China proposes export controls on 23 AI technologies, from large models to agents

What China's commerce and science ministries published

China's Ministry of Commerce (MOFCOM) and Ministry of Science and Technology published Announcement No. 48 of 2026 at 16:00 Beijing time on 16 October 2026. It proposes revising the Catalogue of Technologies Prohibited and Restricted from Export, the list China uses under its Foreign Trade Law and its technology import and export regulations to decide which know-how needs a licence, or cannot leave the country at all.

The draft adds 40 technologies in three fields: artificial intelligence, biomedicine and photovoltaics. MOFCOM's spokesperson said 14 of the 40 would be prohibited and 26 restricted. AI accounts for 23 items, which the announcement groups under large models, agents, computing clusters and information processing. Biomedicine adds five items covering cell and gene therapy, small-interfering-RNA drugs and pathogen work, and photovoltaics adds 12 items across polysilicon, wafer and cell manufacturing.

The public can comment from 16 October to 15 November 2026 by email, fax or letter to MOFCOM's Bureau of Security and Control. The technical annex is a Chinese-language WPS document; AI Lookout read it directly and the translations of thresholds below are ours. We did not find an official English version on 16 October.

Which AI technologies would be banned from export

Four AI entries sit in the prohibited section, which bars export outright. The first is a detection entry: anti-forgery systems built specifically or mainly to manage the security risks of cross-border data flows out of China, if they detect deep-synthesis video, audio, images or multimodal content with accuracy and recall of at least 95%.

The second is aimed at offensive cyber capability. It bans the export of AI-driven techniques for generating and mutating malicious code that could be used against critical information infrastructure, defence or core government systems, if they reach attack success rates of 60% against multi-engine malware detectors, 85% against a single mainstream antivirus product, or 90% against machine-learning models. The same entry covers malware that detects sandboxes, debuggers and emulators or escapes a sandbox, code that rewrites at least 50% of its own structure on each run, and pipelines that generate at least 20 functionally equivalent variants at a time.

The last two prohibited entries are about models and agents. Large models that serve users after being trained on China's "core data", a category defined by the Data Security Law, could not be exported. Nor could agents built specifically or mainly for critical infrastructure, defence or core government use if they reach the performance bar set for the restricted agent entry described next.

The restricted list: model weights, agents, chips and clusters

Seven restricted entries would need an export licence. The one that matters most to model developers covers the core technology of large models: weights, key checkpoints, underlying source code, architecture design, and training-optimisation and inference-acceleration methods. It applies if a model was trained with at least 10^26 floating-point operations, has at least 2 trillion parameters, or has capability at a "global leading level", which the annex defines as a top-10 global ranking at the time of export in public assessments by mainstream evaluators or large platforms, on measures such as overall performance, global call volume, safety or training efficiency. Models trained on China's "important data" are also restricted, unless that data is no more than 0.1% of training, is desensitised and cannot be reproduced in outputs.

The agent entry sets numeric bars: decomposing a natural-language instruction into chains of 20 or more executable sub-tasks with 80% decomposition accuracy and 90% average sub-task success; coordinating 60 or more concurrent agents; or integrating 200 or more third-party tools with 90% tool-selection accuracy and 90% end-to-end success on tasks that need three or more tools. Game-playing decision systems that meet several bars at once, including beating 90% of humans on standard benchmarks, are also listed.

AI-assisted vulnerability discovery gets its own restricted item. It covers systems that score 75% or more on authoritative security benchmarks, build working exploit chains for known flaws in mainstream operating systems or browsers at least half the time, chain two or more low- or medium-severity bugs into a multi-stage attack with working proof-of-concept code, or find more than five previously undisclosed high-severity flaws in one major open-source project or operating system in a single run. It is the kind of capability behind the open letter in which more than 400 scientists called for airgapping cyber-capable models earlier this week.

Hardware appears too. AI processor design is restricted if it needs a 14-nanometre or finer process, uses 2.5D or 3D packaging, has high-speed interconnect or uses compute-in-memory or brain-inspired architectures, and some 3D NAND and DRAM design techniques are listed. Cluster technology for sites with more than 10,000 accelerators is restricted where it reaches thresholds such as 800 GB/s bidirectional chip-to-chip links, recovery from checkpoint failures within 120 seconds or 98% linear scaling. Our explainer on AI chip metrics covers why interconnect and memory matter as much as raw compute. The final restricted additions cover deepfake detection at 98% accuracy and recall, high-robustness image and video steganography, voiceprint recognition and translation systems for Chinese and minority languages.

