China Wants Export Licenses for AI Models Over 2 Trillion Parameters or Ranked in the Global Top 10, but Published Open Weights and API Access Stay Exempt

China has drafted export licensing for its most powerful AI models. On 16 October 2026 the Ministry of Commerce and the Ministry of Science and Technology published Announcement No. 48 of 2026, a proposal to add 23 AI technologies to the country’s catalogue of technologies that are banned or restricted for export.

The line that matters most for model builders: the weights, key checkpoints, source code and architecture of any large model trained with at least 10²⁶ FLOPs, with at least 2 trillion parameters, or ranked in the global top 10 would need a license before they leave China. The draft is open for comment until 15 November, and a temporary registration rule for these exports started on the day it was published.

Two carve-outs matter more to most developers than the thresholds. Models already released as open source stay outside the rules, and the ministry says serving a restricted model through an API, an app or SaaS is not a technology export at all. Here is what the documents say, and what is still unclear.

What Beijing published on 16 October

The notice went up at 16:00 Beijing time (1:30 PM IST) on 16 October. It covers 40 technologies: 23 in AI, 5 in biomedicine and 12 in solar manufacturing.

In a question and answer note released the same day, a Ministry of Commerce spokesperson said 14 of the 40 would be prohibited outright and 26 restricted, meaning they need a license. The spokesperson also said the revision “does not target any specific country, region or entity.”

Comments go to jinxianmulu@mofcom.gov.cn, or by fax or post, until 15 November. No date is given for the final catalogue.

The three tests that pull a model into the rules

The large model entry (266504X in the draft annex) lists three triggers, and any one is enough. It covers more than weights: key checkpoints, source code, architecture design, and training and inference acceleration techniques are all named.

The ranking test is the one to watch. The annex counts a model if “mainstream domestic and foreign evaluation bodies” or “large industry platforms” rank it in the global top 10 for overall performance, specialized ability, global call volume, safety or training efficiency. A cheap model that tops a usage chart could qualify on call volume alone.

What stays outside: APIs, apps and published weights

The spokesperson was direct on cloud access. Using a restricted model to offer API calls, app or web chat, SaaS products, or lightweight on-device deployment “does not fall within the scope of large model technology export management.”

Deploying a restricted model on servers abroad does count. If it runs on the exporter’s own overseas cloud, the ministry says an “automatic license” can apply.

Published work is excluded. Technology that has already entered the public domain through open source releases or academic papers is outside the catalogue. Open sourcing restricted AI technology in future gets automatic license treatment, according to a footnote in the annex, and the spokesperson said that should “basically achieve report and export.”

So the biggest open model we have covered, Moonshot’s Kimi K3, is above the size line at about 2.78 trillion parameters according to its Hugging Face listing. Its weights are already public, so on the draft’s own wording it is outside the rules. DeepSeek V4.1 Flash 1017, released the day after the notice, is about 763 billion parameters on Hugging Face, well under 2 trillion. Whether a future release like it trips the top 10 test depends on rankings nobody has named yet.

The rest of the AI list: agents, bug hunting and chips

• Prohibited: AI-driven malware generation aimed at critical infrastructure, defense or core government systems, for example with a 60% success rate against multi-engine malware detectors. Also banned: high-performance agents built mainly for those settings, and models trained on China’s “core data.”
• Restricted bug hunting: AI-assisted vulnerability discovery that scores 75% or more on an authoritative security benchmark, builds full exploit chains for known flaws in mainstream operating systems or browsers at least 50% of the time, or finds 5 or more undisclosed high severity bugs in one major open source project in a single run.
• Restricted agents: planners that split a natural language request into 20 or more steps with 80% decomposition accuracy and a 90% average subtask success rate, systems running 60 or more cooperating agents, or tool use across 200 or more third-party tools at 90% selection accuracy.
• Restricted chips and clusters: AI chip design using 14nm or finer processes, 2.5D or 3D packaging, or high-speed interconnect, plus cluster technology for setups with more than 10,000 accelerator cards, such as interconnects of 800 GB/s or more.

The chip item is wider than it first looks. One of its “any one” features is simply having floating point or integer compute capability, which on a plain reading covers almost every AI processor design.

How the 10²⁶ line compares with the US and EU

Beijing did not invent the compute figure. The US AI Diffusion rule of January 2025 required a license to export the weights of closed models trained on more than 10²⁶ operations, and it also left published weights alone. The Commerce Department announced it was rescinding that rule on 13 May 2025, before its compliance date.

We tracked the US side of the open weights fight in the open-weight letter that drew 50 signatories in July. China’s draft takes a clear position: public weights stay free, private transfers get checked.

Confirmed vs not yet known

One gap stands out. Interim registration covers selling technology abroad, licensing it for use outside China, or a foreign takeover of its owner. The notice does not say whether a public open source license counts as licensing for overseas use.

What it means for Indian developers

If you call DeepSeek, Qwen, Kimi or GLM through an API, or use their chat apps, nothing changes on the ministry’s own reading. The same goes for teams in the US, Canada and Australia using OpenRouter or a cloud marketplace.

Open weights you have already downloaded, or can download today, are public and stay outside the catalogue. The open question is the next frontier release from a Chinese lab. If it ranks in a global top 10, its upload could need a license step first, even an automatic one. That could add delay, and the draft gives no timeline.

The bigger change is for business deals. An Indian company that wants a Chinese vendor to install a restricted model on its own servers, license its training stack, or buy a Chinese AI startup is now in licensing territory. Registration already applies to deals that started before 16 October and are not yet finished.

Security teams should note the bug hunting entry. Chinese AI vulnerability tools that hit those numbers may get harder to license abroad, so ask your vendor now.

The timing is not random. Fights like OpenAI’s claims about a Moonshot-linked extraction campaign show how much value sits in weights and reasoning traces. Beijing now treats its top models the way Washington once proposed to treat American ones.

FAQ

Does this ban DeepSeek or Qwen APIs outside China?

No. The Ministry of Commerce says offering a restricted model through API calls, apps, web chat, SaaS or lightweight on-device deployment is not a large model technology export.

Are open-weight models already on Hugging Face affected?

No. The notice excludes technology that has already entered the public domain through open source releases or published papers. Future open source releases of restricted technology would get an automatic license.

When do the rules take effect?

The catalogue is still a draft, with comments open until 15 November 2026 and no start date announced. A temporary registration requirement for exporting the listed technologies has applied since 16 October 2026.

What counts as a global top 10 model?

A model qualifies if public evaluations by mainstream evaluators or large industry platforms rank it in the global top 10 at the time of export, on performance, specialized ability, call volume, safety or training efficiency. No specific leaderboard is named.

Is the 2 trillion threshold total or active parameters?

The draft does not say. That matters for mixture of experts models, where total parameters can be many times the active count. Kimi K3, for example, lists about 2.78 trillion parameters in total, but it is already public and so excluded.

Featured image: Ministry of Commerce building on Chang’an Avenue, Beijing, by 維基小霸王 via Wikimedia Commons, CC BY-SA 4.0, cropped and resized.