loading
loading
In the AI race thus far, openness has been China’s secret sauce. As fast followers to the frontier, Chinese AI companies have gained trust by publicizing their weights and architectures. And at the cost of revenue, they have achieved global adoption, brand recognition, and a truly competitive dynamic with American labs. Last week, China’s Ministries of Commerce (MOFCOM) and Science and Technology (MOST) jointly proposed expanding China’s catalogue of export-controlled technologies, with most of the proposed regulations taking aim at subsets of China’s AI industry. Regulators will spend a month taking comments on the draft before anything becomes law, but we can already learn a ton from this announcement in its current form. Does Beijing want to hold back the tides of open models? Why is MOFCOM writing these rules now, and what does this say about the Chinese government’s appetite for AI-enabled risks versus growth? To find out, we spent three days poring over the draft regulations — so you don’t have to! What’s ahead: - How these rules came to be — and how this draft is already affecting the Chinese AI industry; - What the proposed rules mean for frontier models, chip design, memory, cybersecurity, AI content detection, and even China’s minority languages; - Who actually decides which export licenses get approved, and the balance of power between provincial and central authorities; - What these rules tell us about Beijing’s expectations for AI development. Today, we’re just focusing on the AI-related regulations, but a future piece tackling everything else — from this announcement’s proposed restrictions on PV cells and gene therapies, to other recent announcements on port dredgers and tunnel borers — is in the works! Subscribe so you don’t miss it: The Road to a Rule Since 2001, MOFCOM has made regular additions to the Catalogue of Technologies Prohibited or Restricted from Export 中国禁止出口限制出口技术目录. In recent years, this catalogue has basically served to list the technologies for which China’s dominance in global production affords them leverage over the rest of the world — a toolbox of weaponizable dependencies, if you will. In the last several years, this has mostly meant processing and manufacturing technologies for rare earths, magnets, and battery materials. Now China has decided AI models belong on that list as well. On October 16, MOFCOM released Announcement 48 of 2026, detailing 40 new additions to the Catalogue and, effective immediately, requiring pre-export registration of all 40 additions in the interim. Of these 40 additions, 14 are outright export prohibitions (J codes), while 26 are export restrictions requiring licenses (X codes).1 While these 40 additions have garnered the majority of public attention, equally important is the section of the announcement creating an interim pre-export registration system. From last Friday to the date that the revised Catalogue takes effect, any technology exporter must register any exports of technologies among the above additions prior to export, including exports that have already begun but not yet completed (已经开始但尚未完成). There is no precedent in any earlier catalogue revision for the creation of an interim registration regime announced with draft additions. Beijing is creating a better dataset so that it can make an informed final decision on what to license. Under Announcement 48, registration is required for a Chinese company hoping to: 1) assign ownership of the technology abroad, like in the case of an IP sale, 2) license domestic technology abroad, 3) change the owner or actual controller of domestic technology to a foreign entity, or 4) do anything else that MOFCOM later decides to specify. The triggers for registration also suggest that MOFCOM is testing what mechanisms will ultimately be used for classification of an AI export. An AI model is not a physical item like a gallium ingot, so the question of what constitutes export is less clear. This third trigger effectively codifies the Manus case. In December 2025, Meta signed a deal to purchase Manus, a Chinese agent startup that had moved to Singapore, but following MOFCOM review, a security review led by the NDRC led to the deal being reversed. Now, rather than relying on investment review authority, similar deals would require a license on export control grounds, and redomiciliation would not let a company escape Chinese jurisdiction. In the registration form provided with the announcement, MOFCOM asks for standard information like the recipient, technology code, user and end use, and secrecy grade. It also asks for specific circumstances of exports not made under contract (不依据合同出口的具体情形). This forces exporters to judge for themselves whether they should report a potential action, and may point to open-sourcing and sharing code within a group. IP and National Security These rules fall into two categories: controls that protect intellectual property (IP), and controls that protect state security. To Xi Jinping, these are not separate justifications. As he explained during a 2020 study session speech, “Intellectual property protection weighs on national security; only by strictly protecting intellectual property can we effectively safeguard