China’s Ministry of Commerce and Ministry of Science and Technology have released a draft revision to the list of technologies prohibited or restricted for export. It covers 23 priority areas, including large models, AI agents, computing clusters and data processing. AI that autonomously creates or modifies malware would be banned from export, while technology already made public would be exempt. The draft also provides for a system under which open-source releases can be approved simply through registration. The proposal is still a draft, and the final rules have not been determined.
The controls target what’s inside, not performance
What stands out in the proposal is that controls would cover not so much the models themselves as the full set of technologies used to build them. The list includes weights, checkpoints, source code, architecture, and training and inference methods. The idea is less about controlling sales of a finished product than about regulating the removal of the recipe and the entire kitchen.
Weights are collections of numerical values that represent an AI’s “memory,” acquired through training. With those values in hand, it is possible to reproduce the model almost entirely in one’s own environment. That is why countries are beginning to focus their export controls on weights.
Three thresholds that trigger controls
There are three conditions under which a model’s core technology would be controlled: the compute used for training is at least 10^26 FLOPs; the model has at least 2 trillion parameters; or it ranks among the world’s top 10. Meeting any one of these conditions is enough for the technology to fall within the controls.
Export control authorities will determine whether a model ranks in the top 10 by consulting rankings published by leading domestic and international evaluation bodies and industry platforms. The criteria cited include overall performance, individual tasks, safety and the scale of use worldwide. The inclusion of rankings—a moving target—in addition to numerical thresholds is significant. A model could come under regulation as soon as it enters the race for the top spot.
Models trained on important data also fall within the net
Data offers another route into the scope of the controls. Large models trained using China’s “important data,” as defined under laws such as the Data Security Law, and offering services based on that data would also be subject to export controls.
The proposal also sets out detailed exceptions. Data lawfully made public is exempt. In addition, small amounts of data—up to 0.1%—are permitted if they have been cleaned in advance, do not appear in AI outputs, and do not significantly boost research and development capabilities in core technologies in the relevant field. Setting a numerical threshold leaves room for flexibility in implementation.
AI that would be banned, and AI that would be restricted
The proposal’s strongest measure is an export ban on offensive AI. This includes AI tools that autonomously write or modify malware to target critical infrastructure, the military or government agencies.
AI tools that find software vulnerabilities, by contrast, would face new export restrictions rather than a blanket ban. Finding vulnerabilities is a technology that can be used both to defend and to attack. The distinction between a ban and a restriction appears to reflect this dual-use nature. For the security industry, the practical question going forward will be how far the restrictions extend.
A shortcut to protect open source
Although the proposal may look like an effort to curb exports, it also includes measures to accelerate them. Exporting restricted AI technology or weights as an open-source release would qualify for automatic approval. The same treatment would apply to operating one’s own data center overseas, sending chip design data abroad for manufacturing, conducting joint research with foreign partners, and participating in the development of international standards. Eligible exports are designed to be approved once the required documents are submitted.
Chinese open models have become widely used by developers around the world in recent years. The procedure suggests an intention not to halt that momentum. AI technology already made public through open-source releases or academic papers is also outside the scope of the new rules. The approach is to leave alone what has already been released.
Distinguishing use from taking technology abroad
In practice, the distinction based on how a technology is used is likely to matter. Even restricted models would not be subject to export controls when accessed through an API, app, website or SaaS. The same applies to lightweight versions that run on a device. As long as overseas users are trying the model in a chat or integrating it into their own services, they would not run afoul of the rules.
By contrast, installing restricted technology on a local server overseas would require a standard export license. However, a simplified procedure would be available if it were run on an overseas cloud operated by the company itself. In other words, the dividing line is not “who has access,” but “where the technology itself is located.”
This distinction is significant for overseas companies. If the proposal is finalized, bringing a Chinese-made model into their own environment and operating it there would be an option contingent on approval.
A mirror image of the U.S.—and Europe’s dilemma
Dean W. Ball, who leads OpenAI’s Strategic Futures team, sees the move not as China shutting off open-weight models, but as the government preserving the option to halt future models when necessary. He views it as a “mirror image” of the export controls on model weights that the United States has already put in place.
If this dynamic advances, U.S. companies that rely on open-weight AI are likely to lean more heavily on domestic models rather than Chinese ones. Europe faces a more difficult position. It has pursued a strategy of maintaining autonomy by running open-weight models on cloud infrastructure within the region. But that premise is threatened if leading open models come predominantly from the United States and China—and can be halted at any time through export controls.
The word “open” suggests that anyone can use something freely. But that freedom is, to some extent, shaped by the policies of the country where it originates. Rather than a simple choice between open and controlled, we appear to be entering an era in which institutions shape the path to openness itself.
The Global South and the current state of the process
The draft also calls for support for AI development in the Global South. It says exports intended for capacity building, technology sharing and joint rulemaking will be facilitated within the World Artificial Intelligence Cooperation Organization, a framework established by China. The organization is positioned as a counterweight to Western-led AI institutions.
Until the final rules take effect, companies must register affected exports through the Ministry of Commerce’s portal.
Comments