China AI export controls on models, chips, and agents

Most coverage fixated on the 2-trillion-parameter line, but the draft catalogue defines a controlled large model as one that either crosses that parameter count or ranks among the world's top 10 on performance, usage, or safety evaluations ^[2]. That second clause is the one worth sitting with. The r/LocalLLaMA community's read on that clause was that ranking criteria could extend to real-world usage signals such as call volume on routing platforms like OpenRouter, alongside specialized coding and agentic benchmarks - meaning smaller, highly efficient 'flash'-tier models could get swept in simply because they are popular, not because they are enormous. Moonshot AI's Kimi K3 and Alibaba's Qwen3.8-Max are the examples cited as sitting near the threshold today ^[2][3], but the usage-based prong means the list of affected models could grow or shrink independent of parameter count as the AI leaderboard churns. The practical effect: a lab cannot simply stay under 2 trillion parameters to stay clear of registration requirements if its model becomes popular enough to chart.

The draft also draws a sharp, and easily missed, line between types of export. Serving a restricted model remotely - through an API, an app, a web interface, or SaaS - does not count as a controlled export at all ^[1]. What is restricted is transferring the weights, checkpoints, source code, or architecture for local deployment on servers overseas. That distinction matters for how frontier Chinese labs structure their international business: hosted access stays open to anyone, anywhere, while shipping the actual model files abroad now requires registration and, pending final rules, formal export licensing.

The draft explicitly exempts technology already released publicly, whether through open-weight model drops or academic papers, from the new controls ^[1]. For future releases of models that would otherwise qualify as restricted, the ministries propose a fast-track licensing path so a compliance filing does not sit in the way of a launch - the ministries frame the goal as making filing a fast formality rather than a blocking step ^[1], a posture meant to preserve the international reach of China's open-source AI ecosystem rather than wall it off entirely ^[7].

But grandfathering only protects what has already shipped. Every checkpoint a lab has not yet released sits downstream of a new approval step, and the r/LocalLLaMA community's practical read was blunt: download and keep the open-weight models available today, because nothing guarantees the next generation of checkpoints clears the filing process on the same fast timeline open releases have come to expect. A fast-track is still a track - it did not exist before, and even a short administrative step changes the calculus for labs used to shipping weights the moment a paper drops. The chilling effect, if there is one, will show up not in what disappears but in what quietly stops getting open-sourced in the first place.

For three years, the pressure in US-China AI trade has run in one direction: Washington restricting advanced GPUs, EDA tooling, and chipmaking equipment from reaching Chinese firms. This draft inverts that, with Beijing choosing to restrict its own frontier AI exports rather than waiting to have restrictions imposed on it ^[6]. Omdia's chief analyst Lian Jye Su frames the move as a direct mirror of the sovereignty-style technology rules Western governments have already put in place around AI, robotics, and telecommunications, while Natixis economist Gary Ng situates it inside a broader pattern of global trade and technology access fragmenting well beyond any single country's policy choices ^[5].

It is also not China's first use of export controls as a lever rather than a shield. Beijing imposed licensing requirements on gallium and germanium exports in mid-2023, widely read as retaliation for the chip and chipmaking-equipment bans from the US, Japan, and the Netherlands ^[8], building on the legal framework the 2020 Export Control Law established. The AI catalogue revision extends that same instinct - the raw materials that go into chips, and now the models and agents built on top of them - into a new domain, with the government's own language framing it as safety-first governance: keeping 'AI under human control' while still wanting to encourage open-source sharing ^[3].

Almost everything else in the draft is a licensing and registration regime - slower, more paperwork, but ultimately permeable. One category gets no such path: AI agents built for national defense systems or critical information infrastructure cannot be exported at all, and neither can AI tools that autonomously generate or mutate malicious code targeting critical infrastructure, defense, or government systems ^[1]. That is a flat prohibition, not a threshold to clear or a filing to complete.

It is also the detail that reframes what this draft is really about. The parameter counts and benchmark rankings generated the most online commentary, including the framing that the AI race has moved from being just about chips to being about control over the models and agents themselves. But the hard ban on offensive-capable agents is the part of the draft least likely to soften during the public comment period running through November 15, 2026 ^[4]- it targets a dual-use capability that every government, not just China's, has reason to keep off the open market. Chip design rules for sub-14-nanometer or 2.5D/3D stacked processes ^[2]sit in between: licensable, negotiable, probably revisable. The agent ban on critical-infrastructure and defense use is not.