China Wants a Licence Before Its Biggest Model Weights Leave

For three years the export-control story in AI has run one way. Washington restricts the chips; Beijing works around them. On October 16, China's Ministry of Commerce and its science ministry published a draft that flips the direction. For the first time, the country that has done more than any other to give frontier-class models away for free is proposing rules on when it can stop doing so.

What is on the list

The draft adds 40 items to China's controlled-technology catalogue. Twenty-three are AI technologies, covering large models, agents, chip designs and computing clusters. The rest are 12 solar technologies and 5 biomedicine items, including gene therapy.

For large models, the controls would reach the parts that matter most to anyone trying to reproduce or run a system: model weights, source code and other core components. According to Bloomberg's reporting on the draft, the rules would apply to models with at least 2 trillion parameters, or models ranking in the global top 10 on measures such as performance and safety.

The draft itself names no models. But Bloomberg and the Associated Press reported that Moonshot AI's Kimi K3 and Alibaba's Qwen3.8-Max both exceed the size threshold.

The chip side is narrower but pointed. Design know-how for AI chips made at 14 nanometres or below, or built by stacking dies in 2.5D or 3D packages, would be covered, along with some memory chip designs.

What stays open

The exemptions are as important as the controls.

Open-source code and published research are explicitly carved out, so weights and papers already in public are not being clawed back. Chinese companies can keep serving overseas customers through apps, websites and APIs. A developer in Berlin or São Paulo who calls a Chinese model over the network should notice nothing.

What changes is physical custody. Under the draft, running a covered model on servers abroad counts as an export. Firms that run models on their own overseas cloud servers could receive a licence automatically, which protects the Alibabas and Tencents of the world. A third party wanting to host a frontier Chinese model outside China is a different matter.

The part that already applies

Most of the draft is open for public comment until November 15. One piece is not. A temporary registration requirement took effect the same day the draft was published: companies must register before exporting listed items, and the rule also covers deals that have not yet closed.

That is a small administrative step with a large signal. Even before final rules exist, Beijing now has a list of who is sending what, to whom.

Why Beijing says it is doing this

A ministry spokesperson said the rules aim to "prevent misuse and abuse" and "ensure that AI remains under human control," and that the plan does not target any country or firm. The framing borrows the language of AI safety rather than national security, which is a choice worth noticing. It positions China's controls alongside, not against, the growing body of frontier-model governance elsewhere.

The idea is not new. The Financial Times reported in July that China was weighing export controls on AI models and chips, and Beijing had earlier been reported to be considering limits on overseas access to its top systems. What is new is a concrete list with concrete thresholds.

What it means for open weights

The most consequential effect may be on releases that have not happened yet.

Chinese labs have driven much of the open-weight frontier. Their models have become the default starting point for a large share of fine-tunes, local deployments and research projects worldwide. Under this draft, already-public weights are exempt, but a future model above the threshold would be controlled technology at the moment it was trained. Publishing it openly would, in practice, need the state's comfort.

That does not mean Beijing will block open releases. It may well keep approving them; open weights have been a powerful tool of soft influence and a way to set global defaults. But the decision would move from a lab's strategy meeting to a government licensing process. A standing mechanism to slow or stop a release is a different world from no mechanism at all.

The threshold also creates an incentive problem. Two trillion parameters is a bright line. Labs that want to keep shipping openly have a reason to stay under it, or to release smaller distilled siblings while the flagship stays home.

The symmetry problem

There is a familiar shape here. American controls have long tried to keep the most capable compute inside a trusted perimeter while letting services flow out. China's draft does something similar with models: the service travels, the weights stay put unless licensed.

For developers outside both countries, that is a narrowing. The two largest sources of frontier capability would both treat the underlying artefact as controlled, while selling access to it as a utility.

The takeaway

Nothing in this draft switches off a Chinese model anyone uses today. APIs stay open, published weights stay published, and the comment window runs to mid-November. But the draft makes explicit something that had only been assumed: the most capable Chinese weights are a strategic asset, and the state intends to decide when they cross a border.

The open-weight era did not end this week. It got a licensing office.