China Turns Model Weights Into a Controlled Export

Key points

• China’s Ministry of Commerce and Ministry of Science and Technology proposed on 16 October 2026 to add 23 AI technologies to the national export-control catalogue, with pre-export registration in force immediately and comments open until 15 November 2026.
• Under the draft, installing a restricted Chinese model on servers abroad counts as a technology export, while API access, SaaS, apps, lightweight on-device use and models already released as open source fall outside the controls.
• The restricted tier covers the weights, checkpoints, source code and architecture of models trained with at least 10²⁶ operations, with at least 2 trillion parameters, or ranked in the global top ten, echoing the compute line the United States drew for closed model weights in January 2025.

For most of the past three years, the story of AI export controls was written in Washington, which decided which chips, machines and model weights could leave American hands. On 16 October Beijing wrote a chapter of its own. The Ministry of Commerce (MOFCOM) and the Ministry of Science and Technology (MOST) published Announcement No. 48 of 2026, a draft revision of the Catalogue of Technologies Prohibited and Restricted from Export that would add 40 technologies, 23 of them in artificial intelligence. The draft is open for comment until 15 November. One part is not a draft at all: since publication day, anyone exporting a listed technology must first register it with MOFCOM.

The detail that matters most to governments sits in one answer from the ministry. A restricted Chinese model deployed locally on servers outside China, the MOFCOM spokesperson’s Q&A says, falls under technology-export management. Calling the same model through an API does not. That line runs straight through the sovereign-AI deals of the past two years, in which Gulf, Asian and African governments have sought to run capable models on infrastructure they control. Washington dropped its own licence for model weights in 2025. Beijing has now proposed one, and has spelled out that hosting the weights abroad is the act that triggers control.

What Announcement No. 48 controls, and from when

Of the 40 technologies, 23 are in AI (large models, agents, computing clusters and information processing), 12 in photovoltaics and five in biomedicine; the spokesperson says 14 would be prohibited and 26 restricted. Interim registration on MOFCOM’s online platform now applies to four kinds of transaction: transferring a technology’s ownership abroad, licensing it for use abroad, a change of owner or actual controller to a foreign entity, and any other case MOFCOM names. Deals already begun but not completed are covered, and exporters must decide for themselves whether they are in scope. The legal basis is Article 20 of the Foreign Trade Law; the ministry says the revision targets no particular country. The ministry’s statement framed the step as “reinforcing the security bottom line”, the Associated Press reported.

The thresholds are in Annex 1 to the announcement, which AI & GPP read in the Chinese original. Four AI entries, covering six technologies, would be prohibited outright: large models trained on China’s “core data” under the Data Security Law; high-performance agents built for critical infrastructure, defence or core government systems; self-mutating AI-driven malicious code aimed at such systems; and certain deepfake-detection technology. The restricted list matters more to foreign buyers:

• Large models. Models trained on China’s “important data”, and the core technology of any model that passes one of three tests: at least 10²⁶ floating-point operations of training compute, at least 2 trillion parameters, or a global top-ten ranking at the time of export. Core technology explicitly includes weights, key checkpoints, source code and architecture design. The top-ten test draws on public rankings and counts global usage alongside performance, safety and training efficiency, so a popular model can cross the line without growing.
• Agents. Systems that split an instruction into 20 or more executable steps at high accuracy, coordinate 60 or more agents at once, or integrate 200 or more third-party tools.
• Chips and clusters. AI processor design meeting any one of six features, including a 14-nanometre or finer process; some memory-chip design; and interconnect, fault-tolerance and scheduling technology for clusters of more than 10,000 accelerator cards.

Two exclusions limit the reach. Technology already public through open-source release or academic publication would stay outside the catalogue, and products made with a listed technology are not covered. Companies “should assess whether their transactions involving the relevant technologies trigger the new registration requirements”, Ting Peng, a trade-compliance partner at BZW Law Firm in Shenzhen, told The National.

The deployment test: who owns the cloud now decides the paperwork

The ministry applies one test to every way a Chinese AI product goes abroad: does restricted technology move from inside China to outside it? An overseas local deployment of a restricted model does. Serving it through an API, an app, a SaaS product or a lightweight on-device install does not. Automatic licensing, which the ministry likens to report-and-export, is offered for open-source release, for compute centres Chinese firms build and run abroad, for overseas chip tape-out and for joint research. A deployment on an overseas cloud the provider owns, which the ministry regards as relatively controllable, can also qualify.

Read together, these rules favour one model of overseas AI over another. A Chinese provider that runs its frontier model in its own data centre in Riyadh, Jakarta or Nairobi and sells access to a ministry has a light path. A government that wants the weights on its own sovereign cloud, under its own control and audit, is asking for exactly the transaction the catalogue restricts. Sovereign AI has always been about control of the stack; Beijing has now priced that control into the licence.