our country’s independently developed key core technologies and prevent and resolve major risks.” (“知识产权保护工作关系国家安全，只有严格保护知识产权，才能有效保护我国自主研发的关键核心技术、防范化解重大风险。”) We’ll start with the controls that seem primarily IP-focused (frontier models, AI chip design, memory chips, and clusters), then move on to controls in the middle (AI-generated content detectors and agents), and finish on the primarily state security-focused controls (training data, cyber capabilities, and in a suprise addition minority languages!). Controls by Type Frontier models When you use a frontier U.S. model, you are accessing the software without getting a peek at the fundamental structure behind the curtain, and thus closed models can be used without directly leaking IP. Most of China’s domestic AI champions, however, publish open weight models, meaning that the user can see the structure of the model, and much of the IP is fundamentally public. Open weight, though, does not mean open source, and the training data, preprocessing pipelines, and training code remain behind the curtain. MOFCOM proposes to require licenses for the export of both weights and core private IP, including key checkpoints, underlying source code, architecture design, and technology for training optimization and inference acceleration. The regulation controls the core technology of a large model that exceeds any of the following three thresholds: ≥1026 floating point operations, ≥2T parameters, or “global leading capability” 能力达到全球领先水平. We discuss each threshold here: - ≥1026 floating point operations (FLOPs) The number of floating point operations (FLOP) is a common measure of the raw compute used to train an AI model, and is thus often a good proxy for model performance. The minimum cutoff listed in this MOFCOM announcement is identical to the figure originally mentioned in a 2023 Biden executive order, which was later used in the January 2025 AI Diffusion rule (US ECCN 4E091) that was rescinded in May 2025. This is also the same threshold as California SB 53. In its follow-up Q&A, MOFCOM mentioned “referencing internationally accepted standards” 参考国际通行做法 while drafting these proposed catalogue additions. As of October 20, 2026, no released Chinese model is estimated to have crossed this bar. The Chinese models with the largest training compute sit at roughly 2x1025 FLOP, according to Epoch AI. China remains compute-constrained compared to the United States. - ≥2T parameters The number of parameters in a model is the overall size of the model, which is a rough proxy for its capability. As of now, per Epoch AI, only four Chinese models since mid-2024 (Kimi K3, ERNIE 5.0, Qwen 3.8 Max, and Qwen3.8-2.4T-A95B) cross this threshold. No models from DeepSeek, Meituan, Xiaomi, or Z.ai exceed two trillion parameters, but all have models above or near one trillion parameters, and it is reasonable to expect their next releases to cross that threshold. As the Q&A clarified, the restriction does not cover tech that is already public via open weights or literature, so there is an incentive for companies to rush new releases that would exceed the thresholds before the rule is final (I do wonder how MOFCOM feels about DeepInfer, probably positively but did they get the nod beforehand?). This test is especially important for Chinese labs as China is compute constrained, and compute-scarce labs often use a design called Mixture of Experts (MoE), creating large models that only activate a small fraction of their network for any given task. If you measure these models by FLOPs used in training, it undercounts their power and makes them look weaker than they are. Total parameters, while a much better proxy for the Chinese frontier, has a potential weakness: the number of parameters is a design choice, so labs could try to game it by releasing models that slide under the 2T threshold. - Global leading level This category is by far the most up-for-interpretation. The note states that the bar is the global top 10 through public evaluations from “mainstream domestic and foreign testing organizations and large-scale industrial platforms” 国内外主流测评机构，大规模产业平台 across “overall performance, specialized operational capabilities, global call volume, safety performance, training efficiency or others” 综合性能，专项业务能力，全球调用量，安全性能，训练效率， 等. This definition allows the rule to cover a wide range of models. The rule does not name a ranking body, and, in practice, different AI ranking bodies frequently disagree on their ordering as they use different tests and rating algorithms. Likewise, the rule would potentially affect any model that was in a top-10 list on any one dimension, even if the criteria were narrow. The mention of call volume also has the potential to pull in weaker models that are used in high volume for easier tasks. Given that the status is judged at time of export, it is likely that the same model could jump off or on a leaderboard between subsequent exports without the model itself changing. The carve-out for already-released open source models means that published weights are out of the scope of this control, but closed-weight model companies hoping to license existing models to foreign firms and future releases by open-weight companies would still be