China drafts its first export rules for frontier AI models and agents

China’s Ministry of Commerce (MOFCOM) and Ministry of Science and Technology issued Announcement No. 48 of 2026 on October 16, proposing to add 40 technologies to the country’s catalogue of technologies prohibited or restricted from export, 23 of them in artificial intelligence. The most immediate fact for anyone building with Chinese models: the catalogue changes are still a draft, but a pre-export registration requirement for the listed technologies is already in effect.

The proposal covers frontier model weights, AI agents, large computing clusters and AI chip design know-how, with explicit technical thresholds. It also draws a line that matters for most developers: according to the ministry spokesperson, serving a model through an API is not a technology export, while deploying it locally abroad is.

What Announcement No. 48 proposes

Across three sectors, the announcement lists 23 items in AI, five in biomedicine and 12 in photovoltaics. A ministry spokesperson’s question-and-answer says 14 of the 40 would be prohibited and 26 restricted. Under China’s technology-trade framework, prohibited technologies may not be exported at all, while restricted technologies require a licence from commerce and science authorities. The Cloud Security Alliance (CSA), citing the newsletter ChinaTalk, notes that licensing is administered by provincial authorities, although central authorities have intervened in prominent cases.

The announcement contains two instruments with different legal status:

• The catalogue additions are a draft, with public comments open from October 16 to November 15.
• The registration requirement applies now, including to exports that have started but are not yet complete.

This is not the first time the catalogue has touched AI. The 2020 revision added personalised recommendation and AI interaction interface technology. That August 2020 revision coincided with the proposed sale of TikTok to a US buyer and was reported as likely to complicate the deal. What is new this time, according to the CSA, is that the draft reaches frontier model weights, agent architectures and AI-enabled offensive cyber capability, with explicit thresholds for each.

Which models cross the frontier threshold

The draft annex defines the “core technology” of a large model to include weights, key checkpoints, underlying source code and architecture, plus training-optimisation and inference-acceleration techniques. That core technology would be restricted if the model meets any one of three tests:

Test	Threshold in the draft
Training compute	At least 10^26 floating-point operations (FLOPs, a count of the arithmetic used in training)
Model size	At least 2 trillion parameters
“Globally leading” capability	Global top 10 in public evaluations by mainstream assessment bodies or large platforms at the time of export
Training data	Restricted if serving after training on “important data”; prohibited if trained on “core data”, as Chinese law classes them

The two descriptions of the ranking test differ slightly. Komposite News describes it as a top-10 position in public evaluations, while the CSA’s summary also includes global call volume or comparable measures. In either reading, the test is assessed at the time of export, so a model’s status could change as leaderboards move.

The draft names no companies or models. How many existing models are caught is disputed. ChinaTalk’s authors estimate that no released Chinese model currently exceeds the 10^26 FLOP threshold, according to the CSA. Separately, The Next Web, citing Bloomberg, reported that some Chinese models already exceed the parameter threshold; Komposite says it has not confirmed which. Because the tests are alternatives, a model below the compute line can still qualify on parameters or ranking.

Agents, chips and clusters are covered separately

The AI annex groups its items into large models, agents, compute clusters, chip design and information-processing technologies.

Agents

Agents are controlled independently of the model they run on. Planning, multi-agent coordination, tool use and game-theoretic decision technologies are restricted above set benchmarks. One example threshold is breaking an instruction into 20 or more sub-tasks. High-performance agents built for critical infrastructure, defence or core government systems would be prohibited outright.

Cyber capability

AI-driven generation of malicious code would be prohibited, and AI-assisted vulnerability discovery restricted.

Chips and memory

Restricted AI chip design know-how, including architectures, instruction sets, IP cores and software stacks, is defined by a list of features, any one of which qualifies. These include a 14-nanometre or finer manufacturing process, 2.5D or 3D advanced packaging, and high-speed interconnects. Some 3D flash and DRAM memory designs are also listed.

Computing clusters

Interconnect, fault-tolerance and scheduling technologies are covered when used in a “large-scale intelligent computing cluster”, which the annex defines as one with more than 10,000 AI accelerator cards.