The open-source exclusion explains why many existing deals are untouched. Saudi Arabia’s state-backed Humain commissioned its Arabic model, Humain-m3, based on an open-source system from MiniMax, Rest of World reported, while building its computing capacity on American silicon: AMD Instinct MI355X systems went live in the kingdom on 31 August, according to an AMD, Cisco and Humain release. As Humain’s Pragmatic Turn: Chinese Weights, American Chips argued, that is a hedge across both blocs, and because the base weights were already public it would sit outside Beijing’s new list. The exposure lies with the next generation of deals: closed frontier versions licensed for on-premises use. The Associated Press named Moonshot’s Kimi K3 and Alibaba’s Qwen 3.8-Max as models above the 2-trillion-parameter line, though the draft names none.

There is a carrot as well as a gate. The ministry promises extra facilitation for exports among members of the World AI Cooperation Organization (WAICO), whose founding agreement 29 countries signed in Shanghai on 16 July 2026, among them Indonesia, Laos, Kazakhstan and Pakistan, Xinhua reported. Membership of a Chinese-led body may now speed a licence. Many capitals keep both doors open: Kazakhstan has joined WAICO and the US-led Pax Silica initiative, and Singapore is weighing an invitation, according to Rest of World. “Many countries around the world, particularly in the Global South, want the best of both worlds,” Kyle Chan of the Brookings Institution told the outlet.

A mirror of Washington’s rule, held up as Washington moves on

The architecture is familiar. In January 2025 the US Bureau of Industry and Security (BIS) issued the Framework for Artificial Intelligence Diffusion (90 FR 4544), which created ECCN 4E091 and required a licence to export the weights of any closed-weight model trained on more than 10²⁶ operations, leaving open-weight models alone. Beijing’s draft uses the same compute figure, the same split between published and unpublished weights and the same view of weights as the asset to control; the spokesperson says China drew on common international practice.

The American rule did not survive. On 13 May 2025 BIS announced its rescission, saying it would have burdened industry and downgraded dozens of countries, and issued guidance on the risks of using Huawei Ascend chips and of letting American chips train or run Chinese models. Congress has since turned to the models themselves: on 29 April 2026 the House Homeland Security Committee and the Select Committee on China opened a joint investigation into Chinese open-weight and API-accessible models, naming DeepSeek, Alibaba, Moonshot AI and MiniMax.

A government running a Chinese model on Nvidia or AMD hardware is therefore squeezed from both sides: Washington scrutinises the chips and the model’s origin, Beijing now controls the weights. The channel described in A Hotline for Machines has not eased this; the Associated Press noted that the announcement came as both governments made progress on an AI safety dialogue and an incident-notification mechanism.

Both sides of the Strait move, while the chip market splits

Taiwan moved in the same week. Economic Affairs Minister Kung Ming-hsin told Bloomberg on 12 October that AI servers and the most advanced chips would join Taiwan’s export-control list, and that unlicensed exports of restricted AI hardware to China would become a crime under the Foreign Trade Act, TechNews reported (in Chinese). He linked the change to Taiwan’s Agreement on Reciprocal Trade with the United States and gave no start date; the USTR fact sheet on the agreement does not mention export controls. Taiwan’s existing entity list cannot reach diversion through front companies, PTS reported (in Chinese) in June; prosecutors in August charged nine people over 130 AI servers, 74 allegedly routed to China, with breach of trust and forgery, Taiwan News reported.

The market these rules govern is splitting in measurable ways. IDC data seen by Reuters, as published by The Edge Malaysia, put Nvidia’s share of China’s data-centre AI accelerator market at 34 per cent in the first half of 2026, on 678,000 units, down 44 per cent year on year, with Huawei at 28 per cent. Non-GPU accelerators, at 1.016 million units, overtook GPUs, at 991,000, and four Chinese suppliers shipped 95 per cent of them. That domestic chip and cluster stack is what Annex 1’s chip-design and 10,000-card cluster items protect. The divide traced in Two Blocs, One Technology now reaches the model licence.

Governments are not well prepared for that. The OECD’s Securing AI compute: Government policy approaches, published on 12 October, finds that 21 of the 47 jurisdictions it examined treat compute as a dedicated strategic pillar, including 13 of the 18 strategies adopted or updated in 2025–26, and that only Canada and the United Kingdom have separate compute strategies. It notes “limited systematic understanding of effective policy levers”. Its subject is capacity: chips, clusters, budgets. Announcement No. 48 shows that the legal status of the models running on that capacity deserves the same attention.

What a ministry hosting a Chinese model should check

The draft may change, and the ministry stresses that most AI technology will stay freely exportable. But registration applies now, and contracts signed this quarter will be delivered under the final catalogue.