restricted under the proposed rule. Just because a model is open weight, it does not mean it is open source. Open weight companies still hold private know-how, and this IP related to training is directly controlled by a clause mentioning training optimization and inference acceleration 训练优化、推理加速. Open sourcing a restricted model is a controlled export and would get an automatic license. AI chip design The announcement proposes restricting the export of AI chip design that checks off at least one of the following boxes: - requires a manufacturing process of 14 nm or below; - is able to do floating-point or integer arithmetic; - uses advanced 2.5D or 3D packaging to integrate multiple dies; - has high-speed interconnect capacity; - has an architecture integrating memory and compute; - or is used in autonomous driving, computer vision, or speech. The inclusion of any chips with floating-point or integer arithmetic capabilities 具备浮点或整型运算能力 means that this covers almost all digital chips, including all AI chips, which suggests either a drafting error or an extremely wide breadth (MOFCOM will probably be getting some polite letters around this clause…). Likewise, all AI chips used in datacenters require high-speed interconnect capability to interface with other chips and memory. The inclusion of architectures that integrate memory and compute is also noteworthy. Traditionally, AI chips use von-Neumann architecture, where memory and compute are housed separately and data moves back and forth between the processor and the memory. This shuttling of the data wastes energy, however, and technologies like in-memory and neuromorphic computing, explicitly mentioned in the announcement, eliminate this energy loss and allow for greater parallelism. Non-von-Neumann architectures would also potentially allow China to circumvent its shortage of traditional high-bandwidth memory (HBM). While these technologies have seen limited deployment in datacenters because the technology is immature and lacks a mature software ecosystem, they have been used in smaller research data centers and are used in robotics, drones, and autonomous vehicles. China is highly competitive across these three sectors. Indeed, when paired with the direct inclusion of chips used in autonomous driving and computer vision, this gestures to a strategic vision. For Beijing, protecting its advantage in memory-integrated chips could help it plan a future data center build-out that is not dependent on Western memory supply chains. This forward-looking export control on a technology that has not yet picked up real adoption is also reminiscent of the FCC’s own Robot Ban. No one is really sure whether these technologies will take off, but given they are not yet widespread, the easiest time to restrict them is now. The market being hit is minimal, and companies that design such chips don’t have large vested interests to protest against the rule. In the case that non-von-Neumann architectures find commercial viability in the future, China will not have to worry about the US profiting off designs and IP; that door would have already been shut. This restriction, and the following restriction on memory chip technology, does not restrict the chips themselves. Chinese companies remain free to sell AI chips and the memory used in data centers to U.S. companies. The restriction instead applies to the intellectual property associated with these chips, allowing Beijing to have a say in patent deals with foreign companies. This design control can also be construed as MOFCOM disallowing Chinese companies from fabbing their designs at TSMC or other companies. While BIS has attempted to play the cat-and-mouse game to prevent Chinese AI chip designers from covertly sending their designs to TSMC, MOFCOM may be cracking down on Chinese companies itself. Time will tell how the rule ultimately gets enforced: is it more about protecting Chinese designs, or forcing Chinese designers to work with Chinese, not Taiwan or American, fabs? Memory chips This MOFCOM announcement further focuses on memory with its proposed restriction of memory chip design technology export. This restriction’s use of an “any of the following” structure creates a broad category under the guise of narrow delineations. The restrictions on 3D flash (long-term memory) and DRAM (short-term, working memory) design are not AI-specific, capturing much of the memory work at YMTC and CXMT. For a brief refresher on memory, see Aqib’s excellent primer on Chinese HBM. Many of the limbs of the restriction allow broad interpretation. For both types of memory, the proposed addition would require export licenses for all memory that uses bonding technology to join separately made chip layers. This would cover every flash chip made by YMTC as well as almost all HBM chips, which are further covered by the mention of any chips using multi-layer stacking. For flash, the announcement includes density (8 Gb/mm2) and speed (1.5 Gbps I/O) minima that both fall well below current mainstream chips. Likewise, for DRAM, the restriction would apply to any designs requiring a manufacturing process below 18 nm, which would include almost all CXMT DRAM. These numbers are copied over directly from Biden-era