle (AI-generated content detectors and agents), and finish on the primarily state security-focused controls (training data, cyber capabilities, and in a suprise addition minority languages!).
Controls by Type
Frontier models
When you use a frontier U.S. model, you are accessing the software without getting a peek at the fundamental structure behind the curtain, and thus closed models can be used without directly leaking IP. Most of China’s domestic AI champions, however, publish open weight models, meaning that the user can see the structure of the model, and much of the IP is fundamentally public. Open weight, though, does not mean open source, and the training data, preprocessing pipelines, and training code remain behind the curtain.
MOFCOM proposes to require licenses for the export of both weights and core private IP, including key checkpoints, underlying source code, architecture design, and technology for training optimization and inference acceleration. The regulation controls the core technology of a large model that exceeds any of the following three thresholds: ≥1026 floating point operations, ≥2T parameters, or “global leading capability” 能力达到全球领先水平. We discuss each threshold here:
≥1026 floating point operations (FLOPs)
The number of floating point operations (FLOP) is a common measure of the raw compute used to train an AI model, and is thus often a good proxy for model performance. The minimum cutoff listed in this MOFCOM announcement is identical to the figure originally mentioned in a 2023 Biden executive order, which was later used in the January 2025 AI Diffusion rule (US ECCN 4E091) that was rescinded in May 2025. This is also the same threshold as California SB 53. In its follow-up Q&A, MOFCOM mentioned “referencing internationally accepted standards” 参考国际通行做法 while drafting these proposed catalogue additions. As of October 20, 2026, no released Chinese model is estimated to have crossed this bar. The Chinese models with the largest training compute sit at roughly 2x1025 FLOP, according to Epoch AI. China remains compute-constrained compared to the United States.
≥2T parameters
The number of parameters in a model is the overall size of the model, which is a rough proxy for its capability. As of now, per Epoch AI, only four Chinese models since mid-2024 (Kimi K3, ERNIE 5.0, Qwen 3.8 Max, and Qwen3.8-2.4T-A95B) cross this threshold. No models from DeepSeek, Meituan, Xiaomi, or Z.ai exceed two trillion parameters, but all have models above or near one trillion parameters, and it is reasonable to expect their next releases to cross that threshold. As the Q&A clarified, the restriction does not cover tech that is already public via open weights or literature, so there is an incentive for companies to rush new releases that would exceed the thresholds before the rule is final (I do wonder how MOFCOM feels about DeepInfer, probably positively but did they get the nod beforehand?). This test is especially important for Chinese labs as China is compute constrained, and compute-scarce labs often use a design called Mixture of Experts (MoE), creating large models that only activate a small fraction of their network for any given task. If you measure these models by FLOPs used in training, it undercounts their power and makes them look weaker than they are. Total parameters, while a much better proxy for the Chinese frontier, has a potential weakness: the number of parameters is a design choice, so labs could try to game it by releasing models that slide under the 2T threshold.
Global leading level
This category is by far the most up-for-interpretation. The note states that the bar is the global top 10 through public evaluations from “mainstream domestic and foreign testing organizations and large-scale industrial platforms” 国内外主流测评机构，大规模产业平台 across “overall performance, specialized operational capabilities, global call volume, safety performance, training efficiency or others” 综合性能，专项业务能力，全球调用量，安全性能，训练效率， 等. This definition allows the rule to cover a wide range of models. The rule does not name a ranking body, and, in practice, different AI ranking bodies frequently disagree on their ordering as they use different tests and rating algorithms. Likewise, the rule would potentially affect any model that was in a top-10 list on any one dimension, even if the criteria were narrow. The mention of call volume also has the potential to pull in weaker models that are used in high volume for easier tasks. Given that the status is judged at time of export, it is likely that the same model could jump off or on a leaderboard between subsequent exports without the model itself changing.
The carve-out for already-released open source models means that published weights are out of the scope of this control, but closed-weight model companies hoping to license existing models to foreign firms and future releases by open-weight companies would still be restricted under the proposed rule. Just because a model is open weight, it does not mean it is open source. Open weight companies still hold private know-how, and this IP related to training is directly controlled by a clause mentioning training optimization and inference acceleration 训练优化、推理加速. Open sourcing a restricted model is a controlled export and would get an automatic license.
