China’s AI export controls turn model weights into political risk

China’s AI export controls could make future model weights, AI agents, and local deployment technologies that a Chinese supplier needs government permission to send abroad.

That does not mean Chinese AI models are suddenly disappearing from APIs and apps. The crucial distinction is between using a service and taking control of the underlying technology. According to the Chinese authorities, APIs, SaaS products, websites, and lightweight on-device models fall outside the export controls for large-model technology. Installing a covered model on your own infrastructure outside China does not.

Here is the catch: The proposed catalog change is still a draft, but the registration requirement is already in force. The government has installed the gatekeeper before it has finally decided exactly who must stand in line. For companies that chose Chinese open-weight models to avoid vendor lock-in and keep data under their own control, that is a rather large warning sign.

What do China’s AI export controls actually introduce?

China’s commerce and technology ministries published Announcement No. 48 on October 16, 2026. It proposes adding 40 technologies to the country’s catalog of technologies prohibited or restricted from export. The official announcement divides them into 23 AI technologies, five biomedical technologies, and 12 photovoltaic technologies.

The proposed catalog rules are open for public comment until November 15, 2026, so they are not the same thing as a finalized export licensing regime. But anyone exporting technology on the list must already register the transaction with China’s Ministry of Commerce, commonly known as MOFCOM, before export. That requirement also covers transfers that had started but were not completed when the announcement took effect.

Registration may be triggered when ownership moves outside China, Chinese technology is licensed for use abroad, or a foreign party obtains ownership or effective control. The risk therefore extends beyond an ordinary sale. Sharing within a corporate group, code placed in a common repository, and an acquisition could also fall into the danger zone, depending on how the rules are interpreted.

Which AI models and agents are covered?

The draft targets technology behind the largest models, not merely finished products. Weights, key checkpoints, source code, architecture, and training or inference methods become restricted if a model meets at least one threshold: 10²⁶ FLOPs used for training, 2 trillion parameters, or a place among the world’s ten leading models based on public rankings, global use, or a similar measure at the time of export.

That final threshold is the most unpredictable. The announcement does not specify which ranking or methodology decides whether a model is in the top ten. A model could sit below both the compute and parameter thresholds and still become regulated because it suddenly performs well or gains widespread use. That is a moving rule, and moving rules are almost the opposite of predictable infrastructure.

AI agents are assessed separately from the model underneath them. The Cloud Security Alliance’s analysis of Announcement 48 summarizes the thresholds as including at least 20 planning subtasks, at least 60 concurrent agents, or integration with at least 200 third-party tools, combined with separate accuracy and completion requirements. An agent system could therefore be covered even when its language model comes nowhere near a frontier-model threshold.

The draft also covers AI-assisted vulnerability discovery, advanced deepfake detection, speech recognition, language processing, AI chip design, and large computing clusters. AI-generated malware and advanced agents designed for critical infrastructure, defense, or core government functions could be completely prohibited from export when the relevant thresholds are met.

API access is not the same as local model weights

For most users, the distribution method matters more than the model’s name. MOFCOM says that API calls, apps, online services, SaaS products, and lightweight local components do not count as exports of the large-model technology itself. If you access a Chinese model through a service still operated by its supplier, the proposed licensing requirement does not automatically apply.

Move the model weights into your own infrastructure outside China, however, and that becomes local overseas deployment. If the model meets the thresholds, the Chinese supplier must obtain a license. The same issue may apply to important updates, new checkpoints, and code required to run the technology.

This turns a familiar security choice on its head. Many companies self-host to keep customer data, source code, and internal documents under their own control. Under this regime, that option could become more politically dependent than an API. You may own the infrastructure and still depend on a government allowing the supplier to send you the next version.

What happens to open-weight models?

Models and other technologies already made public through open source or academic publication should remain outside the export controls, according to MOFCOM’s own explanation. The draft does not pull back weights that are already public.

The picture is less free for new models. Chinese authorities say an open-source release should qualify for an automatic license after reporting. That sounds reassuring until you remember who decides whether the paperwork was completed correctly, whether the model qualifies, and whether the automatic route will still exist for the next release.

The real risk is not primarily that a model you already downloaded will suddenly stop working. It is that the next major version, checkpoint, or agent framework is delayed, changed, or never released internationally. “Open weight” describes what you can obtain today. It promises nothing about what the authorities will let you receive tomorrow.

The largest companies can afford the queue

Chinese authorities describe the controls as precise and limited. They point to automatic licensing for open source, Chinese-owned data centers abroad, and research cooperation. That may reduce friction in some cases, but it does not remove the political switch.

Large companies can hire lawyers, build compliance teams, and maintain direct contact with officials. A smaller model developer that wants to share weights globally, or a Norwegian company trying to determine whether the next checkpoint will arrive, does not have the same machinery. Regulatory gates often work this way: The largest companies walk through carrying a stack of forms, while smaller players wait outside wondering which document they missed.

The rules may also reward services over local control. If APIs can travel freely while weights require a license, the supplier and the state gain more control over where the model runs, who receives updates, and which terms can change. That is bad for competition, independence, and the ability to switch suppliers on your own terms.

What should businesses outside China do now?

Start by separating Chinese services you use through an API from technology you actually run locally. Make a simple inventory of model weights, agent frameworks, security tools, and checkpoints of Chinese origin. Record where they run, how they are updated, and whether the system depends on new files or code arriving from China.

For local models, ask the supplier to confirm in writing whether the export has been registered, whether it expects a license to be required after the final rules are adopted, and whether future updates are covered. Contracts should also state what happens if a license is delayed, made conditional, or withdrawn. A verbal “it will probably be fine” is not a contingency plan.

Then build a real fallback. Agent logic, data access, and workflows should be portable to another model without rebuilding the entire system. That means standardized interfaces, exportable data, tests that can run against several models, and at least one credible alternative outside the same jurisdiction.

Companies with development teams or subsidiaries in China should also review code flows, shared repositories, fine-tuned models, and internal agent tools sent out of the country since October 16. This is legal and technical work at the same time. A lawyer sees the license, while a developer sees what actually crosses the border. You need both.

My view: Treat model access as political risk

China is not alone in using export controls as a tool of technological power. Other governments have already shown how quickly political decisions can become part of model access. That does not make this approach any more elegant. Companies that thought they were choosing technology are, in practice, also choosing which government may intervene in the supply chain.

The biggest problem is not one specific threshold of 10²⁶ training FLOPs or 2 trillion parameters. It is the combination of a top-ten criterion that can move, agent architectures regulated by behavior, and registration beginning before the catalog is final. Predictability gives way to discretion, paperwork, and political permission.

I would not build a critical workflow around the promise that new Chinese model weights will always keep coming. Use strong models where they create value, but preserve your ability to switch. Once the state places itself between the developer and the user, avoiding vendor lock-in is no longer merely sound technical architecture. It is risk management.

Frequently asked questions