regs. The 18 nm DRAM cutoff is the exact threshold used by the U.S. Department of Commerce’s Bureau of Industry and Security (BIS) October 2022 export controls on memory! This BIS control also included a line on flash, restricting chips with 128 layers or more. When converted from layers to density,2 this is almost exactly the limit proposed in this MOFCOM announcement. On the surface, this symmetry with Washington can be seen as preparing a ready-made defense for these restrictions as “standard international practice.” This can also be viewed, however, as fencing off the IP that China has built in the last four years because of those BIS controls — a protection of the dividend from its forced indigenization of these technologies. Another inclusion worth noting is DRAM technology that uses vertical channel transistors (VCT). Where traditional memory cells are laid flat, in VCT the cells are stood upright, allowing for more memory in the same space without requiring higher precision lithography. China has invested heavily in this technology, as it presents a potential to circumvent Western denial of access to fabrication technologies like EUV. Indeed, in the week before the draft, CXMT announced that it would release a VCT design that shrinks the footprint of each memory cell from the mainstream level by a third by the end of 2026. This prompted a drop in the stock prices of both Samsung and SK hynix, both of which have targeted 2028 for their release of VCT memory. Both Samsung and SK hynix could have pursued VCT earlier but ultimately decided to squeeze more juice out of EUV before turning to VCT. When they do transition, however, the process will inevitably take time as the companies struggle to reach appropriate yield with a new design. China does not want to give the big memory makers any shortcut with that trial and error, as China has learned from the footsteps of other companies. By controlling VCT, China is hoping that the Korean companies will face the same yield struggles as CXMT. Clusters US chip controls have forced China to compete through workarounds, and now, Chinese firms have gotten good enough at engineering whole alternative systems for compute that the government believes they have domestic IP worth protecting. Areas where China could have a comparative advantage include wiring many weaker chips into superPoDs like Huawei’s CloudMatrix 384, engineering systems to keep running through failures, and mixing Nvidia and domestic fleets as one. This corresponds directly to this announcement’s proposed restriction on the export of technology relating to large clusters (≥10,000 AI accelerators) with either fast interconnect (≥800 GB/s), fast recovery from failures (≤120 s), high scaling efficiency (≥98%), or unified scheduling across chips from at least two vendors. This rule would protect such comparative advantages by giving automatic licenses to self-built, self-operated overseas data centers of Chinese firms, while exercising real bureaucratic scrutiny over prospective sales of the tech and IP licensing agreements. That could be used to push companies in the Gulf and Southeast Asia to rent Chinese compute rather than buy it, as the hardware could be freely sold but the know-how to build or run them without Chinese engineers is gated by the licensing desk. Even though China doesn’t have enough chips today to export, this would seem to make the ‘Chinese stack’ less attractive going forward. Agents The proposed agent restrictions were inspired by the debacle with Meta’s attempted acquisition of Manus, aiming to formalize the authority to block future transactions. Chinese firms already sell agent products abroad (from well-known tools like Manus and Kimi, to specialized platforms like Alibaba’s Accio Work), and they could continue to do so under the proposed changes — but they will now need a license to allow the client to host and manage the agent reasoning loop in their own environment. The agent capabilities that trigger the restrictions (autonomous planning/task decomposition, multi-agent collaboration, and tool use) are not necessarily unique to Chinese firms, and the thresholds in each of these qualifying capabilities seem somewhat arbitrary (e.g., integration of 200 third-party tools). But the Manus sale indicates that Chinese firms do have valuable IP when it comes to agents, so we can think of these controls as applying to the specific architectures that enable Chinese agent products to hit these thresholds while keeping costs comparatively low. The fourth capability proposed for export restriction is “AI decision-making technology for strategic interactions” (人工智能博弈决策技术), e.g., wargaming and game-theoretic AI.3 Controlling those capabilities is, of course, more in line with the state security justification than with IP protection. Multiagent collaboration tech would be restricted if the overall task completion time is at most “two times the minimum completion time of a single agent” (“整体任务完成时间≤单智能体最低完成时间2倍”). We’re wondering if that wording is intentional, as it allows the multi-agent system to be twice as slow as a single agent. Technical folks, are we missing something here? We’ll be watching to see if this wording makes it into the final