On October 16, 2026, China’s Ministry of Commerce and Ministry of Science and Technology did not ban the export of open-weight models. They published a draft revision of the Catalogue of Technologies Prohibited or Restricted from Export. The AI lines would prohibit some high-end offensive tools, some agents aimed at critical infrastructure and government work, certain deep-synthesis authentication systems, and large models tied to China’s core data. They would restrict other detection tools, steganography systems, and AI-assisted vulnerability discovery. Open weights, as a class, are not on that list.
That is a narrower document than the headlines, and a more awkward one if your AI plan depends on technology you do not control. Some triggers are performance scores. The two items a board will ask about first are not. Models turn on a legal category. Agents turn on a cross-reference whose numbers are still missing.
The reading here follows the joint notice and an English reproduction of the annex circulated by Geopolitechs. It is not an official translation. Where that English breaks off, the clause is unconfirmed. Check the Chinese original before anyone locks a compliance memo to a percentage.
What is already in force, and what is only a proposal
Public comment runs through November 15, 2026. The notice tells exporters to register listed technologies before export until a revised catalogue is formally issued and takes effect, including exports already started and not finished. Read that as the duty that already applies to technologies on the current list. It runs through the commerce ministry’s technology-trade system.
A draft does not put newly proposed AI lines into force. Those bind only after formal issuance, unless a final notice says otherwise. Treating the comment draft as if it already banned a product is how a sourcing memo gets the calendar wrong.
The transactions the catalogue already cares about are concrete. They cover ownership transfers, including intellectual property, overseas licensing of technology still held in China, a shift in ownership or actual control to an overseas entity, and any other case the Ministry of Commerce designates. The file asks for both parties, the destination, the technology and its intended use, and an estimated value.
The annex is not an AI-only document. It also proposes changes covering five biomedicine technologies and twelve photovoltaic technologies, with solar controls extending to key equipment that incorporates those technologies. Anyone reading only the model headlines will miss the rest of the catalogue.
Offense is prohibited. Vulnerability hunting is restricted.
Under prohibited “information confrontation technology, ” the draft targets a specific kind of system. It does not cover software in general. In the circulating English text, it covers AI-driven malicious-code generation and mutation, adaptive changes while code is running, and automated creation of evasion variants. The technology has to be of a kind that may be used against national critical information infrastructure, national defense and the military industry, or core government affairs, or to bypass national-security defenses.
Even then, the text does not treat every nasty script as an export ban. The plain test is this: mutate attack code, evade detectors, keep a sensitive target in view, and clear a stated score. In that English rendering, the gates include alternatives such as:
- A 60 percent attack-success rate against multi-engine malware detectors, 85 percent against a single mainstream antivirus product, or 90 percent against machine-learning models.
- Detecting sandboxes, debuggers, or emulators, identifying a security product’s type and version, or escaping a sandbox. Or, while keeping the malicious function, rewriting 50 percent of the code structure or control flow on each execution.
- Twenty functionally equivalent but structurally different variants in one run, or 80 percent end-to-end automation. More than ten variants every 24 hours from one baseline, with 30 percent syntax-tree divergence. Or sampled variants with 90 percent behavioral-profile consistency in sandboxes.
Read those figures as pass-fail tests in a draft regulation. Not a product roadmap. Not settled law yet. A coding assistant that writes ordinary software sits outside this line. The line covers a system built to mutate attack code, dodge detectors, and aim at critical or military targets, once it clears those scores.
Vulnerability discovery sits in a different bucket. A new item, added to five existing information-confrontation entries, would restrict AI-assisted vulnerability discovery rather than prohibit it. In the circulating English text, the proposed tests include a 75 percent score on vulnerability reproduction or exploitability in authoritative security benchmarks. For known public vulnerabilities, they also include 50 percent end-to-end success on mainstream operating systems or browsers, or 40 percent success at building an exploit that achieves arbitrary code execution.
A further clause, on tools that improve discovery and exploitation efficiency, reaches “10 times or” and then breaks off. That efficiency test is unconfirmed. Do not treat it as a complete legal trigger.
Agents, core data, and safety tools that can fail by being too good
AI agents get their own prohibition, and it is about the job, not the brand. The draft would prohibit agents mainly used in critical information infrastructure, defense and the military industry, or core government affairs, if they reach the “high performance” indicators cross-referenced to restricted agent technology under code 266505X. Those indicators are not spelled out in the English excerpt. For anyone selling agentic automation into Chinese infrastructure or government work, or moving that technology offshore, this is the clause to watch. It is also the clause you cannot yet price.
Large models are handled more narrowly than the parameter-count stories suggest. The prohibited item, in the English rendering, is large models that provide services after being trained on China’s core data (核心数据, in standard PRC legal usage), with scope set by the Data Security Law and related rules. Core data is the higher tier. It is not the same category as “important data” (重要数据). English summaries have already blurred the two. Confirm the Chinese original before a memo locks either phrase.
