China Prepares Export Controls for AI Technologies

What exactly falls under control

I would not rush to frame this news as a passport-based filter: the published measure regulates technology exports from China, not a user’s nationality. China’s Ministry of Commerce and Ministry of Science and Technology outlined the framework in Announcement No. 48 of 16 October 2026.

The draft revised catalogue contains 40 controlled technologies, 23 of which are related to AI. They include large-model technologies, intelligent agents, computing clusters, information processing, selected chip-design and advanced-computing developments, as well as certain offensive cyber capabilities.

• Prohibited technologies: no export licence is available for these.
• Restricted technologies: transfers may proceed only after government review and licensing.

For large models, the issue is not limited to a finished product. Controls may cover weights, checkpoints, source code, architecture, training and inference methods. Overseas deployment or providing the means to reproduce a model independently appears far more sensitive than ordinary access through a website, app, or cloud API.

As of 3 November, the draft was still open for public consultation, scheduled to run until 15 November 2026. At the same time, temporary registration for certain transfers reportedly took effect on the announcement date, according to a Cloud Security Alliance research note. There is no blanket ban yet, but the monitoring mechanism is already active.

Why nationality is not the main criterion

The practical takeaway is straightforward: access is not being promised exclusively to Chinese citizens or to nationals of supposedly friendly countries. The announcement contains no published list of nationalities allowed or barred from using Chinese AI services.

Country factors can still matter indirectly. Regulators may consider the destination, the recipient’s ownership, end use, sanctions restrictions, and links to military or strategic entities. The same asset can therefore be assessed differently depending on the transaction, but the legal trigger remains a technology export.

From an engineering perspective, I would first examine the delivery boundary rather than the user’s passport: are weights or code being transferred, can the recipient run the model independently, where is the infrastructure located, and who controls the end use? A cloud API and the export of a reproducible model are fundamentally different scenarios.

China appears to be leaving room for exports of AI services while seeking to retain control over what would allow a foreign recipient to reproduce key technology. The key question is no longer the customer’s citizenship, but how broadly authorities will define the act of transfer itself.

We previously covered how OpenAI API security controls can trigger account-owner alerts and require clear compliance processes. That context helps explain the operational consequences of China-related AI access restrictions.