China put 23 AI technologies behind an export register. The handoff rules need examples

THE SIGNAL IN ONE SENTENCE

The new line is not simply inside China or outside China. It is technology transferred or service provided. China's Ministry of Commerce and Ministry of Science and Technology opened a consultation on October 16 that proposes adding 40 technologies to the country's catalogue of technologies prohibited or restricted from export. Twenty-three of those are in artificial intelligence, spanning large models, agents, compute clusters and information processing. At the same time, the ministries imposed a temporary pre-export registration requirement for the technologies listed in the announcement. That requirement started with the announcement and is meant to remain until the catalogue revision is formally issued and implemented. The plain signal is this: China is drawing a sharper boundary around the export of selected AI know-how, but the official explanation deliberately separates transferring the technology from letting overseas users call a service. That distinction is going to carry a lot of weight. The public notice says registration is required before covered technology is exported through several kinds of handoff. The listed triggers include transferring ownership abroad, licensing domestic technology for use abroad, changing the technology owner's or controller's status to an overseas entity, and other cases specifically identified by the ministry. Registration is not described as a one-line checkbox. The notice says exporters should provide information about the exporter and recipient, the destination country or region, the technology and intended use, and the estimated value of the export. Projects already underway but not yet complete are included. That makes the temporary register an information-gathering system as well as a compliance step. The proposed catalogue is not yet final. Public comments are open through November 15 on the added technologies, technical thresholds, control policies and convenience measures. The temporary registration rule, however, is already active for technology falling within the announcement's scope. Proposal and present requirement belong in separate boxes. The ministry's question-and-answer document adds a second important distinction. It says the test for an overseas AI activity is whether restricted technology is transferred from inside China to outside China. An overseas localized deployment of a covered model would count as technology export management under the proposed approach. If that deployment runs in an overseas cloud owned and operated by the Chinese company, the ministry says it may qualify for an automatic-license convenience measure because the risk is considered more controllable. Hosted access gets another answer. The ministry says providing calls to a restricted model through an API, app, webpage or software-as-a-service product does not count as exporting the large-model technology. It also excludes lightweight local endpoint deployment from that model-technology export category in the official explanation. The machine can stay home while the answers travel. This is not unusual as a regulatory concept. A customer who calls a hosted model receives outputs and perhaps tool actions. A customer who receives weights, training methods, cluster designs or deployment know-how receives something that may be operated, copied, modified or passed along. But real products are rarely that tidy. An API package can include a fine-tuned adapter, a local runtime, a proprietary tokenizer, an orchestration layer, system prompts, evaluation code, caching infrastructure and engineering support. A localized deployment can leave ownership unchanged while giving an overseas partner substantial operational control. A joint research project can start with hosted calls and end with shared checkpoints. The interesting question is not whether the product is called SaaS. The interesting question is what crossed the boundary. That is why the policy needs worked examples. Take a Chinese model company that serves an overseas customer through an API. The ministry says ordinary hosted calls are not model-technology export. Fine. What happens when the customer receives a private fine-tune? What if the adapter is small but reconstructs a valuable capability? What if the provider installs an encrypted inference appliance in the customer's data center? What if engineers fly abroad to optimize the stack without transferring formal ownership? Each case changes the bundle. The same issue appears in agent products. An agent is not merely a model response. It may contain tool schemas, planning logic, memory systems, workflow templates, security controls and access to a remote computer environment. Some pieces may remain hosted while others are delivered to the customer. A useful compliance guide would decompose the product into parts and show which fact changes the answer. The ministries have already supplied several lanes. The announcement says AI technologies already placed in the public domain through open source or published academic papers are outside the proposed management scope. The official explanation also describes automatic-license convenience measures for open-sourcing AI technology, Chinese companies building and operating their own overseas compute centers, overseas chip tape-out, joint research using overseas resources and participation in international standards. Open is not a magic word. Timing matters. A technology already in the public domain is different from a company deciding to release covered technology after the new rules are in force. The question-and-answer document suggests a convenient automatic route for certain open-source activity, while the announcement says technology already public is not included. Developers need a clear sequence for both situations. The government says the controls are not aimed at a particular country, region or entity. It also says most AI technology would remain freely exportable after the revision and that products made with a controlled technology are generally outside the technology catalogue unless specifically covered. That is a narrower claim than an AI export ban. The full proposal covers 40 technologies across AI, biomedicine and solar manufacturing. The official explanation says 14 would be prohibited and 26 restricted. Its AI examples include a proposed prohibition on technology for AI-driven generation and mutation of malicious code, plus restricted treatment for AI-assisted vulnerability discovery. Those examples show why the exact technical thresholds matter. Defensive security research and offensive capability can share methods. A vulnerability-discovery system may be used to patch a hospital or probe a power network. A model trained to understand malicious code may support malware analysis or malware modification. Regulators need to describe controlled capability in terms engineers can test, not merely categories broad enough to swallow ordinary work. The public attachment is where those technical definitions live. The consultation asks for feedback on the range, indicators and convenience measures, which is an invitation for affected developers to test the language against real systems before November 15. The strongest response will be concrete. Do not send, this is confusing. Send a diagram of an actual deployment. Mark where the model weights live, who controls the servers, which artifacts are copied, who receives source code, whether fine-tunes leave China, what engineers can access, how updates arrive and whether the overseas party can operate the system without the Chinese provider. Then ask which box each arrow enters. Companies should also build an internal handoff ledger now. Inventory the technology components in every cross-border AI product. Record ownership, control, hosting location, recipient, use, contract rights, access privileges and whether an artifact is already public. Separate the model from the service, the service from the deployment tooling, and the deployment tooling from human expertise. This is operational reporting, not a substitute for Chinese legal advice. The registration notice places the first judgment on the exporter. The official explanation says exporters should determine whether a proposed export falls within the temporary scope and consult the ministries when they encounter problems. A company should therefore preserve the facts and reasoning behind its classification rather than relying on a product label chosen by marketing. The record should survive staff turnover. It should also be narrow enough to update. A hosted API may become an overseas installation. A public research collaboration may produce a private checkpoint. A partner may gain control rights after a financing round. A model that misses the technical threshold today may cross it after an upgrade. Classification is a versioned state, not a sticker. For developers outside China, the policy matters because Chinese models and agent platforms increasingly sit inside global products. Buyers may see new questions about hosting, local deployment, update rights and disaster recovery. Partners may be offered a hosted route when they expected weights. Open-source communities may need clearer release records showing when code and artifacts entered the public domain. None of that proves collaboration stops. The official material repeatedly describes convenience measures, automatic licensing and continued support for international research and open-source work. The practical test will be how fast those lanes operate, how predictable the classifications become and whether companies receive answers before a project clock runs out. That is why worked examples are not bureaucratic decoration. They are the difference between a rule that maps to software architecture and a rule that every lawyer, engineer and product manager redraws from scratch. China has identified the gate. Now it needs to publish the map of the handoffs that reach it.