China's Ministry of Commerce imposed a mandatory pre-export registration requirement on 40 categories of technology — including, for the first time anywhere in the world, AI model weights and source code — effective October 16, placing companies that deploy covered Chinese AI models overseas under an active compliance obligation even as the formal rules remain open for public comment. The registration requirement took effect immediately, without waiting for the draft catalogue to be finalized: affected companies must already be treating these technologies as controlled exports now, with the public comment period running until November 15 and a final catalogue date still unannounced.

The announcement, jointly issued by the Ministry of Commerce (MOFCOM) and Ministry of Science and Technology (MOST) as Announcement No. 48, proposes adding 40 technologies across three sectors to China's Catalogue of Technologies Prohibited or Restricted from Export, with 14 facing outright bans and 26 subject to new licensing requirements. The practical effect for the global AI industry — which has built substantial infrastructure on Chinese open-weight models over the past two years — is a bifurcation: models already in global circulation remain beyond Beijing's legal reach, but future frontier releases from Chinese labs now face a new government gate before going international.

For context on the scale of that existing ecosystem: Chinese AI models now account for roughly 41% of downloads on Hugging Face, the leading open-weight model repository, and for between 30 and 46% of weekly API traffic on OpenRouter. The cost gap that made them attractive — one task on GLM-4.5-Air runs approximately $544, versus approximately $4,811 for the equivalent Claude Opus task, an 8.8-fold difference — applies to models already deployed and is not directly affected by the interim registration requirement. But exposure is not only about cost: China's National Intelligence Law obligates all organizations and citizens, including AI companies, to support and cooperate with national intelligence work on demand, regardless of where their servers are located or what their privacy policies say.

What China's Draft Actually Controls

The AI section of Announcement No. 48 is its most technically specific element, covering 23 AI sub-areas including large models, AI agents, computing infrastructure, chip designs, and data processing.

Under the proposal, two categories of AI technology would face outright bans: AI models trained on what China's Data Security Law classifies as "core data," and AI agents specifically designed to serve national defense, critical information infrastructure, or core government systems. A separate restriction — requiring licenses rather than outright prohibitions — would apply to models either exceeding two trillion parameters or ranking in the world's top ten on measures of performance, safety, or usage.

That threshold directly implicates China's most prominent open-weight releases. Moonshot AI's Kimi K3, released in July at roughly 2.8 trillion parameters, and Alibaba's Qwen3.8-Max, previewed at approximately 2.4 trillion parameters, are both widely assessed to fall within scope, according to reporting by Bloomberg and the Associated Press. The draft does not name specific models or companies.

The same restricted category captures chip designs for AI accelerators at or below the 14-nanometer node, and computing clusters of 10,000 or more accelerator cards — a threshold calibrated to match the infrastructure scale needed to train frontier models.

The proposal also draws one significant boundary: technologies already in the public domain are explicitly exempt. Open-source systems and research published in academic papers are not subject to the new controls. API access and software-as-a-service offerings are also excluded — a carve-out that preserves cloud access to Chinese models and protects the cloud revenue streams Chinese AI companies have built internationally.

Registration Already Required — Before Rules Are Final

One detail has drawn particular attention from trade lawyers: the registration requirement took effect on October 16, without waiting for the draft catalogue to be finalized.

Under the interim rules, any technology export transaction covered by the draft — including ownership transfers, overseas licensing agreements, and foreign control changes over Chinese technology — must be registered with the Commerce Ministry. Registration requires disclosing basic information about the exporter and recipient, a description of the technology and its intended use, and the estimated value of the transaction. Deals already underway at announcement time are covered.

Legal specialists who tracked the announcement characterized it as Beijing moving the compliance clock ahead of the formal rulemaking process — a pattern seen in China's earlier export controls on critical minerals, where interim registration requirements preceded finalized restrictions by months. The practical effect for affected companies is that assessing and registering covered transactions is not a future planning item; it is an immediate operational obligation.

For Chinese AI companies with international ambitions, the implications are more direct still. Deploying a covered model on overseas servers — even for cloud inference — would itself constitute a technology export under the proposal's terms, a requirement that forces firms to assess whether international model releases and API offerings trigger registration or licensing obligations before they go live.

Already Released vs. Not Yet Released: What This Means for Open-Source AI

The structural enforcement paradox at the center of these controls is one the draft acknowledges but does not resolve: export controls on model weights operate prospectively, and weights already in global circulation are effectively beyond Beijing's reach.

