China has drafted its first export controls aimed squarely at frontier AI, and the part that will surprise many companies is who it catches. If your organisation self-hosts a Chinese open model abroad to keep sensitive data inside your own walls, that is precisely the arrangement the draft seeks to control. This is the first time a major AI-producing country other than the United States has put formal outbound limits on model weights and agent systems.
The proposal, issued on 16 October 2026 by China's commerce and science ministries as Announcement No. 48, would add 40 technologies to the export control catalogue, 23 of them in AI. Model weights, checkpoints, source code and training know-how become restricted if a model meets any one of three tests: at least 10^26 FLOPs of training compute, at least 2 trillion parameters, or a global top-10 position on public rankings or call volume. Agent systems are controlled separately, by their behaviour, so an orchestration framework wiring up hundreds of tools could qualify even on a modest underlying model. The catalogue additions are open for comment until 15 November, while a pre-export registration duty already applies, covering exports already under way.
The line that decides most corporate exposure is how you consume a model. The ministries say using a model through an API, app, website or SaaS does not count as exporting it, so cloud calls are clear. Running a restricted model locally on infrastructure outside China does count, which needs a licence held by the Chinese supplier. That is the trap for the privacy-conscious: self-hosting, the setup many firms choose precisely to keep data in-house, is the one the controls capture, and licences can be revoked or conditioned.
Two design choices make this hard to plan around. The top-10 test is dynamic and names no ranking body, so a model that sits below the compute and parameter thresholds can still become restricted after you have deployed it if its popularity rises. And agent rules turn on system behaviour rather than the base model, an ambiguity commentators flag as unresolved. Teams relying on self-hosted models like DeepSeek-V4-Pro, Qwen-3-8-Max or Kimi K3, which we review, are the most exposed.
The honest caveats are real. This is a draft open to change before the catalogue is finalised, key terms such as open source are not defined, and analysts estimate no released Chinese model currently exceeds the 10^26 FLOP threshold, so weights published openly today sit outside the controls. But because the registration duty bites now and the top-10 status can shift after deployment, the Cloud Security Alliance's advice is sound: legal and procurement teams should ask Chinese suppliers about licences before, not after, the rules take hold.