The available text does not impose a general compute cap, a parameter floor, or a global top-10 test on model weights. Secondary write-ups have repeated thresholds of that kind, including 10^26 training FLOPs, at least 2 trillion parameters, and a ranking rule. Some have also described a tidy total of 23 AI technologies. Those claims are not established in the annex text available here. The visible categories are high-performance detection, information confrontation, large models, and agents. The text does not give a free pass for publishing weights. It also does not say that an API, an app, or a lightweight on-device copy escapes licensing. Building a sourcing plan on either rumor is how a deal gets surprised.
The detection rules use the same scorecard, pointed at synthetic media rather than malware. Authentication systems and equipment aimed mainly at security risks in the cross-border transmission of China’s network data would be prohibited where accuracy and recall hit 95 percent for deeply synthesized video, audio, images, or multimodal content.
Two further items, proposed as restrictions on top of seven existing detection entries, go higher or sideways. Deep-synthesis detection systems at 98 percent accuracy and recall. And video or image steganography and extraction that combine an error rate of 0.5 percent or recall of 99.9 percent, a false-positive rate of 0.1 percent, and a similarity bar of SSIM 0.999, PSNR of 41 dB, or LPIPS of 0.005. Those last three measure how close an image stays to the original. They are not a loose comment on picture quality. A trust-and-safety product can become controlled technology once it is simply good enough. The label on the sales deck does not decide it.
Do not import a fast track that belongs to another industry
There is facilitation language in this package, and it is easy to misread. The automatic-licensing provision in the text available applies to biomedicine: overseas licensing that does not transfer ownership. It is not a documented fast track for publishing restricted AI technology or model weights. Overseas Chinese data centers, foreign joint research, and standards work do not, on this record, get a special AI exemption either.
The American comparison needs the same caution. Press accounts around July 21, 2026, nearly three months before this catalogue draft, described White House discussions about open models. Ideas in that mix included a clearinghouse for who gets frontier models, entity-list treatment of Chinese AI firms, and liability for U.S. firms hosting Chinese models. Those were reports of consideration and informal pressure. They were not statutes. Nothing in the public record through October 16 shows those ideas becoming model-weight export controls. Calling Beijing’s draft a mirror image of rules Washington has already imposed overclaims both sides.
Secondary accounts of an earlier World AI gathering quote Xi Jinping encouraging open-source cooperation, including with the Global South, and cite signatories to a World AI cooperation body. That pitch is not in this revision. The commerce ministry text does not promise easier AI exports through that organization.
The business reading, offered as a reading and not as a forecast of who wins the model race, is plainer. Beijing is writing use conditions and performance tests into an export list. That gives the state a way to stop the sharpest offensive tools and sensitive-use agents, and to put a licensing question on large models bound up with core data, without a class-wide ban on every Chinese model anyone can download. For a company running those models in its own cloud, or embedding agents in operations software, the live risk is narrower and more annoying. The weights on your servers, the agent in the workflow, and the detector that is good enough to trust may become controlled exports once the catalogue is final, with a registration file and a political veto, while the comment period is still open.
Questions worth asking before you rewrite the vendor plan
Is China banning the export of open-weight models?
Not on the draft text that can be confirmed. The large-model prohibition described so far covers models that provide services after training on China’s core data. It is not a class-wide ban on open weights, and a special open-source license for these AI items has not been established.
What has to happen before November 15, and what applies before the rules are final?
Comments close on November 15, 2026. Technologies already on the export list keep today’s registration duty, including deals already underway, through the commerce ministry’s technology-trade system. Newly proposed AI lines do not themselves take effect during the comment period unless a final notice says otherwise.
Are ordinary coding tools and security scanners covered?
Not on the thresholds in the available English text. The offensive-code provisions, as rendered, require specific malicious-code capabilities, sensitive targets, and numeric performance gates. AI-assisted vulnerability discovery is proposed as a restriction, not a prohibition, and only above stated benchmark scores. The efficiency clause is cut off, and the agent thresholds behind code 266505X are missing, so those boundaries are not yet firm.
Does an API, a website, or a lightweight app avoid the controls?
That carve-out is not in the draft material that holds up. Do not treat access method as a safe harbor until the final Chinese text says so.
Which deals should a board look at this month?
Inventory in-flight licenses, weight transfers, and embedded agents against technologies already on the export list. Then flag, as watch items rather than banned items, products near the proposed gates: offensive-code systems, high-scoring vulnerability tools, agents aimed at critical infrastructure or government work, core-data models, and synthetic-media detection or steganography above the stated scores.
Performance figures and item descriptions follow the October 16, 2026 joint draft of the Ministry of Commerce and the Ministry of Science and Technology, as reproduced in English by Geopolitechs. They are not a ministry-issued translation. The vulnerability item breaks off mid-clause in that rendering. Confirm the Chinese original before treating any threshold as final.