China Did Not Ban AI Exports. It Put a Registration Form in Front of the Weights.

The headline that travelled was that China had banned AI exports. A Reddit thread with eight hundred upvotes read the news as American companies winning by default: "They got everything they wanted with this announcement and onwards to complete domination of the western market."

The document does not say that. It says something narrower, and the narrow thing is harder to route around than a ban would have been.

What was actually published#

On 16 October, China's Ministry of Commerce and Ministry of Science and Technology published Announcement No. 48 of 2026. It proposes revising the Catalogue of Technologies Prohibited or Restricted from Export, a list the two ministries have adjusted repeatedly since 2001.

The proposal covers 40 technologies across three fields. Twenty-three are AI: large models, agents, compute clusters and information processing. Five are biomedicine. Twelve are solar, and the solar scope reaches the key equipment that carries the controlled technology, not just the process.

Across the whole list, 14 would be prohibited and 26 restricted. The prohibited AI entry is the one that reads like a security document rather than an industrial one: AI-driven generation and mutation of malicious code, which the ministry says could be used against critical infrastructure, defence and core government systems. AI-assisted vulnerability discovery sits on the restricted list.

Comments are open until 15 November, by email, fax or letter, with a published address.

The draft did not arrive from nowhere. Reuters reported in July that Chinese authorities had been discussing with Alibaba, ByteDance and Z.AI the possibility of restricting overseas access to the country's most advanced models, including unreleased ones, and that regulators had spent weeks consulting domestic AI and chip companies on how to stop flagship technology reaching Western hands. The two questions under discussion then were the transfer of training data abroad and whether foreign users should keep getting free downloads of model weights. Both are visible in the final draft.

The part that is already in force#

This is the detail most coverage skipped, and it is the only part with legal effect today.

The draft needs a comment period and a formal revision. The registration requirement does not wait. From 16 October, until the catalogue is formally revised and implemented, an exporter must register on a Ministry of Commerce platform before exporting any technology in the annex.

Exports already begun but not finished are explicitly included. The ministry's own summary of the cases: transferring technology ownership abroad, licensing domestic technology for use abroad, and a change of owner or actual controller of domestic technology to a foreign entity. The form asks for the exporter, the recipient, the destination, the technology and its use, and the expected value.

The ministry also says exporters should judge for themselves whether their technology falls inside the registration scope. That is a self-assessment obligation with a filing attached, which is a different kind of burden from a prohibition and, for a company with a legal department, often a more expensive one.

The exemptions decide everything#

Three sentences in the annex and the spokesperson's Q&A do most of the work, and they point in the opposite direction from the headlines.

First, the announcement itself: technology that has already entered the public domain through open source or published academic papers is not within the management scope. That covers the Chinese open-weight models already on Hugging Face. Kimi K3's card lists 2.8 trillion total parameters with full weights published. Qwen's Qwen3.8-2.4T-A95B carries 2.4 trillion parameters with 95 billion active. Both are out, on the ministry's own wording, because they are already public.

Second, the spokesperson on service access: using a restricted large model to provide API calls, app or web interaction, SaaS applications, or local on-device lightweight deployment does not fall within large model technology export management. The thing being managed is the movement of technology out of China, not the ability of a foreign developer to call it.

Third, on new open-source work: open-sourcing AI technology, running your own compute centre abroad, going abroad for chip tape-out, joint research using foreign resources, and international standards work all get automatic licensing, which the ministry describes as roughly report and export immediately.

Put together, the announcement keeps the current open-weight generation in circulation, keeps the API open to the world, and gives the next open release an automatic licence with a filing step. That is not a ban, and it is not the closing of the open-model ecosystem the reaction described.

What it does catch#

The narrow thing is still real, and it lives in the definition of a technology export.

The restricted large-model entry is reported to cover a model's core technology: weight parameters, key checkpoints, source code, architecture design, and training-optimisation and inference-acceleration techniques. Transferring those to a foreign party outside the service channels is caught.

The sharpest line is deployment. Asked directly about the various ways Chinese models go abroad, the spokesperson said the test is whether restricted technology moves from inside China to outside it. For restricted AI, overseas localised deployment is within scope. If the deployment sits on the vendor's own overseas cloud, where risk is judged relatively controllable, automatic licensing can apply.

So the gradient runs like this. A European company calls a covered Chinese model over the API and nobody in Beijing is involved. The same company asks for that model installed on its own hardware, so that client documents never leave its own perimeter, and the vendor needs a licence. The option a residency-conscious buyer actually wants is the one with the paperwork.

There is also a data provision. Models trained on China's core data and then offered as a service would be prohibited from export, and models trained on important data would be restricted. The ministry's Q&A does not expand those categories beyond referring to the existing legal framework, and they are where the real commercial exposure sits for any lab that trained on domestic material.

Agents have numbers too#

The agent entry is the most concrete thing in the annex, and it reads less like a legal category than like the specification sheet from a product launch.