Model weights — the trillions of numerical parameters adjusted during training that, together with model software, determine how inputs become outputs — are the core of an AI model in a way hardware is not. Once weights are published and distributed, no licensing regime can recall them. The global developer community that has already downloaded and deployed Qwen, DeepSeek, Kimi, and other Chinese open-weight releases is legally unaffected by Announcement No. 48. The compliance obligation falls specifically on Chinese companies planning new international releases of covered models.

This creates what amounts to a frozen-inventory dynamic: the existing Chinese open-weight ecosystem that foreign developers have built on remains freely accessible globally. What changes is the legal framework governing the next generation of Chinese frontier models. Labs that would have released future ultra-scale models openly — as they did with DeepSeek-R1, Qwen3, and Kimi K3 — must now navigate export licensing before foreign distribution. The open-source and API carve-out preserves access to whatever is already public; it does not guarantee that the next iteration will be.

What Independent Security Research Has Found About Chinese AI

The security risk attached to Chinese AI is not theoretical. Researchers at Cisco tested DeepSeek R1 and found a 100% attack success rate — every attempted jailbreak of the model succeeded, a finding that has no published parallel in evaluations of Western frontier models. Check Point Research has documented threat actors using Qwen to develop malicious content, including infostealer malware, with threat actors sharing jailbreaking methods on underground forums. Security researchers working with Hugging Face have identified more than 352,000 unsafe or suspicious issues across 51,700 models in the platform's public repository — raising supply-chain integrity concerns for enterprises pulling weights directly from open repositories.

A separate attack surface — model poisoning — affects any organization using Chinese-origin models for internal applications. Research on supply-chain poisoning has found that as few as 250 malicious training documents can embed a persistent backdoor in a 13-billion-parameter model, a threshold orders of magnitude below the frontier models in scope of Announcement No. 48. China's DeepSeek R1 was already banned or restricted for government use in the United States, Australia, Taiwan, and Italy before October 16.

Solar and Biotech: The Other Two Pillars

Beyond AI, Announcement No. 48 targets two additional industries where China holds dominant or strategically important positions.

In biotechnology, the proposed bans cover cell and gene therapy platforms — an area in which Chinese companies have made substantial research investments over the past decade. The ban specifically targets foreign acquisition of proprietary platforms; licensing agreements are not prohibited under the current draft. Aaron Gu of Han Kun law firm described the practical effect as "regulating transfers while leaving licensing unconstrained" — meaning international pharma companies can still access Chinese cell-therapy innovations through royalty agreements but cannot buy the underlying platforms outright. Foreign transactions involving Chinese biotech assets reached approximately $120 billion in the first half of 2026, up 36% year over year, representing a pipeline of deals that now requires legal review against the draft's scope.

The solar provisions are broader in scope and more commercially disruptive than they might initially appear. The draft proposes restricting the export of production know-how for perovskite and tandem solar modules — next-generation cell architectures that have reached 34.85% efficiency in tandem configurations, versus roughly 22% for conventional silicon, and are increasingly relevant for aerospace, defense, and satellite applications where power-to-weight ratio matters more than cost. Technologies for producing polysilicon — the foundational raw material for conventional photovoltaic panels — are also included. China accounts for roughly 97% of global wafer output, a dominance achieved over a decade of manufacturing investment that reduced the global cost of solar power by more than 90%.

MOFCOM's accompanying statement on solar framed the restrictions explicitly around national security, citing the "continuously expanding" application of solar technology in "aerospace, national defense, unmanned equipment, and high-security-level infrastructure." Cosimo Ries, an analyst at Trivium China, offered a more pointed read: "Beijing and the market leaders in China's solar industry are undoubtedly worried about efforts from the US, EU, and India to develop homegrown solar manufacturing industries, so these recent tech export controls may very well be a response." Analysts at Daiwa Capital Markets noted that, given China's commanding position in wafer production and the sector's high barriers to entry, it was "reasonable for Beijing to consider controls to prevent technology leakage to overseas competitors."

Beijing's Logic — and Its Own Constraints

MOFCOM's official framing was careful to avoid casting Announcement No. 48 as a direct response to the United States. A ministry spokesperson described the revision as "routine," said it "does not target any specific country, region or entity," and cited preventing misuse and ensuring AI remains under human control among its justifications.

The context makes that framing difficult to take entirely at face value. US-led export restrictions have constrained China's access to cutting-edge AI chips and the equipment to manufacture them for several years, limiting the hardware layer of China's AI industry. Announcement No. 48 represents Beijing applying the same logic outward — asserting control over the software, training data, and biological technology that Chinese companies developed despite those hardware constraints. MOFCOM consulted Alibaba, ByteDance, and Zhipu on the shape of these controls since at least the summer, according to reporting by Bloomberg and the Financial Times, suggesting the announcement was months in preparation.