Three steps follow before 15 November. Ask Chinese suppliers in writing whether they have registered and how they classify the model on offer. Write licensing risk into contracts: delivery dates, termination rights and who pays if a licence is refused or delayed. And decide where the weights should sit, since this draft makes a host-owned sovereign cloud harder to obtain than access through the vendor’s own data centre. Governments that want a say can file comments with MOFCOM by the deadline.

Then watch three things: the final catalogue and its start date; any US response to Taiwan’s listing and to Beijing’s 10²⁶ line; and whether WAICO membership yields faster licences. “The world is getting more fragmented in trade and investment, but also in access to technologies,” Gary Ng, a senior economist at Natixis, said, according to the Associated Press. For governments that buy AI, that fragmentation now reaches the licence itself.

Questions this answers

Does China’s Announcement No. 48 stop governments using Chinese AI models through an API?
No. The MOFCOM spokesperson says API calls, app or web access, SaaS and lightweight on-device use of a restricted model are not model exports; only overseas local deployment of restricted technology is. (MOFCOM Q&A)

Which Chinese AI models would need an export licence under the draft catalogue?
Annex 1 restricts models trained on China’s important data, and the core technology, including weights, checkpoints, source code and architecture, of models with at least 10²⁶ training operations, at least 2 trillion parameters or a global top-ten ranking at export. Technology already released as open source would stay outside. (Annex 1, MOFCOM)

When do China’s new AI export rules take effect?
Pre-export registration has applied since 16 October 2026, including to transfers under way. Comments close on 15 November 2026; registration runs until the revised catalogue is formally issued and takes effect, for which no date is set. (Announcement No. 48)

Sources

1. 商务部 科技部公告2026年第48号 (MOFCOM/MOST Announcement No. 48 of 2026) — Ministry of Commerce of the People’s Republic of China, 16 October 2026 (in Chinese; translation by AI & GPP)
2. 附件1：拟列入《中国禁止出口限制出口技术目录》的人工智能、生物医药、光伏技术范围（征求意见稿）(Annex 1, draft technology scope) — Ministry of Commerce of the People’s Republic of China, 16 October 2026 (WPS document download; in Chinese; translation by AI & GPP)
3. 商务部新闻发言人就修订《中国禁止出口限制出口技术目录》答记者问 (Spokesperson’s Q&A on the catalogue revision) — Ministry of Commerce of the People’s Republic of China, 16 October 2026 (in Chinese; translation by AI & GPP)
4. China says it will curb tech exports, including AI, citing national security risks — PBS NewsHour (Associated Press), 16 October 2026
5. China targets AI technology exports with new controls as US trade truce frays — The National, 16 October 2026 (updated 17 October 2026)
6. Playing both sides of the U.S.-China AI “Cold War” — Rest of World, 16 September 2026
7. AMD, Cisco and HUMAIN Expand Saudi Arabia’s AI Infrastructure as AMD Instinct Systems Go Live — Cisco Newsroom, 31 August 2026 (company release)
8. 29 countries sign agreement on establishing World AI Cooperation Organization — Xinhua, via english.www.gov.cn, 17 July 2026
9. Framework for Artificial Intelligence Diffusion (90 FR 4544) — Federal Register, Bureau of Industry and Security, 15 January 2025
10. Department of Commerce Announces Rescission of Biden-Era Artificial Intelligence Diffusion Rule, Strengthens Chip-Related Export Controls — Bureau of Industry and Security, 13 May 2025
11. Chairmen Garbarino, Moolenaar Announce Joint Investigation into National Security Risks Posed by PRC AI Models — House Committee on Homeland Security, 29 April 2026
12. 台灣將收緊對中國先進晶片出口，未許可輸出產品將首度列刑事犯罪 (Taiwan to tighten export controls on advanced chips to China) — TechNews 科技新報, 16 October 2026 (in Chinese; translation by AI & GPP)
13. Fact Sheet on U.S.-Taiwan Agreement on Reciprocal Trade — Office of the United States Trade Representative, February 2026
14. 彭博指我擬嚴管高階晶片輸中 經濟部：與美協商共同管制出口 — PTS News Network (公視新聞網), 11 June 2026 (in Chinese; translation by AI & GPP)
15. Taiwan to impose strict controls on AI chip exports to China — Taiwan News, 16 October 2026
16. Nvidia’s China AI-chip share falls as Huawei closes gap, report finds — The Edge Malaysia (Reuters), 13 October 2026 (Reuters report of IDC data)
17. Securing AI compute: Government policy approaches — OECD Policy Briefs, 12 October 2026 (PDF)

Security & Geopolitics desk · 19 October 2026