AI chip design
The announcement proposes restricting the export of AI chip design that checks off at least one of the following boxes:
requires a manufacturing process of 14 nm or below;
is able to do floating-point or integer arithmetic;
uses advanced 2.5D or 3D packaging to integrate multiple dies;
has high-speed interconnect capacity;
has an architecture integrating memory and compute;
or is used in autonomous driving, computer vision, or speech.
The inclusion of any chips with floating-point or integer arithmetic capabilities 具备浮点或整型运算能力 means that this covers almost all digital chips, including all AI chips, which suggests either a drafting error or an extremely wide breadth (MOFCOM will probably be getting some polite letters around this clause…). Likewise, all AI chips used in datacenters require high-speed interconnect capability to interface with other chips and memory.
The inclusion of architectures that integrate memory and compute is also noteworthy. Traditionally, AI chips use von-Neumann architecture, where memory and compute are housed separately and data moves back and forth between the processor and the memory. This shuttling of the data wastes energy, however, and technologies like in-memory and neuromorphic computing, explicitly mentioned in the announcement, eliminate this energy loss and allow for greater parallelism. Non-von-Neumann architectures would also potentially allow China to circumvent its shortage of traditional high-bandwidth memory (HBM). While these technologies have seen limited deployment in datacenters because the technology is immature and lacks a mature software ecosystem, they have been used in smaller research data centers and are used in robotics, drones, and autonomous vehicles. China is highly competitive across these three sectors. Indeed, when paired with the direct inclusion of chips used in autonomous driving and computer vision, this gestures to a strategic vision. For Beijing, protecting its advantage in memory-integrated chips could help it plan a future data center build-out that is not dependent on Western memory supply chains.
This forward-looking export control on a technology that has not yet picked up real adoption is also reminiscent of the FCC’s own Robot Ban. No one is really sure whether these technologies will take off, but given they are not yet widespread, the easiest time to restrict them is now. The market being hit is minimal, and companies that design such chips don’t have large vested interests to protest against the rule. In the case that non-von-Neumann architectures find commercial viability in the future, China will not have to worry about the US profiting off designs and IP; that door would have already been shut.
This restriction, and the following restriction on memory chip technology, does not restrict the chips themselves. Chinese companies remain free to sell AI chips and the memory used in data centers to U.S. companies. The restriction instead applies to the intellectual property associated with these chips, allowing Beijing to have a say in patent deals with foreign companies.
This design control can also be construed as MOFCOM disallowing Chinese companies from fabbing their designs at TSMC or other companies. While BIS has attempted to play the cat-and-mouse game to prevent Chinese AI chip designers from covertly sending their designs to TSMC, MOFCOM may be cracking down on Chinese companies itself. Time will tell how the rule ultimately gets enforced: is it more about protecting Chinese designs, or forcing Chinese designers to work with Chinese, not Taiwan or American, fabs?
Memory chips
This MOFCOM announcement further focuses on memory with its proposed restriction of memory chip design technology export. This restriction’s use of an “any of the following” structure creates a broad category under the guise of narrow delineations. The restrictions on 3D flash (long-term memory) and DRAM (short-term, working memory) design are not AI-specific, capturing much of the memory work at YMTC and CXMT. For a brief refresher on memory, see Aqib’s excellent primer on Chinese HBM.
Many of the limbs of the restriction allow broad interpretation. For both types of memory, the proposed addition would require export licenses for all memory that uses bonding technology to join separately made chip layers. This would cover every flash chip made by YMTC as well as almost all HBM chips, which are further covered by the mention of any chips using multi-layer stacking. For flash, the announcement includes density (8 Gb/mm2) and speed (1.5 Gbps I/O) minima that both fall well below current mainstream chips. Likewise, for DRAM, the restriction would apply to any designs requiring a manufacturing process below 18 nm, which would include almost all CXMT DRAM.
These numbers are copied over directly from Biden-era regs. The 18 nm DRAM cutoff is the exact threshold used by the U.S. Department of Commerce’s Bureau of Industry and Security (BIS) October 2022 export controls on memory! This BIS control also included a line on flash, restricting chips with 128 layers or more. When converted from layers to density,2 this is almost exactly the limit proposed in this MOFCOM announcement. On the surface, this symmetry with Washington can be seen as preparing a ready-made defense for these restrictions as “standard international practice.” This can also be viewed, however, as fencing off the IP that China has built in the last four years because of those BIS controls — a protection of the dividend from its forced indigenization of these technologies.