draft. AI-generated content detection tools The proposed controls also cover exports of advanced AI-generated content (AIGC) detectors. Detection tools with accuracy above 98% are in the restricted category and will be exportable with a license. But detection tools used by Chinese authorities, in relation to national security threats and content entering China from abroad, are outright prohibited from being exported if their accuracy rate exceeds just 95%. The exact wording covers tools that are “specifically or primarily used to prevent and address security risks in China’s cross-border network-data transmission” “专门或者主要用于我国网络数据跨境传输安全风险防范和处置” — data security seems to be the most important threat. This makes intuitive sense: proprietary censorship tools used by state authorities are presumably trained on sensitive data, so as to be able to detect content that Beijing deems noteworthy. Therefore, exports of these tools run the risk of leaking political secrets or enabling an adversary to reverse-engineer AI-generated political content that these tools are less likely to detect. But why require export licenses for AIGC detectors not used by the government? To Lily, it seems MOFCOM believes that China could have valuable IP here. Chinese social media platforms are, in theory, required by law to detect and label AIGC, so perhaps this is an area where Chinese companies are doing hardcore innovation and will eventually develop commercially competitive products. RedNote has published research on AI image detection, although it’s not clear how much of their AIGC detection algorithms for audio, video, and images are developed in-house vs. by an external model maker. Other platforms are similarly tight-lipped about their AIGC labeling systems. Curiously, few competitive AI-generated text detectors have come out of China: even a recent state media editorial on AIGC, reprinted by Xinhua, mentioned Pangram and GPTZero as example detectors, seemingly unable to name local equivalents. So congratulations to Pangram on ascending to national security crown jewel status. Ceding the international market would be bad news for profitability and product quality. If authorities are restrictive in licensing detection products — or if there is a risk your license won’t be renewed because your detection algorithm became so good that the government decided to start using it — that could make tech companies hesitant to spend resources improving these tools. Training data In addition to restricting the export of large models, the proposed revisions to the Catalogue cover all AI models trained on sensitive data, regardless of size or performance. The inclusion logic here rests on security rather than IP. Model weights hold the potential to act as a channel to move data outside of China, so Beijing plans to regulate them as an extension of China’s existing rules on data leaving the country. The rule completely bans the export of models trained on “core data” 核心数据, and restricts the export of those trained on “important data” 重要数据. These categories come from China’s Data Security Law. “Core data” includes any data on national security, economic lifelines, important livelihoods, or major public interests 关系国家安全、国民经济命脉、重要民生、重大公共利益. “Important data,” on the other hand, is left for “relevant regions and departments” to define and catalogue. It seems unlikely that Chinese AI companies have been training their open models on highly sensitive “core” data that only the government can supply, given data leakage risks that Beijing no doubt is aware of. The category of “important” data, however, is more nuanced. In the 2024 cross-border data-flow provisions, the Cyberspace Administration of China (CAC) advises firms handling data that, unless previously notified that the data in question is considered “important,” submitting it for the official outbound-data security assessment is unnecessary. Technically, then, since the government is supposed to notify companies about “important” status, AI companies should already know which pieces of data in their training corpora are “important.” Will they need to exclude this data from future training runs, or will getting licensed be easy enough? And how will this work in practice — will training runs on overseas compute clusters be cut off, or allowed to continue as they do today? … Minority languages? Finally, included in the list of restricted AI technologies are translation technologies that pass a certain fidelity score threshold for “Chinese and ethnic minority languages,” as well as voiceprint recognition technologies with “specialized optimization capabilities … in ethnic minority languages or specific regional dialects”. At first, this seems like an odd addition to a list focused on technical capabilities. But the politics of language in China help explain this rule, as well as further contextualizing how Beijing understands AI safety. There are at least 80 minority languages in China, spoken by the country’s various non-Han ethnic groups. Additionally, Chinese itself is a blanket term for at least seven language varieties and their own dialects. Beijing’s censorship and information security apparatuses are optimized for standard Mandarin Chinese, but show cracks