China drew a border around 23 AI technologies. Open source sits outside it

THE SIGNAL IN ONE SENTENCE

An artificial intelligence model can cross a border in several ways. A company can transfer the model weights to a foreign buyer. It can license the underlying technology. It can place the system in a data center abroad. It can keep everything at home and let overseas customers call an application programming interface. It can publish source code, weights or a paper that anyone can retrieve. It can also shrink the model until it runs on a phone. Those routes can look similar to a user. They do not look similar to China's proposed export rules. On October 16, China's Ministry of Commerce and Ministry of Science and Technology published a draft revision to the country's catalogue of technologies prohibited or restricted from export. The consultation covers 40 technologies across artificial intelligence, biomedicine and photovoltaics. Twenty-three are in AI, spanning large models, agents, computing clusters and information processing. The draft is not the final catalogue. Public comments run through November 15. Yet one part began immediately: exporters must register covered technology transfers before they occur while the formal revision is pending. The requirement also reaches covered exports that have started but are not complete. The ministries describe four kinds of transaction that require registration. They include transferring technology ownership abroad, licensing domestic technology for overseas use, changing a technology owner's or actual controller's status to a foreign entity and any other case the commerce ministry specifically identifies. The registration asks for the exporter and recipient, destination, technology, intended use and expected value. That is a reporting step, not the same thing as a final export license. It still gives regulators a live map of transactions while the proposed rules are being debated. The proposed catalogue divides the full 40-technology package into 14 prohibited technologies and 26 restricted technologies. The official explanation gives two AI examples. Technology that autonomously generates and mutates malicious code is listed among the proposed prohibitions. AI-assisted vulnerability discovery is listed among the proposed restrictions. Those examples matter because they show that the document is not a blanket ban on exporting Chinese models. The ministries say most AI technology will remain freely exportable. The policy tries to draw boundaries around capabilities, transfer methods and risk instead of treating every chatbot as a controlled object. Then comes the unusually important open-source clause. AI technology that has already entered the public domain through open-source release or academic publication would sit outside the proposed export management scope. New open-source exports, overseas computing centers owned and operated by Chinese companies, overseas chip fabrication, international joint research and standards work may qualify for automatic licensing or other simplified treatment. That does not make open source a magic invisibility cloak. A company still needs to know whether the exact technology is already public, whether unpublished components remain controlled, whether a later transfer includes private training systems or operational knowledge, and whether other laws apply. But the stated boundary gives Chinese developers a powerful reason to publish before a technology becomes commercially or strategically awkward to move. The service boundary is just as consequential. The ministry says overseas local deployment of a restricted model would count as a technology export. Deployment on a company's own overseas cloud may receive simplified licensing because the risk is considered more controllable. By contrast, letting overseas users call a restricted model through an API, app, website or software-as-a-service product would not count as exporting the model technology. Nor would lightweight local deployment on an end device. That distinction separates access from transfer. If a model stays on servers controlled by its Chinese operator, a foreign customer receives outputs without necessarily receiving the weights, training recipe, deployment stack or right to reproduce the system. Moving the model into a foreign-operated environment gives another party much more technical control. The same answer may appear on the screen, but the underlying custody is different. This is the plain signal: AI export policy is becoming architecture policy. Companies will decide where models run, who controls the infrastructure, which pieces are published and how customers connect partly in response to regulatory boundaries. A rule written around transfer can favor hosted services over downloadable systems. An exception for public technology can favor open releases. A simpler path for a company's own overseas cloud can favor vertically integrated providers with enough capital to build abroad. That can change competition. A large Chinese company may be able to keep its most capable restricted model on infrastructure it controls and sell access around the world. A smaller developer that wants a foreign partner to operate the same system may face registration and licensing work. A university may publish research openly, while a startup built from the same idea keeps a more capable implementation private and discovers that the implementation cannot travel as easily as the paper. The boundary also creates ordinary compliance questions with no glamorous answer. What counts as model technology rather than a product? Does a fine-tuned checkpoint inherit the status of the base model? Is a quantized version merely a lightweight end-device deployment, or a meaningful transfer of controlled capability? What happens when an open model depends on a private router, evaluator, safety filter or agent harness? Does a foreign employee downloading internal weights create an export? How should a company treat mirrored repositories, model derivatives and research artifacts that were public before the rule but later changed? The ministry's explanation helps with the large categories. Companies still need a version-level receipt. For every cross-border AI release, that receipt should identify the exact weights, code, documentation, training or post-training methods, tool integrations, evaluation assets, deployment target, controller, recipient, destination and intended use. It should say what was already public and when, what remains private, which catalogue threshold was assessed, who made the determination and whether registration or a license was required. The receipt must follow updates. A model that is outside a threshold today can cross it after additional training. A harmless assistant can become a cyber tool after a private agent harness is attached. An API can turn into local deployment when a customer asks for a dedicated appliance. One commercial label can hide several legally different transfers. The cybersecurity rationale deserves careful handling too. Autonomous malicious-code generation can obviously threaten critical infrastructure, defense systems and government networks. Vulnerability discovery can support defense or offense depending on authorization, target and how findings are handled. A prohibition or license can slow a risky transfer. It cannot decide whether a capability is used responsibly once it exists, and it cannot replace secure development, access controls, monitoring, incident disclosure and coordinated vulnerability handling. Export controls also have side effects. Keeping a powerful model behind an API can make technical leakage harder, but it concentrates control and visibility in the provider. Publishing technology can broaden scientific review and reduce dependence on one vendor, but it can also distribute a capability that cannot be recalled. Requiring registration can reveal patterns to regulators, but it can burden joint research or create uncertainty if definitions lag behind fast-changing model architectures. The public-domain exclusion is therefore not simply generous or risky. It is a governance choice about when a technology becomes too distributed to manage as a confidential transfer and when openness itself serves innovation. Researchers and developers outside China should pay attention even if they never file a Chinese export form. The rule can shape which Chinese models arrive as downloadable weights, which arrive only as hosted services, which companies build overseas infrastructure and which collaborations include complete technical artifacts. It can influence model availability, cloud competition, audit access and the ability to run systems under local control. Governments elsewhere will notice the design as well. The United States and other economies often focus on restricting hardware, capital or access to advanced computing. China's draft reaches outward from domestically developed technology and distinguishes several delivery modes. Those systems are not symmetrical, but together they show that AI trade policy is moving from chips toward models, agents, infrastructure and operational know-how. The consultation period should produce more than general applause or alarm. The ministries should publish machine-readable definitions and examples for each AI category, including edge cases for model derivatives, quantization, fine-tuning, agent scaffolds, cloud deployment, source releases and research collaboration. Exporters need a prompt way to request a binding classification. Researchers need a safe route to correct a mistaken assessment. Foreign partners need to know whether a license attaches to a version, a deployment or an ongoing technical relationship. Public reporting should also separate registrations, automatic licenses, ordinary licenses, denials and enforcement actions without exposing genuine security details. Otherwise nobody outside the agencies can tell whether the policy is narrow in practice or merely narrow in its press explanation. The proposal's central distinction is sensible: using a model is not always the same thing as receiving the technology that makes it work. Now China has to make that distinction legible at the level where engineers actually operate. The border is no longer a line on a map. It is a weight file, a license, a server, a repository, an API call and a decision about who holds the keys.