China moves to control AI exports - but leaves open-source outside

What is in force today, and what is only proposed

This distinction is doing most of the work in this story, and almost every summary of it has blurred the two together.

In force now. An interim pre-export registration requirement, under Announcement No. 48 of 2026. Before exporting any of the listed technologies, a company must register the export on the Ministry of Commerce's technology trade management platform. It applies from the date of the announcement until the revised catalogue takes effect, and it covers transferring ownership of a technology abroad, licensing a domestic technology for overseas use, a change of ownership or control to a foreign entity, and exports already in progress but not yet completed.

Proposed only. Everything else. The restrictions themselves are a draft revision of the Catalogue of Technologies Prohibited and Restricted from Export, issued by the Ministry of Commerce and the Ministry of Science and Technology, open for public comment until 15 November 2026.

So nothing is yet prohibited that was not prohibited last week. What exists today is a reporting obligation - but a reporting obligation that is live, mandatory, and attached to the same list of technologies the draft would later restrict.

That is not a small thing. It means Beijing already knows who is exporting what, several months before deciding what to do about it.

What is actually on the list

The draft adds 40 technologies across three fields: 23 in artificial intelligence, 5 in biomedicine and 12 in photovoltaics. Of the 40, 14 are proposed for outright prohibition and 26 for restriction, which means they would require a licence rather than being banned.

The 23 AI entries cover large models, intelligent agents, computing clusters and information-processing technologies. Model weights and source code are included where the underlying product exceeds specified performance thresholds.

Two entries are worth separating out, because they are the clearest statement of what Beijing considers dangerous rather than merely valuable:

• Proposed for prohibition: AI-driven technology for generating and mutating malicious code.
• Proposed for restriction: AI-assisted vulnerability mining.

Note the asymmetry. Finding security holes is treated as a licensable capability with legitimate uses. Automatically writing and rewriting malware is treated as something that should not leave the country at all. That is a judgement about offence and defence, and it is a more precise one than most national AI policy has managed.

The ministry's own framing is that the revision is routine, reflects the spread of these technologies into sensitive fields, and is not aimed at any particular country, region or entity.

The open-source carve-out is real, and narrower than it sounds

The most quoted part of this announcement is that open-source AI is excluded. That is accurate, and it comes from the ministry's own policy explanation rather than from commentary: technologies already in the public domain through open-source release or academic publication are proposed to sit outside the scope of control entirely. Exports of open-source AI technology are also listed among the cases that could qualify for automatic licensing.

Taken alone, that reads like a significant hole. A government restricting frontier AI exports while leaving the open-weight route open has arguably restricted very little, given that the most consequential Chinese model releases of the past two years have been open-weight ones.

But the carve-out is about publication, not about capability. It exempts what has already been made public. It does not exempt a restricted model that a company chooses to hand to a foreign partner privately. The distinction being drawn is not open versus closed. It is published versus transferred.

Which brings us to the part that has been almost entirely missed.

Where the line actually falls: access versus possession

For restricted large models, the ministry says that offering API calls, app or web interaction, SaaS services and lightweight on-device deployment are not within the scope of large-model export control.

Deploying that same restricted model locally overseas is within scope. Running it on the company's own cloud infrastructure abroad sits in between, and may qualify for automatic licensing as a lower-risk case.

Read those two sentences together and the architecture becomes clear. A foreign user may use the model as much as they like. What they may not do, without a licence, is end up holding it.

This is a control on where the weights come to rest, not on who gets to use the capability. Selling the output is fine. Shipping the thing that produces the output is the regulated act.

It is a coherent position, and it is close to the opposite of the usual Western framing, which has concentrated on compute and on who is allowed to buy chips. Beijing is proposing to regulate the model itself as the controlled item, while leaving the service built on top of it almost entirely alone.

What this does and does not tell us

It is tempting to read this as China pulling up the drawbridge. The evidence does not support that reading yet.

What the documents establish. That a registration requirement is live. That a draft list exists, with 23 AI entries, a prohibited and a restricted tier, and explicit carve-outs for published research and for service-based access. That the consultation runs to 15 November 2026.

What they do not establish. What the performance thresholds are, which is the number that decides how much of the Chinese AI industry this actually touches. Whether the final catalogue will match the draft. How a licence decision would be made, or how quickly. Whether a model released as open weights after the catalogue takes effect would count as already public, or as an export requiring permission - which is the question that determines whether the open-source carve-out is a genuine exemption or a one-time grandfathering.

That last one matters more than anything else on the list, and the published documents do not answer it.

There is a broader point here about how AI governance is starting to work. For two years the argument has been about whether capability can be controlled at all, usually framed around compute. This proposal sidesteps that argument by regulating a different object - not the chips, not the use, but the transfer of the artefact. Whether that is more tractable or simply easier to write down is not yet clear. A set of weights, unlike a data centre, fits on a drive.

Anyone trying to follow this properly needs to be clear about what is being claimed at each step, which is a problem that runs through this whole field - see how AI capability is actually measured.

What to watch

• The thresholds. The draft restricts model weights above specified performance levels. Until those numbers are published, nobody can say how many models are in scope.
• 15 November 2026. The consultation closes. The gap between the draft and the final catalogue will show how much of this was a negotiating position.
• The next major Chinese open-weight release. Whether it ships globally, on time, with downloadable weights, is the most direct test available of what the carve-out means in practice.
• Whether anyone reciprocates. A model-transfer control is a different instrument from a compute control. If other jurisdictions start regulating weights rather than hardware, this will have been the first move.

Sources

• Ministry of Commerce, China: Announcement on revising the Catalogue of Technologies Prohibited and Restricted from Export (16/10/26)
• Ministry of Commerce, China: Policy explanation of the catalogue revision and interim registration requirement (16/10/26)
• Reuters: China proposes adding 40 AI, biotech, solar technologies to export control list (16/10/26)