Another inclusion worth noting is DRAM technology that uses vertical channel transistors (VCT). Where traditional memory cells are laid flat, in VCT the cells are stood upright, allowing for more memory in the same space without requiring higher precision lithography. China has invested heavily in this technology, as it presents a potential to circumvent Western denial of access to fabrication technologies like EUV. Indeed, in the week before the draft, CXMT announced that it would release a VCT design that shrinks the footprint of each memory cell from the mainstream level by a third by the end of 2026. This prompted a drop in the stock prices of both Samsung and SK hynix, both of which have targeted 2028 for their release of VCT memory. Both Samsung and SK hynix could have pursued VCT earlier but ultimately decided to squeeze more juice out of EUV before turning to VCT. When they do transition, however, the process will inevitably take time as the companies struggle to reach appropriate yield with a new design. China does not want to give the big memory makers any shortcut with that trial and error, as China has learned from the footsteps of other companies. By controlling VCT, China is hoping that the Korean companies will face the same yield struggles as CXMT.
Clusters
US chip controls have forced China to compete through workarounds, and now, Chinese firms have gotten good enough at engineering whole alternative systems for compute that the government believes they have domestic IP worth protecting. Areas where China could have a comparative advantage include wiring many weaker chips into superPoDs like Huawei’s CloudMatrix 384, engineering systems to keep running through failures, and mixing Nvidia and domestic fleets as one. This corresponds directly to this announcement’s proposed restriction on the export of technology relating to large clusters (≥10,000 AI accelerators) with either fast interconnect (≥800 GB/s), fast recovery from failures (≤120 s), high scaling efficiency (≥98%), or unified scheduling across chips from at least two vendors.
This rule would protect such comparative advantages by giving automatic licenses to self-built, self-operated overseas data centers of Chinese firms, while exercising real bureaucratic scrutiny over prospective sales of the tech and IP licensing agreements. That could be used to push companies in the Gulf and Southeast Asia to rent Chinese compute rather than buy it, as the hardware could be freely sold but the know-how to build or run them without Chinese engineers is gated by the licensing desk. Even though China doesn’t have enough chips today to export, this would seem to make the ‘Chinese stack’ less attractive going forward.
Agents
The proposed agent restrictions were inspired by the debacle with Meta’s attempted acquisition of Manus, aiming to formalize the authority to block future transactions.
Chinese firms already sell agent products abroad (from well-known tools like Manus and Kimi, to specialized platforms like Alibaba’s Accio Work), and they could continue to do so under the proposed changes — but they will now need a license to allow the client to host and manage the agent reasoning loop in their own environment.
The agent capabilities that trigger the restrictions (autonomous planning/task decomposition, multi-agent collaboration, and tool use) are not necessarily unique to Chinese firms, and the thresholds in each of these qualifying capabilities seem somewhat arbitrary (e.g., integration of 200 third-party tools). But the Manus sale indicates that Chinese firms do have valuable IP when it comes to agents, so we can think of these controls as applying to the specific architectures that enable Chinese agent products to hit these thresholds while keeping costs comparatively low.
The fourth capability proposed for export restriction is “AI decision-making technology for strategic interactions” (人工智能博弈决策技术), e.g., wargaming and game-theoretic AI.3 Controlling those capabilities is, of course, more in line with the state security justification than with IP protection.
Multiagent collaboration tech would be restricted if the overall task completion time is at most “two times the minimum completion time of a single agent” (“整体任务完成时间≤单智能体最低完成时间2倍”). We’re wondering if that wording is intentional, as it allows the multi-agent system to be twice as slow as a single agent. Technical folks, are we missing something here? We’ll be watching to see if this wording makes it into the final draft.
AI-generated content detection tools
The proposed controls also cover exports of advanced AI-generated content (AIGC) detectors. Detection tools with accuracy above 98% are in the restricted category and will be exportable with a license. But detection tools used by Chinese authorities, in relation to national security threats and content entering China from abroad, are outright prohibited from being exported if their accuracy rate exceeds just 95%. The exact wording covers tools that are “specifically or primarily used to prevent and address security risks in China’s cross-border network-data transmission” “专门或者主要用于我国网络数据跨境传输安全风险防范和处置” — data security seems to be the most important threat. This makes intuitive sense: proprietary censorship tools used by state authorities are presumably trained on sensitive data, so as to be able to detect content that Beijing deems noteworthy. Therefore, exports of these tools run the risk of leaking political secrets or enabling an adversary to reverse-engineer AI-generated political content that these tools are less likely to detect.
