On October 16, 2026, China proposed its first frontier AI export controls, and the test it chose is custody, not access. Under Announcement No. 48 from the Ministry of Commerce and the Ministry of Science and Technology, calling a restricted Chinese model through an API, an app, a website, or a SaaS product is not a technology export, while installing that model on servers outside China is. That single distinction decides most of the practical exposure, and it is the answer readers should carry into any contract that involves a Chinese model.
Two instruments, two clocks
Announcement No. 48 contains two instruments with different legal status, and confusing them is the first mistake. The catalogue additions are a draft, open for comment until November 15, 2026. The interim pre-export registration requirement applies now, and it covers exports that started before October 16 but are not yet complete. In other words, the final catalogue can still change, but a company with a listed technology in transit cannot wait for the final text before filing.
The draft proposes adding 40 technologies to the Catalogue of Technologies Prohibited or Restricted from Export: 23 in artificial intelligence, 12 in photovoltaics, and 5 in biomedicine. Across all three fields, 14 technologies would be prohibited and 26 restricted. That distinction matters because the headlines that say China "banned" AI exports overstate the draft: most of the AI entries are restricted, not prohibited, and the service-access carve-out leaves a large part of ordinary use untouched.
The deployment test, in plain terms
The Ministry of Commerce framed the central question as whether restricted technology moves from inside China to a place outside China. That framing produces a table every buyer and vendor should be able to recite:
| What you do | Proposed treatment |
| Call a restricted model through an API, app, website, or SaaS product | Outside large-model export management |
| Use a lightweight on-device deployment | Outside large-model export management; "lightweight" is not defined |
| Install a restricted model on servers outside China | Counts as an export; a licence is required |
| Run it on the Chinese developer's own overseas cloud | Automatic licensing may apply, where risks are considered controllable |
| Use weights already released as open source or in academic publication | Outside the scope of the draft |
| Open-source a new restricted model for the first time | Automatic licensing after reporting, not a free release |
Two warnings belong beside that table. First, the service label does not decide the question. If a vendor moves covered weights to an overseas environment and then serves users by API from there, the weight movement still needs its own analysis. Second, a first release is not "already public." The public-domain exclusion covers technology that is already public, so a new open-weight release from a Chinese lab should be treated as a future release whose cadence is now partly a licensing question, not only a product schedule.
What counts as frontier in the draft
For large models, the draft restricts weights, key checkpoints, source code, architecture, and training and inference optimization know-how if a model meets any one of three tests: at least 10 to the power of 26 floating-point operations of training compute, at least 2 trillion parameters, or a global top-10 position on public evaluation rankings, global call volume, or comparable measures at the time of export. The third test is the one to watch. A model that sits below the compute and parameter lines can still become restricted if its ranking or call volume puts it in the global top 10 when the export happens, and a model cleared today can fall under the draft after a later update changes its standing.
Agents are controlled independently underneath them, which is the draft's most original move. Planning and task decomposition are restricted above 20-step subtask chains with at least 80 percent decomposition accuracy and 90 percent subtask success. Multi-agent collaboration architectures are restricted above 60 concurrent agents, with completion time no more than twice the single-agent minimum and at least 85 percent agreement with reference answers. Tool calling and system operation are restricted above 200 integrated third-party tools, with at least 90 percent tool-selection accuracy and 90 percent end-to-end success for tasks requiring three or more tools. High-performance agents built specifically or mainly for critical infrastructure, defense, or core government use are prohibited outright. Readers who want the wider question of who verifies an agent and who is liable when it acts will find it in ByteHerald's agent identity stack comparison, which maps credentials and liability rather than export thresholds.
The draft's Cloud Security Alliance research note gives the same thresholds. Other AI entries follow the same pattern of a number plus a condition. AI chip and memory chip design is restricted at process nodes of 14 nanometres and below, among other criteria. Large compute clusters are restricted above 10,000 accelerators with interconnect of at least 800 gigabytes per second and related fault-tolerance and scheduling conditions. Models trained on China's "core data" are prohibited, models trained on "important data" are restricted with a narrow carve-out for trace use of desensitized data at or below 0.1 percent, and AI-assisted vulnerability discovery is restricted under six alternative tests, including at least 75 percent authoritative benchmarks or autonomous chaining of two or more low or medium flaws into a working exploit.
Why registration already changes deals
Interim registration is triggered by four kinds of transaction: transfer of technology ownership abroad, licensing of domestic technology for overseas use, a change of ownership or actual control that makes a foreign entity the owner or controller, and any other case the Ministry of Commerce designates. Exporters must decide for themselves whether a technology falls within scope, and the form asks for recipient details, destination, technology description, and use, and estimated value. Analysts reading that form have noted it may capture intra-group code sharing, which means a multinational with China-based research teams sharing agent frameworks or fine-tuned models with affiliates outside China may need to register before sharing, not only before selling to a third party.
The Manus precedent shows why companies should take the control-change trigger seriously. In January 2026, the Ministry of Commerce announced an assessment of Meta's acquisition of Manus, a Singapore-registered AI agent company whose products were developed in China, examining whether the relocation of staff and technology required export authorization. No new law gives that line of scrutiny explicit, agent-specific thresholds, so diligence on any AI target with China-origin development history should include an export-control workstream from the start.
What this is not, and what to do before November 15
This draft is not a ban on using Chinese AI models, and it is not aimed, by the Ministry's own statement, at any specific country, region, or entity. It is also the first time China has touched AI in this catalogue: the 2020 revision added personalized recommendation and AI interaction interface technology. What is new is the reach into frontier model weights, agent architectures, and AI-enabled offensive cyber capability, with explicit technical thresholds for each. ByteHerald's export-control map put the United States and China side by side in October, and this draft is the development that map anticipated: frontier AI now faces formal outbound controls from both of the largest AI-producing jurisdictions, drawn on different lines.
For a company that uses a Chinese model, the practical sequence is short. Inventory every Chinese-origin model, agent framework, and AI security tool, and record how each is consumed: API or SaaS service, lightweight on-device component, or locally deployed weights or code. The locally deployed category is the priority, because it is the one the draft places within export management. For each locally deployed asset, ask the supplier in writing whether it has registered the export under Announcement No. 48 and whether it expects to need a licence once the catalogue is final. And if the scope affects your business, prepare comments before November 15, 2026, because thresholds, the undefined word "lightweight," and the automatic-licensing procedures are all still open to change.
By ByteHerald Staff. Ministry of Commerce and Ministry of Science and Technology of China, October 16, 2026, issued Announcement No. 48 proposing 40 catalogue additions, 23 in artificial intelligence, with comments due November 15, 2026 and interim pre-export registration in effect since October 16, 2026. Greenberg Traurig, October 29, 2026, reported the deployment table, the three large-model tests, and the four registration triggers, and noted that "lightweight" is undefined. ChinaTalk, October 21, 2026, analyzed the draft annex and noted the global top-10 test is the most open to interpretation and estimated that no released Chinese model yet exceeds the 10 to the power of 26 compute threshold.
Comments
Post a Comment