for other languages. During the Covid-19 pandemic, for example, netizens found they could express frustrations with government policies when they typed internet posts in Cantonese. Various Chinese academic institutions have researched natural language processing for minority languages, with the help of state funding. Peking University, for example, built MC2, a corpus specialised in Tibetan, Uyghur, Kazakh and Mongolian. Other state-funded efforts have worked on tokenizers for these languages. Given the political sensitivity of these ethnic groups, Beijing may believe that providing AI tools customized for their languages will bring them closer to the Party’s values — and failing that, enable authorities to more effectively monitor dissent. Knowledge of niche languages has come into use in times of conflict. During WWII, Navajo members of the US Marines used their own unwritten language to create unbreakable code, helping the US win in the Pacific Theater. Perhaps the Chinese versions of the Navajo code talkers will speak Tujia! Cyber capabilities MOFCOM has proposed restrictions as well as separate prohibitions on distinct sets of cyber capabilities. First, the prohibitions. Exports of “[AI-driven] malicious code generation and mutation technologies” that “may be used to attack highly sensitive systems such as national critical information infrastructure, national defense and military industry, and core government affairs, or to bypass national security defense systems (“可被用于攻击国家关键信息基础设施、国防军工、核心政务等高敏感系统，或用于绕过国家安全防御体系”) are prohibited if they meet any one of three relatively high capability thresholds in offensive cyber attacks.4 Separate prohibitions apply to anti-virus evasion and adaptive evasion technologies (i.e., techniques for circumventing security tools and modifying malware as it runs) that could be used to threaten state security and meet specific technical thresholds. On the other hand, the proposed restrictions apply to “vulnerability discovery technologies,” i.e., AI that can identify exploits in code the way Mythos did. But in this category, the restrictions kick in if any one of six low-to-medium-difficulty technical thresholds5 is met. That is to say, the bar for requiring a license is much lower than Mythos-level competence. That suggests that the Chinese government is wary about going down a “let it rip” timeline, as we concluded earlier this year when thinking through the Chinese Mythos moment. We may be entering an era of cyber-exploit abundance thanks to AI tools outside China’s control, but leadership at MOFCOM still would seemingly like to prevent Chinese AI technology from causing a devastating attack — or a PR crisis. The unfortunate thing about cyber, of course, is that defensive and offensive capabilities largely overlap. You can try to limit offensive capabilities by teaching the model to refuse fishy prompts, but safeguards can be circumvented as long as code-patching competence is preserved. How will MOFCOM enforce the rules? The letter of the proposed rules tells us nothing about how the automatic licensing mechanism would work — it is a new regulatory mechanism that has yet to be defined. That means the officials responsible for evaluating export license applications may not yet have subject-area expertise or longstanding relationships with AI labs. Industry has the opportunity to submit comments on the proposal until November 15th, 2026. On paper, export licenses are handled by the provincial commerce authority in the exporter’s locality “in conjunction with the [provincial] science and technology authority” (“省级商务主管部门会同科技部门审查”) rather than being approved or denied by MOFCOM.6 In practice, however
In the AI race thus far, openness has been China’s secret sauce. As fast followers to the frontier, Chinese AI companies have gained trust by publicizing their weights and architectures. And at the cost of revenue, they have achieved global adoption, brand recognition, and a truly competitive dynamic with American labs. Last week, China’s Ministries of Commerce (MOFCOM) and Science and Technology (MOST) jointly proposed expanding China’s catalogue of export-controlled technologies, with most of the proposed regulations taking aim at subsets of China’s AI industry. Regulators will spend a month taking comments on the draft before anything becomes law, but we can already learn a ton from this announcement in its current form. Does Beijing want to hold back the tides of open models? Why is MOFCOM writing these rules now, and what does this say about the Chinese government’s appetite for AI-enabled risks versus growth? To find out, we spent three days poring over the draft regulations — so you don’t have to! What’s ahead: - How these rules came to be — and how this draft is already affecting the Chinese AI industry; - What the proposed rules mean for frontier models, chip design, memory, cybersecurity, AI content detection, and even China’s minority languages; - Who actually decides which export licenses get approved, and the balance of power between provincial and central authorities; - What these rules tell us about Beijing’s expectations for AI development. Today, we’re just focusing on the AI-related regulations, but a future piece tackling