Beijing's decision also reflects a strategic calculation about what China holds that can be protected. Critical minerals controls — on gallium, germanium, graphite, and antimony — have already demonstrated Beijing's willingness to weaponize supply-chain dominance. Announcement No. 48 extends that playbook into software and biological technology: assets that cannot be embargoed at a port but can, at least prospectively, be placed behind a licensing wall.

The constraints are real, though. The draft's own public-domain carve-out reflects the acknowledgment that open-weight models already distributed globally cannot be recalled. And the API/SaaS exemption — which preserves foreign access to Chinese AI via cloud queries — creates a monitoring-compatible access channel that may serve Beijing's interests in ways the blanket prohibition would not: inference queries sent to Chinese servers are subject to the same National Intelligence Law compelled-access framework as any other data on those systems.

Does This Apply to Your Current Deployment?

For companies or developers that have already downloaded and are running Chinese model weights locally, Announcement No. 48's interim registration requirement does not apply retroactively — the public-domain and already-released exemption covers existing open-weight models. The exposure question for most foreign developers centers on three scenarios: (1) entering into a new licensing agreement for a covered Chinese AI technology after October 16; (2) deploying a covered Chinese-origin model through a direct server arrangement that could be characterized as an overseas technology deployment rather than an API call; (3) a future acquisition or investment that would place effective control of a covered Chinese AI platform in foreign hands.

For companies uncertain about their exposure, the window between now and November 15 — when public comments on the draft close — is the most productive time to engage: both to assess internal exposure and, if affected, to submit comments through MOFCOM's public consultation process that could influence the scope and definitions of the final catalogue.

Frequently Asked Questions

Are DeepSeek and existing Qwen models affected by these controls?

Existing open-weight releases of DeepSeek-R1, Qwen3, Kimi K3, and other Chinese models that are already publicly available are not retroactively controlled by Announcement No. 48. China's export-control framework — like all export control regimes — operates prospectively: it can restrict future transfers, not undo past ones. The public-domain exemption in the draft explicitly preserves access to already-released models. What changes is the regulatory environment for future frontier model releases from Chinese labs: any new open-weight or otherwise distributed release of a model meeting the two-trillion-parameter threshold or the top-10 performance criterion would, under the draft, require export registration or licensing before international distribution.

What exactly must companies register, and with whom?

The interim registration requirement, effective October 16, requires any party engaged in a covered technology-export transaction to register the deal with China's Ministry of Commerce before the transaction proceeds. Covered transactions include outbound ownership transfers of covered Chinese technology, overseas licensing agreements, and ownership or control changes in Chinese entities that would transfer effective control of a covered technology to foreign parties. The registration form requires basic information about the parties, a description of the technology and its intended use, and an estimated transaction value. The MOFCOM registration portal is the designated channel; the requirement applies to deals already underway at the time of the announcement, not only new ones.

What are the security risks of using Chinese AI models that remain freely accessible?

Beyond the export-control question, companies using Chinese AI models — including those that remain fully accessible under the public-domain exemption — face a separate structural risk. China's National Intelligence Law (Article 7, 2017) legally obliges all Chinese organizations and citizens to "support, assist, and cooperate with national intelligence work," and that obligation applies to Chinese AI companies regardless of where their servers are physically located or what their privacy policies state.

API queries sent to Chinese model endpoints travel through infrastructure subject to this law. Independent security research has documented additional concerns: Cisco's testing found a 100% jailbreak success rate on DeepSeek R1, Check Point Research has documented threat actors using Qwen to develop malware for active deployment, and security researchers working with Hugging Face have flagged more than 352,000 unsafe or suspicious issues in public AI model repositories. Organizations with sensitive workloads should evaluate whether Chinese AI model dependencies — even fully legal and openly accessible ones — represent acceptable risk at the infrastructure level.

When will the final export-control catalogue take effect, and will it differ from the draft?

No date for the final catalogue revision has been announced. The public comment period runs until November 15, 2026, after which MOFCOM and MOST will review submissions and may revise the draft's scope, thresholds, or definitions before publishing a final version. The interim registration requirement operates independently of the final catalogue timing — it applies now to the technologies described in the draft, regardless of when finalization occurs. Based on China's handling of prior export control catalogue revisions, including controls on critical minerals, the period between draft and final rule has historically ranged from several weeks to several months, and final rules have sometimes differed meaningfully from drafts in response to industry comment.