But why require export licenses for AIGC detectors not used by the government? To Lily, it seems MOFCOM believes that China could have valuable IP here. Chinese social media platforms are, in theory, required by law to detect and label AIGC, so perhaps this is an area where Chinese companies are doing hardcore innovation and will eventually develop commercially competitive products. RedNote has published research on AI image detection, although it’s not clear how much of their AIGC detection algorithms for audio, video, and images are developed in-house vs. by an external model maker. Other platforms are similarly tight-lipped about their AIGC labeling systems. Curiously, few competitive AI-generated text detectors have come out of China: even a recent state media editorial on AIGC, reprinted by Xinhua, mentioned Pangram and GPTZero as example detectors, seemingly unable to name local equivalents. So congratulations to Pangram on ascending to national security crown jewel status.
Ceding the international market would be bad news for profitability and product quality. If authorities are restrictive in licensing detection products — or if there is a risk your license won’t be renewed because your detection algorithm became so good that the government decided to start using it — that could make tech companies hesitant to spend resources improving these tools.
Training data
In addition to restricting the export of large models, the proposed revisions to the Catalogue cover all AI models trained on sensitive data, regardless of size or performance. The inclusion logic here rests on security rather than IP. Model weights hold the potential to act as a channel to move data outside of China, so Beijing plans to regulate them as an extension of China’s existing rules on data leaving the country.
The rule completely bans the export of models trained on “core data” 核心数据, and restricts the export of those trained on “important data” 重要数据. These categories come from China’s Data Security Law. “Core data” includes any data on national security, economic lifelines, important livelihoods, or major public interests 关系国家安全、国民经济命脉、重要民生、重大公共利益. “Important data,” on the other hand, is left for “relevant regions and departments” to define and catalogue.
It seems unlikely that Chinese AI companies have been training their open models on highly sensitive “core” data that only the government can supply, given data leakage risks that Beijing no doubt is aware of. The category of “important” data, however, is more nuanced. In the 2024 cross-border data-flow provisions, the Cyberspace Administration of China (CAC) advises firms handling data that, unless previously notified that the data in question is considered “important,” submitting it for the official outbound-data security assessment is unnecessary. Technically, then, since the government is supposed to notify companies about “important” status, AI companies should already know which pieces of data in their training corpora are “important.” Will they need to exclude this data from future training runs, or will getting licensed be easy enough? And how will this work in practice — will training runs on overseas compute clusters be cut off, or allowed to continue as they do today?
… Minority languages?
Finally, included in the list of restricted AI technologies are translation technologies that pass a certain fidelity score threshold for “Chinese and ethnic minority languages,” as well as voiceprint recognition technologies with “specialized optimization capabilities … in ethnic minority languages or specific regional dialects”. At first, this seems like an odd addition to a list focused on technical capabilities. But the politics of language in China help explain this rule, as well as further contextualizing how Beijing understands AI safety.
There are at least 80 minority languages in China, spoken by the country’s various non-Han ethnic groups. Additionally, Chinese itself is a blanket term for at least seven language varieties and their own dialects. Beijing’s censorship and information security apparatuses are optimized for standard Mandarin Chinese, but show cracks for other languages. During the Covid-19 pandemic, for example, netizens found they could express frustrations with government policies when they typed internet posts in Cantonese.
Various Chinese academic institutions have researched natural language processing for minority languages, with the help of state funding. Peking University, for example, built MC2, a corpus specialised in Tibetan, Uyghur, Kazakh and Mongolian. Other state-funded efforts have worked on tokenizers for these languages.
Given the political sensitivity of these ethnic groups, Beijing may believe that providing AI tools customized for their languages will bring them closer to the Party’s values — and failing that, enable authorities to more effectively monitor dissent.
Knowledge of niche languages has come into use in times of conflict. During WWII, Navajo members of the US Marines used their own unwritten language to create unbreakable code, helping the US win in the Pacific Theater. Perhaps the Chinese versions of the Navajo code talkers will speak Tujia!
Cyber capabilities
MOFCOM has proposed restrictions as well as separate prohibitions on distinct sets of cyber capabilities.