everything else — from this announcement’s proposed restrictions on PV cells and gene therapies, to other recent announcements on port dredgers and tunnel borers — is in the works! Subscribe so you don’t miss it: The Road to a Rule Since 2001, MOFCOM has made regular additions to the Catalogue of Technologies Prohibited or Restricted from Export 中国禁止出口限制出口技术目录. In recent years, this catalogue has basically served to list the technologies for which China’s dominance in global production affords them leverage over the rest of the world — a toolbox of weaponizable dependencies, if you will. In the last several years, this has mostly meant processing and manufacturing technologies for rare earths, magnets, and battery materials. Now China has decided AI models belong on that list as well. On October 16, MOFCOM released Announcement 48 of 2026, detailing 40 new additions to the Catalogue and, effective immediately, requiring pre-export registration of all 40 additions in the interim. Of these 40 additions, 14 are outright export prohibitions (J codes), while 26 are export restrictions requiring licenses (X codes).1 While these 40 additions have garnered the majority of public attention, equally important is the section of the announcement creating an interim pre-export registration system. From last Friday to the date that the revised Catalogue takes effect, any technology exporter must register any exports of technologies among the above additions prior to export, including exports that have already begun but not yet completed (已经开始但尚未完成). There is no precedent in any earlier catalogue revision for the creation of an interim registration regime announced with draft additions. Beijing is creating a better dataset so that it can make an informed final decision on what to license. Under Announcement 48, registration is required for a Chinese company hoping to: 1) assign ownership of the technology abroad, like in the case of an IP sale, 2) license domestic technology abroad, 3) change the owner or actual controller of domestic technology to a foreign entity, or 4) do anything else that MOFCOM later decides to specify. The triggers for registration also suggest that MOFCOM is testing what mechanisms will ultimately be used for classification of an AI export. An AI model is not a physical item like a gallium ingot, so the question of what constitutes export is less clear. This third trigger effectively codifies the Manus case. In December 2025, Meta signed a deal to purchase Manus, a Chinese agent startup that had moved to Singapore, but following MOFCOM review, a security review led by the NDRC led to the deal being reversed. Now, rather than relying on investment review authority, similar deals would require a license on export control grounds, and redomiciliation would not let a company escape Chinese jurisdiction. In the registration form provided with the announcement, MOFCOM asks for standard information like the recipient, technology code, user and end use, and secrecy grade. It also asks for specific circumstances of exports not made under contract (不依据合同出口的具体情形). This forces exporters to judge for themselves whether they should report a potential action, and may point to open-sourcing and sharing code within a group. IP and National Security These rules fall into two categories: controls that protect intellectual property (IP), and controls that protect state security. To Xi Jinping, these are not separate justifications. As he explained during a 2020 study session speech, “Intellectual property protection weighs on national security; only by strictly protecting intellectual property can we effectively safeguard our country’s independently developed key core technologies and prevent and resolve major risks.” (“知识产权保护工作关系国家安全，只有严格保护知识产权，才能有效保护我国自主研发的关键核心技术、防范化解重大风险。”) We’ll start with the controls that seem primarily IP-focused (frontier models, AI chip design, memory chips, and clusters), then move on to controls in the middle (AI-generated content detectors and agents), and finish on the primarily state security-focused controls (training data, cyber capabilities, and in a suprise addition minority languages!). Controls by Type Frontier models When you use a frontier U.S. model, you are accessing the software without getting a peek at the fundamental structure behind the curtain, and thus closed models can be used without directly leaking IP. Most of China’s domestic AI champions, however, publish open weight models, meaning that the user can see the structure of the model, and much of the IP is fundamentally public. Open weight, though, does not mean open source, and the training data, preprocessing pipelines, and training code remain behind the curtain. MOFCOM proposes to require licenses for the export of both weights and core private IP, including key checkpoints, underlying source code, architecture design, and technology for training optimization and inference acceleration. The regulation controls the core technology of a large model that exceeds any of the following three thresholds: ≥1026 floating point operations, ≥2T parameters, or “global leading capability” 能力达到全球领先水平. We discuss each threshold here: - ≥1026 floating point operations (FLOPs) The number