Reported thresholds for restricted agent technology include planning that decomposes a natural-language instruction into chains of twenty steps or more at eighty percent decomposition accuracy and ninety percent average subtask success; multi-agent architectures running sixty or more concurrent agents; and tool use across two hundred or more third-party tools at ninety percent tool-selection accuracy, with ninety percent end-to-end success on tasks requiring three tools or more. There is a separate entry for AI game-decision technology, which among other conditions plans twenty steps deep, runs ten game agents at once, decides in two hundred milliseconds or less, and beats ninety percent of humans on a standard benchmark.

The draft names no benchmark for any of them, which means the numbers are doing the work that a definition would otherwise do. Whether that is precision or the appearance of it will be settled by the first company that has to argue its system falls below the line.

One limit in the same text cuts the other way. Products made using a listed technology are not covered, so a Chinese agent product sold abroad as a service stays outside. Transferring the agent stack itself is what the entry targets.

Three tests, not one number#

The threshold that travelled in coverage was two trillion parameters. That came largely from the Associated Press, and it is one of three alternative tests reported from the annex, any one of which brings a model into scope: at least 10 to the 26th power floating point operations of training compute, at least two trillion parameters, or a capability level judged to be at a globally leading level.

That third test has a definition, and it is the strangest thing in the document. Globally leading is reported to mean a top-ten ranking, at the time of export, in public evaluations run by mainstream evaluation bodies in China or abroad, or by large industry platforms. The listed criteria include overall performance, specialised capabilities, safety, training efficiency and global call volume.

Global call volume. On that wording, a model's popularity with foreign developers can pull it into the control scope after it has already been released. The draft does not say which ranking counts, or whether one suffices. For anyone planning to build on the next Chinese open release, that is a more consequential sentence than any parameter count, because it means the exemption for a published model may not extend to its next checkpoint.

The mirror, and the difference#

Both countries now control AI exports. They control different chokepoints, and the difference is the useful part.

The American instrument has been about who may call a model. In June the Commerce Department asked Anthropic to bar foreign nationals from using two models on national security grounds, a restriction that was later lifted.

China's draft is about where the weights may go. It does not much care who calls the model through an API. It cares whether the thing itself, the parameters and checkpoints and source, crosses a border and lands on hardware someone else controls.

Read that way, the announcement is less a retaliation than a symmetry. The ministry says so explicitly, noting that all major economies have adopted export controls to varying degrees and that this revision is routine, lawful, and not aimed at any particular country, region or entity. That is the same framing Washington uses for its own lists, and it deserves the same scepticism for the same reason: a control that targets nobody in particular still has a target.

Where the reaction went wrong#

The "American companies win by default" reading fails on the exemptions. Already-published weights stay out, the API stays open, and the next open release gets an automatic licence. The flow of Chinese open models does not stop. What changes is that a licensing and registration layer now sits on the transfer of the technology itself, which affects vendors selling private deployments far more than it affects developers downloading weights.

The "China is closing off" reading fails for the same reason, and also because the ministry built explicit carve-outs for the things it says it wants to encourage: open source, overseas compute owned by Chinese firms, foreign chip tape-out, joint research, standards work.

What the reaction missed is the one thing that is actually operative: a registration duty that began on 16 October, applies to deals already in progress, and requires the exporter to decide for itself whether it is covered.

Where this could be wrong#

The annex is published as a document format this analysis could not parse directly. The technical thresholds, including the 10 to the 26 compute figure, the two trillion parameter figure, the three-test structure, the global call volume criterion and the agent thresholds, come from a third-party reading of that annex, not from my own reading of it. They are specific enough to be worth reporting and I have flagged them as reported rather than confirmed.

The two trillion number in particular has travelled with more authority than it has earned. It is a press figure attached to a draft that names no model. Anyone quoting it should say where it came from.

The ministry's claim that the revision targets no country is not something a document can prove either way. It is a statement of intent, and the same statement appears in every export control regime.

Nothing here has been enforced. The catalogue is a draft, the thresholds are open to comment until 15 November, and the ministry says it will adjust the list dynamically, including removing technology that is no longer advanced. The most likely outcome of the comment period is that some numbers move.

And the underlying enforcement problem is not solved by any of this. Once weights are published they cannot be recalled. A control on open-weight releases works prospectively or not at all, which is precisely why the text leans so hard on automatic licensing for open source: the alternative was a rule that the internet would have made unenforceable within a week.

The close#

The useful way to hold this is as a border control on a specific object rather than a ban on a category. The object is the model itself, the parameters and checkpoints and the source that generates them, at the moment it moves onto hardware outside China's reach.

Calling the model is fine. Publishing it is fine, with a form. Putting it on your own servers is where the permission starts.

That is a narrower policy than the headlines described, and a more interesting one, because it is a government admitting in public that it cannot un-publish a weight file. The registration form is what you build when you know the thing is already out and you are trying to count what leaves next.