First, the prohibitions. Exports of “[AI-driven] malicious code generation and mutation technologies” that “may be used to attack highly sensitive systems such as national critical information infrastructure, national defense and military industry, and core government affairs, or to bypass national security defense systems (“可被用于攻击国家关键信息基础设施、国防军工、核心政务等高敏感系统，或用于绕过国家安全防御体系”) are prohibited if they meet any one of three relatively high capability thresholds in offensive cyber attacks.4 Separate prohibitions apply to anti-virus evasion and adaptive evasion technologies (i.e., techniques for circumventing security tools and modifying malware as it runs) that could be used to threaten state security and meet specific technical thresholds.
On the other hand, the proposed restrictions apply to “vulnerability discovery technologies,” i.e., AI that can identify exploits in code the way Mythos did. But in this category, the restrictions kick in if any one of six low-to-medium-difficulty technical thresholds5 is met. That is to say, the bar for requiring a license is much lower than Mythos-level competence.
That suggests that the Chinese government is wary about going down a “let it rip” timeline, as we concluded earlier this year when thinking through the Chinese Mythos moment. We may be entering an era of cyber-exploit abundance thanks to AI tools outside China’s control, but leadership at MOFCOM still would seemingly like to prevent Chinese AI technology from causing a devastating attack — or a PR crisis.
The unfortunate thing about cyber, of course, is that defensive and offensive capabilities largely overlap. You can try to limit offensive capabilities by teaching the model to refuse fishy prompts, but safeguards can be circumvented as long as code-patching competence is preserved.
How will MOFCOM enforce the rules?
The letter of the proposed rules tells us nothing about how the automatic licensing mechanism would work — it is a new regulatory mechanism that has yet to be defined. That means the officials responsible for evaluating export license applications may not yet have subject-area expertise or longstanding relationships with AI labs. Industry has the opportunity to submit comments on the proposal until November 15th, 2026.
On paper, export licenses are handled by the provincial commerce authority in the exporter’s locality “in conjunction with the [provincial] science and technology authority” (“省级商务主管部门会同科技部门审查”) rather than being approved or denied by MOFCOM.6
In practice, however, there is precedent for central authorities from MOFCOM and S&T to get involved. ByteDance applied with the Beijing Municipal Commerce Bureau for a license to sell TikTok in 2020, but the central government made it clear that they did not want the sale to go through.7 In 2023, central authorities intervened in CATL’s application to export battery technology to Ford after provincial authorities had already reviewed the case. While MOFCOM is delegating most export license reviews to province-level authorities, it effectively retains a final say on cases with topmost national security implications.
In the case of Announcement 48, comments on the proposal have been directed to the Bureau of Industrial Security and Import and Export Controls 产业安全与管制局, while the announcement of the catalogue back in July 2025 was issued by the Department of Trade in Services and Commercial Services 服务贸易和商贸服务业司. That suggests more authority has been conferred upon the security bureau for these rules.
Can bureaucracy bog things down?
In a companion Q&A with journalists published alongside the draft regulations, the MOFCOM spokesperson said that for certain types of AI technology exports, MOFCOM will largely operate under the principle of “immediate submission, immediate license issuance” (即报即出). This is a well-worn phrase template in Chinese trade policy language — the earliest example Irene found was from 2006 — and it is meant to communicate that there will be minimal friction at the point of application for most cases.
The categories of technology exports that enjoy this privilege are:
Open-sourcing of AI technologies;
Chinese companies building self-operated data centers abroad;
Chip tape-out overseas;
Using international resources for joint research and development;
And participating in international standard-setting.
MOFCOM has created carveouts for areas where China stands to gain the most from international AI cooperation. Open source remains the most meaningful strategy for shaping competition at the frontier, as well as attracting users to Chinese models. Chinese AI companies are still able to amass compute abroad to substitute for restrictions at home. Chinese chip designers can still tape-out in overseas fabs where foreign rules still allow it, and researchers and governance bodies will still pursue influence in standard-setting.
Open source
Open sourcing is first on the automatic license list, but an automatic license is a license nonetheless. For technology that is already open sourced, Beijing cannot claw back what has been made public. But for any new or unreleased technology in the AI section of the announcement, open sourcing would require an automatic license. The extent to which this is truly automatic is hedged in the Q&A, saying it will “basically” achieve immediate implementation 基本实现即报即出. There is quite a bit of room here for a slowdown should Beijing desire. In the interim, before this rule is finalized, registration is likely required for any firm seeking to open source a technology listed in the announcement. This gives MOFCOM access to the technical specifications of every frontier Chinese AI model before it is released to anyone else. On the surface, this creates a release-by-release record that can inform the final licensing rule, yet it also carries the implicit threat that even in this interim period where no control yet exists, after receiving a registration form, Beijing could act quickly to block the open sourcing of a model it deems too valuable to release.
