Mofcom Announcement 48 restricts frontier weights, not API calls to Chinese models

Announcement No. 48 of 2026 contains two instruments with different legal status. The first is a draft adding 40 technologies to China's Catalogue of Technologies Prohibited or Restricted from Export, 23 of them in AI, and it is open for comment until November 15, 2026. The second is an interim pre-export registration requirement that already applies, including to exports that have started but are not finished. Across sectors the draft lists 14 prohibited and 26 restricted items, split into 23 in AI, 5 in biomedicine and 12 in photovoltaics. Prohibited items cannot be exported at all, and restricted items need a license, which ChinaTalk notes is administered by provincial authorities.

The official annex groups the AI items into large models, agents, compute clusters, chip design and information-processing technologies. The draft thresholds below come from the annex as summarized by the Cloud Security Alliance.

MOFCOM's spokesperson framed the test as whether restricted technology moves from inside China to overseas. Under that guidance, API calls, apps, websites and SaaS for overseas customers are outside large-model export management, and so is lightweight on-device deployment. Local deployment of a restricted model on infrastructure outside China is inside it and needs a license. Deployment on a Chinese company's own overseas cloud or compute center may get automatic licensing, described as report and export.

This puts a common data-protection choice inside the controls. Teams that self-host a Chinese frontier model to keep sensitive data inside their own boundary are using the deployment pattern the draft captures, and that arrangement requires the Chinese supplier to hold a license. ChinaTalk reads the rule as also covering on-premises licensing deals and managed deployments where a vendor runs an agent's reasoning loop inside a customer environment. Because licenses can be revoked or conditioned, ChinaTalk suggests some non-Chinese users may reconsider those dependencies. Registration already covers exports in progress, so ongoing weight-delivery or model-update arrangements may be affected before the catalogue is final.

Commenters on Hacker News questioned how much trust self-hosting buys. One noted that malicious behavior, such as secretly sending data that meets certain conditions to an outside address, can be embedded in a model, so an open model running locally is not foolproof. Another compared open weights to freeware binaries that cannot be meaningfully audited. The sources do not address model integrity: the export rule changes who must hold a license for local deployment, not whether locally deployed weights are safe.

The annex excludes technology that has entered the public domain through open-source release or academic publication. Open-sourcing a newly developed restricted model falls under automatic licensing after reporting. One Hacker News commenter quoted a MOFCOM spokesperson statement saying automatic licensing will apply to open-source AI technology exports, basically achieving immediate reporting and export. In reply, one commenter said that what governments do matters more than what they say and that the direction here is toward restriction, while another read it as meaning anyone exporting closed AI will have to apply for a licence.

Two gaps matter for anyone depending on Chinese open-weight releases. The draft does not define open source, and commentators note it is unclear how restricted-use licenses would be treated. Two Hacker News commenters made the related point that these releases are open-weight, not open-source: the weights are published, but the training data and process are not. The sources do not say which side of the line a weights-only release under a custom license falls on. Current downloads are not affected, but future release cadence becomes a variable outside the user's control.

The sources do not name DeepSeek, Qwen, Kimi, GLM or any other model as in scope. ChinaTalk notes that the 10^26 FLOP threshold mirrors the 2023 U.S. executive order and the since-rescinded 2025 U.S. AI Diffusion rule, and estimates that no released Chinese model currently exceeds it. The sources do not say whether any Chinese model meets the 2 trillion parameter test. That leaves the global top-10 test as the least predictable route by which a Chinese model could become restricted.

The top-10 test is evaluated at the time of export and names no ranking body. A model version that was unrestricted when released can become restricted if its evaluation rank or global call volume rises into the top 10. One Hacker News commenter argued that restricting any powerful Chinese model in the global top 10 would make Chinese models very difficult to advocate for and hard for global users to adopt. Another replied that Chinese models are popular because they are good, not because they are free, and cited American and Canadian open-weight models that did not take off. The sources test neither claim.

The agent items are defined by what the system does, not by the underlying model. An orchestration framework integrating 200 or more tools at the accuracy and success thresholds could meet the tool-calling item while running on a model far below 10^26 FLOPs, an issue Ray Sun identifies as unresolved. High-performance agents that meet the restricted thresholds and are specially or mainly designed for critical infrastructure, defense or core government use are prohibited outright. Chinese-origin red-teaming, vulnerability-discovery and detection tools that meet the thresholds would need a license to leave China, and offensive code-generation capability could not be exported at all.

Registration has four triggers: transfer of ownership abroad, licensing domestic technology for overseas use, a change of ownership or control that makes a foreign entity the owner or controller, and other cases MOFCOM designates. Exporters decide for themselves whether a technology is in scope, and the form asks for recipient details, destination, technology description, end use and estimated value. ChinaTalk reads the form's field on exports made outside formal contracts as potentially capturing intra-group code sharing and open-sourcing. That reading is an inference from the form, not an official statement.

A model fine-tuned in China on important data under the Data Security Law would be restricted unless the 0.1% carve-out applies, and one trained on core data would be prohibited. Teams that classified China-resident data for cross-border transfer may not have applied the same classification to training and fine-tuning sets, because those obligations previously governed data transfer, not model transfer. Redomiciling may not help either. In January 2026, MOFCOM announced an assessment of Meta's acquisition of Manus, a Singapore-registered AI agent company whose products were developed in China, over whether moving staff and technology required export authorization.