China is drafting export controls for frontier AI models, not the open weights you already run

Much of the world’s usable open-weight AI comes out of Chinese labs. The models people download and run at home from Alibaba’s Qwen, from DeepSeek, from Zhipu’s GLM, are a large part of why running capable AI on your own hardware is possible at all. So a move by Beijing to control the export of AI model technology is worth reading carefully, and worth reading accurately, because the early word-of-mouth on this one has the direction almost backwards.

What was actually announced

On 16 October 2026, China’s Ministry of Commerce and Ministry of Science and Technology jointly published Announcement No. 48, a draft revision to the country’s Catalogue of Technologies Prohibited and Restricted from Export. It proposes adding 40 technologies across artificial intelligence, photovoltaics and biomedicine, of which 23 are AI technologies. Across all 40, 14 are proposed for outright prohibition and 26 for restriction, meaning they would need an export licence. The split between prohibited and restricted is across the whole list, not the AI items alone.

This is a draft. It is open for public comment from 16 October to 15 November 2026, and it is not yet law. The one part that is not merely proposed: a separate interim measure requiring pre-export registration of all 40 additions took effect immediately on publication, covering even deals already begun but not completed, and lasting until the revised catalogue is finalised. So exporters already have to treat these items as controlled, which is the detail that undercuts any “it is only a draft” reassurance.

The draft defines the controlled “core large-model technology” broadly: model weights, key training checkpoints, source code, architecture design, and training and inference methods. As translated by the policy outlet ChinaTalk from the draft catalogue, a large model is caught if it meets any one of three thresholds:

• training compute of at least 10^26 floating-point operations;
• at least 2 trillion parameters;
• or “globally leading” capability, which ChinaTalk reads as a top-ten placing on mainstream public evaluations, with no specific ranking body named.

(If you have seen a figure of 30 billion parameters quoted, it is wrong. The parameter threshold in the draft is 2 trillion, three to four orders of magnitude higher, and it is corroborated across Bloomberg and multiple outlets.)

Alongside the size and compute bars, the draft ties the two enforcement tiers to data. Models trained on “core data”, China’s national-security tier under its Data Security Law, would be prohibited from export entirely. Models trained on “important data” and offered as a service would be restricted, needing a licence. Neither term is defined in the draft itself; classification is left to regional and departmental authorities.

Why this matters for running models locally

The exemptions are the part that decides whether any of this touches you, and the ministry’s own spokesperson has been specific about them.

Technology that has already entered the public domain through open-sourcing or academic publication is proposed to sit outside the export-control scope. And offering a model to overseas users through an API, an app or web interface, a SaaS product, or a lightweight on-device deployment does not count as a technology export. What does count is moving the technology itself out of China: assigning ownership abroad, licensing the domestic technology for overseas use, or handing control to a foreign entity. Deploying a restricted model on localised overseas infrastructure falls under export management too, though a company running it on its own overseas cloud may get automatic licensing.

For anyone with Qwen, DeepSeek or GLM weights on a local drive, the practical upshot is calm rather than alarming:

• Weights that are already public are explicitly out of scope. Nothing here retroactively pulls a model you have already downloaded, and downloading or running what is already released is unaffected.
• Delivery over an API or on a device is exempt regardless of a model’s size.
• Most of the Chinese open-weight models people actually run sit well under the 2-trillion-parameter and 10^26-FLOP bars, so on size and compute alone they would not be caught. The looser top-ten ranking criterion is the one that could, in principle, reach a strong model that is smaller than the hard thresholds.

The real exposure is forward-looking. A future frontier open-weight release that crossed a threshold would, on the draft’s logic, be a controlled export, so open-sourcing it would require a licence. The draft says the restricted tier would get automatic or simplified licensing for a new open-source release, but the prohibited core-data tier could be blocked. There is an unresolved question in the commentary about whether the open-source exemption applies to the restricted tier or only to the prohibited one, and the draft does not settle it. That uncertainty, rather than any threat to today’s downloads, is the thing worth watching.

The argument around it

MOFCOM’s framing is that the measure is narrow and pro-openness. Its spokesperson describes the scope as “precise and limited”, says the aim is to support an open-source innovation ecosystem, and states that the vast majority of AI technology can still be exported freely. Products made using the technology are out of scope.

Critics read the registration step differently. The analysis at ChinaTalk argues that requiring frontier developers to register technical specifications before a public release hands Beijing visibility, and potentially a veto, over an open-source drop, which could gate the very open-weight strategy that won Chinese labs their global following, including across the Global South. A Nomura analysis cited by Chinese outlets adds a competitive angle: the automatic-licensing lane is easier for large internet firms that already run overseas data centres than for independent frontier labs. These are readings of a draft, not settled outcomes, and the comment window exists precisely so they can be argued.

There is also a timing reading worth noting as analysis rather than fact: the comment window closes on 15 November, three days before an expected meeting between the Chinese and US leaders at the APEC summit on 18 November, which some commentators take as a sign the measure could serve as leverage.

How we got here

This did not come from nowhere. In July 2026, Reuters reported that Chinese officials had held closed-door meetings with Alibaba, ByteDance and Zhipu about a scheme to curb overseas access to their top models, explicitly including open-weight ones. Nothing was decided then, and officials indicated any curbs might apply only to future models. Announcement No. 48 reads as the formalisation of that direction into a concrete, if still draft, catalogue revision.

It also lands in a wider pattern of states drawing lines around specific models rather than the technology as a whole. We covered the United States ordering DeepSeek out of its federal agencies earlier this month, a restriction on one government’s own procurement rather than on the weights themselves, and the way some open models already arrive with terms that exclude the UK. Europe’s own direction of travel is in the EU AI Act’s digital omnibus. The common thread is that “open weights” and “freely available everywhere” are starting to come apart, and where a model was trained is increasingly part of whether you can use it.

For now, the honest bottom line for a local-AI reader is the one in the headline. Your existing DeepSeek V4.1 Flash, GLM-5.3 or Qwen3.8 Flash-Next download is not affected by this draft. The open question is whether a licensing gate on future frontier releases becomes a chokepoint on the next generation of Chinese open weights. It is a draft, it may change after comments, and we will follow the final text.

This piece draws on MOFCOM’s published Q&A and on ChinaTalk’s translation and analysis of the draft catalogue. The official announcement text and the full list of 23 AI items should be read directly before any figure here is treated as final.