Open sourcing is not defined in the announcement, and it is unclear what it would include. Kimi’s K3, for example, is an open weight model, but it is released under restricted-use and commercial-use licenses — whether this type of release is included in the autolicense regime is yet to be seen. The Q&A also promises to help facilitate capacity building by members of the newly formed World AI Cooperation Organization (WAICO) founded in Shanghai in July of this year. Could license speed now be a WAICO membership benefit? Beijing is simultaneously maintaining its growing soft power of open models while adding a checkpoint on frontier releases. This move may backfire, however, as Chinese model adopters in non-WAICO countries may suddenly become queasy about their usage of such models. If a license can be revoked at a whim, then maybe it is time to move your company to a non-Chinese model.
What about international users?
For AI technologies on the “restricted” list, serving international customers through Chinese companies’ own data centers abroad requires an export license (though the proposal suggests that such licenses could be granted under streamlined or even automatic processing). However, providing API access, app or web-based interactions, and SaaS applications to clients abroad do not require a license. (Nor does providing lightweight deployment on local devices.)
One Chinese analysis, citing Nomura, argues that these regulations benefit internet-giant players in China’s AI ecosystem over independent labs. Since companies like Tencent, ByteDance, and Alibaba have already built their own data center clusters abroad, they have mature processes for serving their models to international users. Pure-play model makers like DeepSeek, Kimi, or MiniMax, on the other hand, need to work with inference providers to ensure compliance.
China and the art of wakeboarding 乘风破浪
This new package of restrictions is driven in part by security concerns. However, it does not change our basic assumption that China is optimistic overall about AI’s future development. MOFCOM has tried to assure its anxious audience that it does not seek to slow down Chinese companies or research institutions as they attempt to innovate at the cutting edge. Rather, MOFCOM is asserting its jurisdiction as China’s import-export regulator over AI hardware and software alike. As AI becomes an increasingly complicated commodity, the decision to start building expertise and enforcement mechanisms early will yield compounding gains.
A draft like this represents the convergent interests of different stakeholders across the security bureau, industrial-policy and AI regulators, and private companies. In the Q&A, MOFCOM and MOST say that they consulted research institutes, industry associations and major firms beforehand, and the amount of technical detail in previously unregulated areas suggests that this has been in the works for months.
The exact timing of the release seems to be no accident. The comment period closes three days before Xi and Trump’s expected November 18 meeting at APEC. While finalization will not arrive in those three days, the option to tighten, narrow, or shelve the draft could serve as an excellent bargaining chip should Beijing so desire. This announcement also comes five weeks after the NSA/CISA/FBI advisory accusing six Chinese labs of “industrial-scale distillation.”
The stereotype of Chinese innovation, and the one implied by the distillation advisory, is that it follows American progress, either as an application of an existing technology or a cheap facsimile, and that China is dependent on Western chip know-how. This draft for controlled technologies pushes back on the premise that Chinese firms across AI innovation and the industries that support it are just surfing the wake of the American frontier companies — they are producing valuable parallel technologies that China believes are worth protecting.
New technologies, however, come with new risks, particularly to an authoritarian state. Wrapped into the same draft of export controls are regulations that seek to protect the state from the ill effects of an AI-native citizenry and keep the AI systems that Beijing uses for control to itself.
Submit your comments!
Anyone (yes, that means you!) can submit comments related to these proposed rules to MOFCOM, via email, fax, or a letter addressed to their office in Beijing. The comment period is between October 16 and November 15, a standard-length window for stakeholders to put together cases for amendments.
The history of this 30-day comment period is an interesting footnote in US-China relations. Back in June 2008 during the US–China Strategic Economic Dialogue, both countries committed to publish proposed trade- and economy-related administrative regulations and departmental rules for at least 30 days of public comment. China does so on the Ministry of Justice’s 中国政府法制信息网 site, while the US uses the Federal Register. That dialogue is one basis on which China continues to publish draft trade regulations for public comment to this day.
