China's AI Export Draft Is Not a Download Ban

Your team runs a Chinese open-weight model. Then a headline says China wants to restrict AI exports.

Should you stop deployments? Assume the next API call is illegal? Download everything before it disappears?

None of those conclusions follows from the published proposal.

As of October 18, there are two different developments: proposed export prohibitions and licensing restrictions, and an interim registration requirement already in effect. Mixing them up makes the story less useful for developers.

Two clocks are running

On October 16, China's commerce and science ministries published Announcement No. 48, proposing additions to the Catalogue of Technologies Prohibited and Restricted from Export.

The proposal covers 40 technologies, including 23 in AI. Across all three sectors covered, 14 entries would be prohibited and 26 restricted. Those totals are not all AI entries.

The registration requirement addresses technology exporters. Covered situations include transferring ownership abroad, licensing domestic technology for overseas use, and changes that put ownership or actual control in foreign hands.

Registration is not the same as approval under the proposed final licensing regime. Equally, calling everything "just a draft" misses an obligation that has already begun.

What counts as AI technology?

This is broader than shipping a model file, but narrower than banning all Chinese AI.

The official Q&A describes selected large-model, agent, compute-cluster, and information-processing technologies. It gives AI-driven malicious-code generation as a proposed prohibited example and AI-assisted vulnerability discovery as a restricted example.

The large-model entry, visible in draft tables reproduced by Sina Finance, includes weights, key checkpoints, source code, architecture, training optimization, and inference acceleration.

Its alternative thresholds include compute of at least 10^26 floating-point operations, at least two trillion parameters, or specified world-leading capabilities. The capability test refers to top-ten public assessments across areas such as performance, safety, and training efficiency at the time of export.

These are not three conditions that must all be met. Nor is parameter count a complete classification test: separate provisions concern models trained using data classified as "important" or "core" under Chinese law.

Associated Press reporting highlights the model and chip provisions, but notes that the draft names no specific model. A model family name is not a legal classification.

Open weights, new releases, and APIs are different cases

The official explanation makes three distinctions worth keeping.

Technology already made public. The proposal excludes relevant technology that has entered the public domain through open-source release or academic publication. Here, "public domain" describes the regulatory scope; it is not a statement that a model has lost copyright protection.

A new open-source release of covered technology. The Q&A describes automatic licensing and other facilitation measures for AI open-sourcing and certain other transfers. That is a different route from an exclusion. "Automatic" should not be read as "no process."

Serving a model rather than transferring its technology. The ministry says API calls, app or web interaction, and SaaS applications using restricted models would be outside the proposed large-model technology-export scope.

By contrast, moving covered model technology abroad for local deployment would fall within that scope. Deployment on a Chinese company's own overseas cloud could qualify for facilitation, according to the Q&A. That does not automatically cover every customer's self-hosted installation.

So the documents do not establish a blanket prohibition on ordinary model downloads or API use. They also do not guarantee that every model described as "open-weight" meets every exclusion.

A model license answers what reuse the rights holder permits. Export rules answer a different question. Neither replaces the other, and other applicable laws still matter.

Where your dependency actually sits

The immediate engineering question is not just where a model was created. It is what your next deployment needs from its supplier.

An existing local checkpoint does not technically stop working because a consultation opens. However, future versions, private adapters, optimized kernels, support, or new deployment arrangements may introduce dependencies that the current installation does not have.

An API avoids receiving the underlying weights, but it leaves availability and version control with the provider. Neither architecture is automatically risk-free.

These are planning scenarios, not claims that any named supplier has stopped releases or service.

Make a small, useful continuity plan

Start with a model inventory: exact checkpoint revision, source, license, hosting location, tokenizer, runtime, and any remote code or services required. Record whether you use a public artifact, a private transfer, or a hosted service.

Preserve artifacts and license notices where your rights permit it. Verify hashes, review executable model code, and prove that the deployment can rebuild without silently fetching "latest." This is normal supply-chain hygiene, not a reason to bypass a restriction.

Then test one realistic alternative. Switching the API URL is not enough. Compare task quality, tool-call formats, structured outputs, context limits, latency, and cost. If you change an embedding model, expect to rebuild and validate the retrieval index.

For example, a support assistant may keep generating answers after a model swap while quietly calling the wrong tool or using the wrong citation format. An evaluation should catch that before a supply change forces the switch.

Ask vendors specific questions about upcoming releases and private deployments: which entry might apply, which transfer is involved, and who is responsible for compliance? Get qualified legal advice for a real transaction rather than guessing from a parameter count.

What remains unsettled

The final wording, effective date, and implementation details can change. Teams should watch how authorities apply "public domain" to different weight-release terms, how automatic licensing operates, and which public assessments determine world-leading capability.

The impact on a particular derivative, adapter, or mixed package also needs facts about that artifact and transaction. The draft is not a ready-made legal verdict on every fine-tune.

The ministry presents the policy as security-focused and not directed at a particular country or entity. Reporting places it within wider technology rivalry. Neither tells us exactly how future releases will be handled.

The sensible response is not panic or dismissal. Separate the current registration duty from the proposed final controls, identify your actual dependencies, and keep a tested alternative ready.

Sources and scope

• MOFCOM and MOST: October 16 announcement and draft attachments
• MOFCOM: Official questions and answers
• MOFCOM and MOST: July 2025 enacted catalogue update
• Associated Press, via KSAT: Proposed technology-export curbs
• Sina Finance: Report and reproduced AI draft tables
• The Next Web: Models, chips, and the interim registration rule

Source note: The official notices and Q&A were read directly. The WPS annex download was unavailable during research; model-entry details were checked against reproduced draft-table images in the linked Sina report. This is a developer explainer based on information available October 18, 2026, not legal advice.

Hero photo: Yangshan-Port-Balanced, by English Wikipedia contributor Marqueed, June 2009. CC BY 3.0. The source photo was already white-balanced; this copy was resized from 4000 x 3000 to 1920 x 1440 pixels and JPEG-compressed. Archival illustration of Shanghai's Yangshan port, not evidence of an AI export, enforcement action, or involvement by any company shown. No endorsement is implied.