of floating point operations (FLOP) is a common measure of the raw compute used to train an AI model, and is thus often a good proxy for model performance. The minimum cutoff listed in this MOFCOM announcement is identical to the figure originally mentioned in a 2023 Biden executive order, which was later used in the January 2025 AI Diffusion rule (US ECCN 4E091) that was rescinded in May 2025. This is also the same threshold as California SB 53. In its follow-up Q&A, MOFCOM mentioned “referencing internationally accepted standards” 参考国际通行做法 while drafting these proposed catalogue additions. As of October 20, 2026, no released Chinese model is estimated to have crossed this bar. The Chinese models with the largest training compute sit at roughly 2x1025 FLOP, according to Epoch AI. China remains compute-constrained compared to the United States. - ≥2T parameters The number of parameters in a model is the overall size of the model, which is a rough proxy for its capability. As of now, per Epoch AI, only four Chinese models since mid-2024 (Kimi K3, ERNIE 5.0, Qwen 3.8 Max, and Qwen3.8-2.4T-A95B) cross this threshold. No models from DeepSeek, Meituan, Xiaomi, or Z.ai exceed two trillion parameters, but all have models above or near one trillion parameters, and it is reasonable to expect their next releases to cross that threshold. As the Q&A clarified, the restriction does not cover tech that is already public via open weights or literature, so there is an incentive for companies to rush new releases that would exceed the thresholds before the rule is final (I do wonder how MOFCOM feels about DeepInfer, probably positively but did they get the nod beforehand?). This test is especially important for Chinese labs as China is compute constrained, and compute-scarce labs often use a design called Mixture of Experts (MoE), creating large models that only activate a small fraction of their network for any given task. If you measure these models by FLOPs used in training, it undercounts their power and makes them look weaker than they are. Total parameters, while a much better proxy for the Chinese frontier, has a potential weakness: the number of parameters is a design choice, so labs could try to game it by releasing models that slide under the 2T threshold. - Global leading level This category is by far the most up-for-interpretation. The note states that the bar is the global top 10 through public evaluations from “mainstream domestic and foreign testing organizations and large-scale industrial platforms” 国内外主流测评机构，大规模产业平台 across “overall performance, specialized operational capabilities, global call volume, safety performance, training efficiency or others” 综合性能，专项业务能力，全球调用量，安全性能，训练效率， 等. This definition allows the rule to cover a wide range of models. The rule does not name a ranking body, and, in practice, different AI ranking bodies frequently disagree on their ordering as they use different tests and rating algorithms. Likewise, the rule would potentially affect any model that was in a top-10 list on any one dimension, even if the criteria were narrow. The mention of call volume also has the potential to pull in weaker models that are used in high volume for easier tasks. Given that the status is judged at time of export, it is likely that the same model could jump off or on a leaderboard between subsequent exports without the model itself changing. The carve-out for already-released open source models means that published weights are out of the scope of this control, but closed-weight model companies hoping to license existing models to foreign firms and future releases by open-weight companies would still be restricted under the proposed rule. Just because a model is open weight, it does not mean it is open source. Open weight companies still hold private know-how, and this IP related to training is directly controlled by a clause mentioning training optimization and inference acceleration 训练优化、推理加速. Open sourcing a restricted model is a controlled export and would get an automatic license. AI chip design The announcement proposes restricting the export of AI chip design that checks off at least one of the following boxes: - requires a manufacturing process of 14 nm or below; - is able to do floating-point or integer arithmetic; - uses advanced 2.5D or 3D packaging to integrate multiple dies; - has high-speed interconnect capacity; - has an architecture integrating memory and compute; - or is used in autonomous driving, computer vision, or speech. The inclusion of any chips with floating-point or integer arithmetic capabilities 具备浮点或整型运算能力 means that this covers almost all digital chips, including all AI chips, which suggests either a drafting error or an extremely wide breadth (MOFCOM will probably be getting some polite letters around this clause…). Likewise, all AI chips used in datacenters require high-speed interconnect capability to interface with other chips and memory. The inclusion of architectures that integrate memory and compute is also noteworthy. Traditionally, AI chips use von-Neumann architecture, where memory and compute are housed separately and data move
document fetched 2026-10-24 11:22 · canonical https://chinatalk.media/p/mofcoms-new-ai-rules