API access versus custody: what builders need to know

The ministries drew the line around transfers of the technology, not use of the products. For developers outside China who call Chinese models, this is the central point. The spokesperson said that offering a restricted model through an API, an app or website, software-as-a-service or a lightweight on-device deployment is not a technology export. Deploying a restricted model locally overseas is, although a company running it on its own overseas cloud may qualify for automatic licensing.

In practice, that sorts common integration patterns roughly as follows, based on the spokesperson’s description:

• Calling a hosted Chinese model through its API: not an export under the spokesperson’s definition.
• Running restricted weights on your own servers outside China: counts as an export.
• Using already published open-source models: technology already in the public domain through open-source release or academic publication is excluded from management.

The open-weights picture has a second layer. Komposite reports that automatic licensing would also apply to open-sourcing AI technology, to Chinese companies’ own overseas computing centres, to chip tape-out abroad and to joint research, which the ministry describes as close to “report and export immediately”. Read together, existing open releases are outside the rules, while a future open release of a model that meets the thresholds appears to involve a reporting step first. Chinese labs have been active in open releases; Unicorn API recently covered DeepSeek open-sourcing its Super-agent prototype. The sources do not say whether the new process will change the timing of such releases.

Exposure for larger companies goes beyond product exports. Multinationals face it through licensing deals and changes of ownership or control, and analysts read the registration form as potentially capturing intra-group code sharing as well, according to the CSA.

How the registration requirement works today

Until the revised catalogue takes effect, exporters must register on the ministry’s online platform before exporting a listed technology. Registration covers four triggers:

1. Transfer of technology ownership abroad.
2. Licensing of domestic technology for overseas use.
3. A change in ownership or control that makes a foreign entity the owner or controller.
4. Other cases MOFCOM designates.

The form asks for the exporter and recipient, the destination, the technology and its intended use, and the expected export value. The spokesperson said exporters must judge for themselves whether a technology falls within scope. Komposite sums up the current effect as procedural: a Chinese lab that licenses weights, or sells a chip design to a foreign customer, files first, and the consultation will decide what is prohibited outright and what needs a licence.

Beijing’s stated aims and the wider export-control context

The spokesperson described the revision as routine and grounded in Article 20 of the Foreign Trade Law, stressing that it “does not target any specific country, region, or entity”. According to Komposite, the spokesperson said the AI controls are meant to prevent misuse and keep AI under human control.

The proposal did not come without warning. Implicator, relaying the Financial Times, reported in July that the commerce ministry was consulting Alibaba, ByteDance and Zhipu on limits for model weights and chip designs; Reuters said at the time that it could not immediately verify that report.

MOFCOM has used export-control tools in its trade relationship with the United States before. In April 2025 it added 28 US entities to its Export Control List, prohibiting dual-use exports to them, then suspended those measures for 90 days from May 14, 2025 after talks in Geneva. In May 2026, the ministry said Chinese and US trade teams had held in-depth exchanges on export control issues involving rare earths and critical minerals. Announcement No. 48 itself sits under the technology-trade regime, which is separate from the dual-use regime set by the 2020 Export Control Law.

On the US side, ChinaTalk observes that the 10^26 FLOP threshold mirrors the figure used in the 2023 US executive order and the since-rescinded 2025 US AI Diffusion rule. The CSA concludes that frontier AI supply chains now face formal outbound controls from both of the largest AI-producing jurisdictions.

Open questions and what to watch

Several points remain unsettled in the sources:

• The final list. The consultation closes on November 15, and its outcome decides which of the 40 items end up prohibited and which restricted.
• Which models are in scope. Reports conflict on whether any released Chinese model already crosses a threshold, and the ranking test is assessed at the time of export.
• Self-assessment. Because exporters decide for themselves whether a technology is covered, companies that license weights or share code across borders may interpret the scope differently.
• Enforcement. Licensing is handled provincially, with central intervention in prominent cases, so practice may vary.

For builders, the near-term takeaway is narrow. Calling Chinese models through hosted APIs is outside the definition of export, according to the spokesperson. Teams that self-host frontier-scale Chinese weights abroad, license Chinese model technology, or plan deals involving Chinese AI or chip design assets are the ones to watch the final catalogue most closely.