China's AI export list is a draft. The registration bolted to it is not.

China's October 16 export announcement is usually reported as a proposal, and half of it is one. The Ministry of Commerce and the Ministry of Science and Technology published Announcement No. 48, a draft revision of the catalogue of technologies prohibited or restricted from export, adding 40 technologies across three sectors: 23 in artificial intelligence, five in biomedicine and 12 in photovoltaics. Per the ministry, 14 would be prohibited and 26 restricted. Comments are open until November 15.

The other half took effect the day it appeared, and it applies to deals that are already running.

The registration is not a draft

The pre-export registration requirement covers any technology listed in the announcement's annexes, and it began on publication. It reaches backwards: exports already commenced but not yet completed must also be registered, through the Technology Trade Management Information System on the ministry's Unified Business Platform. Three transaction shapes are named — transferring technology ownership abroad, licensing domestic technology for use overseas, and a change of ownership or actual control that leaves the owner or controller an overseas entity. A fourth clause lets the ministry add cases by notice.

The practical effect is that for any covered transaction still open on October 16, the compliance date was October 16. Exporters register the recipient, the destination country, the technology, its intended use and the estimated value of the export. The ministry's own Q&A puts the scope decision on the exporter: companies are responsible for determining whether a proposed export falls inside the requirement.

That is a filing obligation rather than a permission slip, but it builds a dated record of who is exporting what while the list generating the record is still being argued over. Reading the announcement as "nothing has changed yet" misreads which half is operative.

What is on the AI list

The AI section runs from model weights to the buildings that train them. Large models, agents, computing clusters and information-processing technologies all appear. Data categories cut across it: models trained on what Chinese law defines as "core data" and used to provide services fall under the proposed ban, while those trained on "important data" fall under restrictions. The important-data note carries exceptions — use of 0.1% or less, safeguards that stop important data being reproduced in outputs, and important data lawfully obtainable from public sources. It does not explain how the 0.1% is calculated, or whether that exception survives the separate scale criteria.

The prohibited examples are narrower than the rhetoric around them. Technology for AI-based generation and mutation of malicious code is on the banned list. AI used to discover software vulnerabilities, by contrast, lands in the restricted category — an inversion of the usual Western framing, where offensive tooling is the worry and defensive research gets the carve-out.

Agents are drawn by capability plus accuracy: tool-calling technology that integrates 200 or more third-party tools with tool-selection accuracy of 90% or higher, and an average success rate of 90% or higher on tasks needing three or more types of tools. On infrastructure, a cluster with more than 10,000 AI accelerator cards counts as large-scale; the draft also reaches bidirectional interconnects of 800 GB/s or more, distributed-training failure recovery, and design technology for AI processing and memory chips.

Three thresholds, one nobody can check

Draft item 266504X is where the list stops being a list and becomes a test. It would restrict the weights, key checkpoints and underlying source code of large models meeting any one of three conditions.

Condition	Threshold in the draft
Compute	10^26 floating-point operations or more
Parameters	2 trillion or more
Ranking	Global top 10 on a covered metric at time of export

Any one is enough. A model below both quantitative lines can still be caught by the third, and the third is the one nobody outside the ministry can audit. The draft judges the ranking at the time of export, against public evaluations by mainstream domestic and international bodies and industry platforms, on metrics including task-specific capability, global call volume, safety performance and training efficiency. It names no institution, leaderboard or method for resolving a disagreement between two of them. A lab reading its own model card cannot tell whether that model is covered.

The quantitative lines are more concrete but not much more usable. Two trillion parameters is not an abstraction: the Associated Press reported that Kimi K3 and Qwen 3.8-Max sit above it, so the parameter test does catch the largest Chinese flagships. It does not catch the tier below. DeepSeek V4.1 Flash, published the day after the announcement, is described by its own card as a 552B backbone with 8B parameters active on input and 16B on output — well under the line, and its training compute is undisclosed, leaving 10^26 unverifiable too.

For that tier, coverage hangs on a ranking clause with unnamed referees.

API calls out, weights in, hosting undecided

The ministry's same-day Q&A makes the unit of control the transfer, not the model. API calls, apps and SaaS access sit outside technology export controls for large models; local deployment overseas is inside them; deployment on a company's own overseas cloud is inside but eligible for facilitation such as automatic licensing; lightweight on-device deployment is outside. Technology already public through open source or academic publication is excluded outright, and future open-source releases are eligible for automatic licensing — which presumes the item is controlled and merely simplifies the procedure, a different thing from being out of scope. The announcement commits to no review time.

What the draft and Q&A do not settle is whether a foreign cloud operator hosting a Chinese model counts as a technology export. A commenter on the Geopolitechs analysis raised exactly this, naming Kimi K3 on Amazon Bedrock. The nearest category in the Q&A is a Chinese company's own overseas cloud, which assumes the operator is the Chinese developer; a third-party marketplace listing is not that. This piece is not asserting hosting is covered, or exempt: the text does not say, and companies with a Bedrock or Vertex listing will be asking.

What the open-weights economy is exposed to

The public-domain exclusion is real relief for anyone downloading an existing checkpoint. It is not a promise about the next release. The draft separates permission to use what has been published from the conditions attached to sending something new across the border, and automatic licensing for future open-source drops is a procedure, not a right.

That split lands on the same seam the open-versus-closed gap has tracked all year. Chinese labs have built their foreign distribution on downloadable weights and permissive licences; XenoSpectrum points out that DeepSeek put an MIT licence on its March 2025 V3-0324 weights. A licence is permission to use what you hold. It says nothing about the export status of the successor. If the ranking clause survives consultation, a model family can be free to download and restricted to ship, in the same week.

What would settle it

Three things would move this from speculation to policy. A final text that names the metrics and the bodies doing the ranking, so coverage can be checked rather than guessed. Guidance, or a first enforcement action, on third-party hosting. And published review times for automatic licensing, since a facilitation measure with no clock is a queue.

Until then, the asymmetry is the story. Compliance teams have an enforceable filing duty now, on a list whose boundaries are partly unreadable and partly not yet law. The ministry frames the revision as ordinary control to prevent technology escaping control or spreading inappropriately, and says it targets no particular country, region or entity. Lian Jye Su of Omdia told the Associated Press it could also be seen as a response to Western demands for technological sovereignty. Both readings can hold at once. What does not hold is the assumption that the draft is the only thing to watch.