China's AI Export Draft Spares API Calls and Public Weights. Overseas Deploys Aren't

If your app calls a Chinese model through an API, China's newest export-control draft says that call is not an export. If a Chinese vendor installs a restricted model on servers in your country, the same ministry says that one is.

On October 16, China's Ministry of Commerce (MOFCOM) and Ministry of Science and Technology published Announcement No. 48 of 2026. It proposes adding 40 technologies to the Catalogue of Technologies Prohibited and Restricted from Export, and 23 of them are AI: large models, agents, computing clusters and information processing. Public comment runs from October 16 to November 15.

It's a draft. But one piece already applies: an interim pre-export registration for the listed technologies, in force from the day of the announcement until the revised catalogue takes effect.

Across all three fields (AI, biomedicine and solar), the draft proposes 14 technologies for prohibition and 26 for restriction. The ministry's own AI examples are concrete. "AI-driven malicious code generation and mutation technology" would be prohibited. "AI-assisted vulnerability discovery technology" would be restricted.

The interim registration names four triggers: transferring ownership of a listed technology abroad, licensing it for overseas use, a domestic owner coming under foreign control, and any other case MOFCOM specifies by notice (notice). Exports that started before October 16 but haven't finished are covered too.

A ministry spokesperson said the rules aim to "prevent misuse and abuse" and "ensure that AI remains under human control," per The Next Web. MOFCOM also says the revision is not aimed at any specific country, region or entity, and that most AI technologies can still be exported freely.

Calls through the gate, crates at the desk: the draft treats serving a model and shipping it differently.

The spokesperson's Q&A says the test is whether a restricted technology moves from mainland China to another country.

The API row is spelled out. The Q&A says offering a restricted large model through "API 调用、APP / 网页交互、SaaS 应用、本地端侧轻量化部署" (API calls, app or web interaction, SaaS and lightweight on-device deployment) is not large-model technology export.

The open-source rows are the ones to read twice. Technology that has "进入公共领域" (entered the public domain) through open source or academic papers is not covered. For releases still to come, the ministry proposes automatic licensing and says it should basically achieve "即报即出", export as soon as it is filed. So the draft adds a filing step in front of a restricted model's open release, and says the step should not hold it up. How fast that works in practice is unknown until the rule is final.

The 23 AI items and their technical parameters sit in Attachment 1, a .wps file the notice page doesn't render, so the figures below come from news reports, not from the attachment itself.

The Next Web, citing Bloomberg, reports that the large-model curbs cover weights, source code and other core components of models with at least 2 trillion parameters, or models in the world's top 10 on tests such as performance and safety. AP, via Fortune, reports the same 2-trillion figure, plus prohibitions on core technology of large models trained on sensitive national data and on AI agents designed for highly sensitive environments such as national defence and critical information infrastructure.

Both outlets report that Moonshot AI's Kimi K3 and Alibaba's Qwen3.8-Max exceed that size (TNW, Fortune). The draft itself names no models.

In July, the Financial Times reported that MOFCOM was consulting Alibaba, ByteDance, Zhipu and other companies on possible controls, including tighter limits on foreign downloads of model weights, while overseas customers could keep using hosted Chinese models (Implicator, citing the FT). The October draft keeps that split between serving a model and handing it over, and offers open source a faster path.

Installing a restricted model on servers abroad is the case the draft pulls into export control.

Nothing in your stack breaks today. A draft can change before it becomes final, and the details that matter most to you sit in Attachment 1, not on the notice page. This isn't legal advice. If your company depends on a Chinese model in production, talk to counsel and read Attachment 1 yourself.

Pin the exact weights you run. Weights that are already public sit outside the draft, but a restricted model's next release may have to go through a filing step first. If you self-host an open model, record the commit you tested and keep a local copy where the model's license allows it. With huggingface_hub, a revision can be a commit SHA:

from huggingface_hub import snapshot_download

path = snapshot_download(
    repo_id="deepseek-ai/DeepSeek-V3",
    revision="<commit-sha-you-tested>",
    local_dir="./models/deepseek-v3",
)
print(path)

Keep a second provider wired in. Many hosted models, DeepSeek's included, expose an OpenAI-compatible API, so a fallback can be two clients from the openai package and a loop. Models and keys come from the environment:

import OpenAI from "openai";

const providers = [
  {
    client: new OpenAI({
      baseURL: process.env.PRIMARY_BASE_URL,
      apiKey: process.env.PRIMARY_API_KEY,
    }),
    model: process.env.PRIMARY_MODEL!,
  },
  {
    client: new OpenAI({
      baseURL: process.env.FALLBACK_BASE_URL,
      apiKey: process.env.FALLBACK_API_KEY,
    }),
    model: process.env.FALLBACK_MODEL!,
  },
];

Then try each provider in order and keep the last error:

export async function complete(prompt: string) {
  let lastError: unknown;
  for (const { client, model } of providers) {
    try {
      const res = await client.chat.completions.create({
        model,
        messages: [{ role: "user", content: prompt }],
      });
      return res.choices[0].message.content;
    } catch (err) {
      lastError = err;
    }
  }
  throw lastError;
}

Run your evals against the fallback too, or you're guessing.

Ask about on-prem deals in flight. If a Chinese vendor is installing a model in your datacenter and that model falls under the listed technologies, the Q&A treats it as overseas local deployment, and the interim registration covers listed-technology exports already under way on October 16. Ask the vendor whether it applies and whether they have registered.

Comment if it affects you. The notice accepts comments by email, fax or post until November 15, with the contact details on the notice page.

The part you can't check yet is the thresholds. Which models count as restricted is decided in Attachment 1, and the final rule can still move those lines.

Do you run a Chinese open-weight model in production, or only call one over an API? Would a filing step in front of the next open release change which models you build on? Tell me in the comments.

If you're building agents on top of models you don't control, the hard part is the layer around the model: tool calls, fallbacks, and guardrails that still hold when a provider changes under you. The AI Agents Pocket Guide covers those patterns in a short read.

I also build Hermes IDE, so weigh this with that in mind: it runs Claude Code, Codex, OpenCode and other agents side by side, each in its own terminal and worktree, and lets you pick the agent and model per task. It's free, source-available, and on macOS, Windows and Linux (GitHub).