And they do lead to substantive changes! When MOFCOM revised the same catalogue back in 2022-2023, public comment and consultation with experts led to the Ministry dropping and narrowing many proposed entries. To draft the final version of the 2024 Dual-Use Items Export Control Regulations, MOFCOM reviewed nearly 600 comments from companies, chambers, associations, foreign governments and foreign missions, according to their Q&A.
The contents of these new restrictions, then, are open to revision. They could become more relaxed, tighten in some respects, or change in scope. Analysts should take care not to view these proposed regulations as the final word on any technical detail, though we should also expect the spirit of the rules to remain consistent.
Unlike previous revisions to the Catalogue explicitly run by the Services-Trade Department 服贸司, this announcement was published through the Security and Control Bureau 产业安全与进出口管制局, which historically is in charge of China’s export control system. This announcement was issued under the authority of the Foreign Trade Law 中华人民共和国对外贸易法, the revised version of which took effect in March of this year, and the Regulations on Technology Import and Export Administration 技术进出口管理条例.
See SemiAnalysis’s conversion for YMTC 128-layer NAND.
Specifically, AI agents which meet all of the following criteria:
“(1) single-task decision planning depth of 20 steps or 10 concurrent game agents;
(2) possessing strategy self-adaptation capability, complex dynamic game decision latency of 200 milliseconds and 10 control units;
(3) exceeding 90% of humans on standard game benchmarks.”
Thanks to Geopolitechs for the translation. Further block-quote translations in other footnotes come from this post, too.
For each of the 3 sections, prohibitions kick in when any of the listed technical criteria is met:
“Information confrontation technology:
1. AI autonomous-driven malicious code generation and mutation technologies that have any of the following characteristics and may be used to attack highly sensitive systems such as national critical information infrastructure, national defense and military industry, and core government affairs, or to bypass national security defense systems:
(1) an attack success rate of 60% against multi-engine malware detectors;
(2) an attack success rate of 85% against a single mainstream antivirus software;
(3) an attack success rate of 90% against machine learning models.
2. Adaptive evolution in adversarial environments and runtime dynamic behavior modification technologies that have any of the following characteristics and may be used to attack highly sensitive systems such as national critical information infrastructure, national defense and military industry, and core government affairs, or to bypass national security defense systems:
(1) capable of detecting virtualization sandboxes, debuggers, and emulators, identifying the type and version of security products, or achieving sandbox escape;
(2) under the premise of maintaining complete malicious functionality, automatically rewriting 50% of code structure or control flow upon each execution.
3. Automated antivirus-evasion variant batch generation and distributed large-scale deployment technologies that have any of the following characteristics and may be used to attack highly sensitive systems such as national critical information infrastructure, national defense and military industry, and core government affairs, or to bypass national security defense systems:
(1) generating 20 functionally equivalent but structurally different variants in a single run, or having an end-to-end automation rate of 80%;
(2) based on a single baseline payload, generating more than 10 variants every 24 hours with syntax tree divergence of 30%;
(3) sampled variants showing 90% consistency in behavioral profiles in sandboxes.”
Restrictions apply to AI-assisted vulnerability discovery technologies that have any of the six characteristics:
“(1) in authoritative security benchmark tests, a vulnerability reproduction or exploitability determination score of 75%;
(2) for known publicly disclosed vulnerabilities, an end-to-end success rate for independently completing the process from vulnerability analysis to construction of a complete exploit chain: 50% success rate for mainstream operating systems or browsers, or 40% success rate for exploit construction at the arbitrary-code-execution level;
(3) vulnerability discovery and exploitation efficiency achieving an improvement of 10 times or more compared with the benchmark implementation by senior security experts, or achieving a performance improvement of 10 times or more in the number of exploitable vulnerabilities discovered in standard vulnerability database security benchmark tests;
(4) capable of autonomously chaining two or more low-risk or medium-risk software defects into a complete multi-stage attack chain and generating runnable proof-of-concept code;
(5) under a conventional testing framework, capable of autonomously discovering in one pass more than 5 previously undisclosed high-risk security defects, or more than 50 previously undisclosed security defects, in a major open-source project or mainstream operating system;
(6) reaching the highest level in mainstream domestic and international exploit capability grading systems.”
Excellent work. I learned a lot! I retired last year and haven’t kept up. Wow things are changing so fast.
Great job. It’s always interesting to see the lengths Beijing will go to in order to buttress the façade of being a rule of law country.