What stays outside the controls

Two exclusions define how far this reaches. First, a footnote to the AI section says technology that has already entered the public domain through open-source releases or published academic papers is not covered. For restricted AI items, open-sourcing itself, Chinese companies' self-built and self-operated computing centres abroad, chip tape-out at foreign fabs, joint research using foreign resources and work on international standards would get "automatic licensing and other facilitation measures". The spokesperson described that as reports being cleared almost on submission.

Second, MOFCOM's spokesperson Q&A says the test is whether restricted technology moves from inside China to outside it. Offering a restricted large model to foreign users through API calls, apps, web interfaces, SaaS or lightweight on-device deployment is not a large-model technology export. Localised overseas deployment of a restricted model is, although deployment on a company's own overseas cloud may qualify for automatic licensing. The spokesperson also said products made using listed technologies are outside the catalogue, and that the great majority of AI technology would remain freely exportable.

The registration rule that starts now

Unlike the catalogue change, the registration duty is already in force. From the date of the announcement until the revised catalogue takes effect, anyone exporting a listed technology must register it beforehand on MOFCOM's technology-trade platform at ecomp.mofcom.gov.cn. Exports that have started but not finished are included. Exporters must decide for themselves whether a deal is in scope.

• Transferring ownership of a technology abroad, such as assigning intellectual property.
• Licensing domestic technology for use outside China.
• A change in the owner or actual controller of the technology to a foreign entity.
• Any other case MOFCOM specifies by notice.

Why Beijing says it is doing this

MOFCOM framed the revision as routine. It says the catalogue has been adjusted many times since 2001, that this change follows law and does not target any country, region or entity, and that major economies already control exports in these fields. On AI specifically, it gave two reasons: keeping AI "safe and controllable", citing the risk that autonomous malware generation could be used against critical infrastructure or fall to non-state actors; and supporting open source and cooperation, which is where the exemptions come from. It also promised extra facilitation for capacity-building exports among members of the World AI Cooperation Organization.

Reuters, in a report carried by Devdiscourse, placed the draft in the US-China contest. It noted that Washington's chip controls have helped keep Anthropic and OpenAI ahead, that frontier models such as Anthropic's Mythos have raised concern about AI-enabled cyberattacks, and that Chinese authorities had discussed restricting overseas access to the most advanced Chinese models with companies including Alibaba, ByteDance and Z.ai in July. The API carve-out, Reuters wrote, could let developers such as DeepSeek and Alibaba keep expanding abroad while Beijing gains oversight of transfers.

What it means for Chinese labs and their customers

For most users of Chinese models outside China, little changes in the draft as written. Hosted access through APIs, chat apps and SaaS is explicitly outside the large-model entry, and open-weight models that are already public sit in the exempt public domain. That covers releases such as the DeepSeek-V3 family, whose weights and papers are already out.

The pressure points are elsewhere. A Chinese lab that wanted to license unreleased weights of a top-10 or 2-trillion-parameter model to a foreign partner, stand up a localised deployment on someone else's infrastructure abroad, sell a stake that hands control of a model to a foreign owner, or move cluster-scheduling know-how overseas would need to register now and, once the catalogue is final, apply for a licence. The ranking test is moving: a model that is top-10 when it is exported is covered, whatever its size.

The thresholds echo Western rules. A 10^26-operation trigger appeared in the 2023 US executive order on AI, since revoked, and the EU AI Act presumes systemic risk at 10^25 FLOPs. China's version applies them to outbound know-how rather than to domestic safety duties. It also lands a day after Tim Cook said Apple Intelligence had been approved in China, a reminder that Beijing now regulates AI coming in as well as going out.

Open questions before the 15 November deadline

This is a consultation draft, so thresholds, wording and exemptions can change before a final catalogue is issued, and no effective date for that final text has been published. Several terms will need guidance. "Core data" and "important data" depend on catalogues that are not fully public. The top-10 test does not name which evaluators or platforms count. Some chip-design criteria, such as having floating-point or integer capability, read very broadly, and it is unclear how strictly they will be applied.

It is also unclear how quickly automatic licences will be granted in practice, how MOFCOM will treat partial releases such as open weights without training code, and whether foreign companies with research teams in China will face the same registration duty when moving work between offices. The ministries said they will adjust the catalogue over time and remove technologies that stop being advanced. AI Lookout will update this article if MOFCOM publishes an English text, guidance, or the final catalogue.