China's Ministry of Commerce and Ministry of Science and Technology have opened a public consultation on a draft amendment to the 'Catalogue of Technologies Prohibited or Restricted from Export': 23 of the 40 proposed items concern AI, for the first time including the models themselves, agents, and compute clusters, rather than just chips. Closed on-premise deployments of restricted models abroad will require licensing, while APIs, SaaS, web and mobile applications, and open weights remain outside the scope of control. The draft is open for comments until November 15, 2026, and mandatory pre-registration of export transactions has been in effect since October 16.

image
image

What happened

On October 16, 2026, China's Ministry of Commerce (MOFCOM) and Ministry of Science and Technology (MOST) issued Announcement No. 48: a draft amendment to the 'Catalogue of Technologies Prohibited or Restricted from Export' is open for public consultation until November 15, 2026. The draft proposes adding 40 technologies in three areas: AI, biomedicine, and photovoltaics. Fourteen items are proposed for a full ban — including AI generation and mutation of malicious code, cell and gene therapy platforms, and the production of perovskite and tandem solar cells. Another 26 items fall under licensing restrictions, including AI vulnerability search. Twenty-three of the forty items concern AI: large models, agents, compute clusters, and information processing. In parallel with the publication of the draft, mandatory pre-registration of export transactions in restricted areas has been in effect since October 16 — until the catalogue enters into force.

Context

Previously, China's export controls in the AI sphere effectively covered hardware: chips and compute complexes. The new edition of the catalogue shifts regulation to the level of software objects: deploying restricted models abroad is equated with the export of technology, and model weights and code are considered export goods for the first time. The draft explicitly excludes open-source technologies and methods published in scientific articles from control, so open weights and public methodologies remain available without licenses. Service channels for consuming models are also unaffected: API calls, SaaS, web and mobile applications, and lightweight local deployments. A separate provision concerns vendor infrastructure: installations of restricted models in their own overseas clouds are proposed to be processed automatically, while closed on-premise deployments for overseas customers require a full license.

Why this matters for the industry

For the industry, this is the first time China has included AI models, agents, and compute clusters in the export control catalogue, rather than chips, creating a precedent for regulating model weights and code as export goods. Practical pressure is currently concentrated on closed on-premise contracts with overseas customers: pre-registration slows down new deals, and the timelines and terms of unfinished projects need to be rechecked. The channels on which current business models of Chinese vendors are built — APIs, SaaS, open weights, and their own overseas clouds with automatic clearance — remain intact. An expected but not yet approved adjustment to the release policy of Chinese labs toward open-weight may further shift distribution toward open weights and cloud schemes. A separate effect for the security industry: the ban on AI generation of malicious code and the licensing of AI vulnerability search affect dual-use areas, including the publication of corresponding tools and benchmarks.

Why this matters for users

For most readers, nothing changes directly: using Chinese models via APIs, SaaS, web and mobile applications, working with open weights, and lightweight local deployments are formally not affected by the new controls. The difference appears where a company deploys a restricted model on its own servers abroad: such a closed installation will require a license, so corporate deployments of Chinese models in self-hosted format may shift in timing and be revised in terms. If you are choosing between API access and a closed on-premise deployment, the service channel currently has less regulatory uncertainty. The final wording is not fixed: until November 15, 2026, a comment window is open, and the final list of items and thresholds may differ from the proposed draft.

What is currently unknown / limitations

The definitions of 'large models,' 'agents,' and 'compute clusters' are given without disclosed thresholds — size, criteria, and evaluation methodology have not been published, so it is impossible to determine in advance which specific models and systems will fall under licensing. The catalogue has not yet been approved: until November 15, 2026, the list, thresholds, and exclusions may change. Predictions that SaaS will 'win' over self-hosted, that vendors will move clients to their own clouds, or that they will strengthen open-weight strategies, are hypotheses based on a single draft, not established facts, and should be correctly verified against the first licensing decisions and the final edition of the catalogue.

Sources

Author

Look at AI, editorial team