China proposes adding 23 AI technologies to its prohibited/restricted export catalogue, with comments open from October 16
China proposes adding 40 technologies — 23 of them AI — to its export-prohibited/restricted catalogue. Comments run October 16 to November 15.
China’s Ministry of Commerce and Ministry of Science and Technology published Announcement No. 48 of 2026 on October 16, opening a public comment period on revisions to the Catalogue of Technologies Prohibited or Restricted from Export. The draft adds 40 technologies across three fields — 23 in artificial intelligence, 5 in biomedicine, 12 in photovoltaics — and the AI block, covering large models, agents, compute clusters and information processing, is the largest of the three. The same day, a commerce ministry spokesperson gave the split: 14 technologies proposed for prohibition and 26 for restriction. Comments are open from October 16 to November 15 by email, fax or post, and exports of listed items need registration on a ministry platform from now until the revised catalogue takes effect.
Key points
- Volume and split: 40 technologies in total — AI 23, biomedicine 5, photovoltaics 12. The spokesperson’s framing is 14 prohibited and 26 restricted.
- Two AI entries come with hard numbers: AI-driven autonomous malware generation and mutation is proposed for prohibition, and AI-assisted vulnerability research for restriction.
- The interim rule is already live: from the announcement date until the revised catalogue is implemented, exporters must register listed items on the ministry’s unified platform before shipping, including exports already under way.
Background
The catalogue has been revised repeatedly since 2001, and the spokesperson called this round routine technology-trade administration that is “not targeted at any specific country, region or entity”. What is new is that AI gets its own headings. Annex 1 introduces “AI large model technology”, “AI agent technology” and “AI compute cluster technology” as named categories, each with quantitative thresholds. The neighbouring categories already existed: “information countermeasure technology” is marked as added to 5 existing items, and “information processing technology” to 18 existing ones. What the catalogue previously held was authentication, cryptography and information processing work; this round splits out models, agents and compute clusters on their own.
That lands on the third leg of cross-border AI compliance. Hardware-side restrictions already have their own case law: on October 2 we covered a US chip smuggling prosecution over $300 million of A100 and H100 servers routed into China through Southeast Asian forwarders. Model-side scrutiny is on the rise too, as with the UK’s compulsory safety reporting plan announced October 12. Announcement 48 covers the third piece: model and algorithm technology, with thresholds a company can test itself against.
The facts
The announcement itself sets the frame; Annex 1 carries the thresholds. Both AI entries below are quoted from the annex.
| Field | Items | Example proposed for prohibition | Example proposed for restriction |
|---|---|---|---|
| AI | 23 | AI-driven malware generation and mutation | AI-assisted vulnerability research |
| Biomedicine | 5 | Proprietary cell and gene therapy process platforms | New-target discovery and validation for CGT |
| Photovoltaics | 12 | Perovskite and tandem cell module production | Polysilicon engineering with ≥30,000 t/yr per line |
On the prohibited side, item 266402J (“information countermeasure technology”) sets the bar in attack success rates: ≥60% against multi-engine malware detectors, ≥85% against a single mainstream antivirus product, ≥90% against machine learning models. It also covers adaptive evasion and runtime behavior modification that can detect virtualized sandboxes and escape them, and automated generation of bulk equivalent variants — ≥20 structurally distinct functional-equivalent variants in a single run, or an end-to-end automation rate of ≥80%.
On the restricted side, item 266404X (“AI-assisted vulnerability research”) uses several independent triggers: ≥75% on authoritative security benchmarks for reproduction or exploitability; ≥50% end-to-end success building a working exploit chain against a mainstream operating system or browser; a 10x-or-better efficiency gain over a senior security researcher baseline; autonomous discovery of 5 or more previously undisclosed high-severity flaws in one major open-source project or operating system; or top tier on any major vulnerability capability rating scale.
Restricted “AI large model technology” (266504X) draws two lines: a large model trained on China’s “important data” and then offered as a service, and the core technology of any model meeting one of three thresholds — ≥10^26 floating-point operations, ≥2 trillion parameters, or “globally leading capability”, which the annex defines as a top-10 global ranking on public evaluations of comprehensive performance, business capability, call volume, safety or training efficiency. The controlled scope includes weight parameters, key checkpoints, source code, architecture design, and training optimization or inference acceleration techniques. Restricted “AI compute cluster technology” (266507X) defines a large-scale intelligent compute cluster as one with more than 10,000 AI accelerator cards, and lists thresholds such as ≥800 GB/s bidirectional inter-chip or inter-node bandwidth and mean time to repair of ≤120 seconds for distributed training fault tolerance.
Exemptions and conveniences
The announcement body states two things: technologies already in the public domain through open source or academic publication are outside the scope of management, and outbound licensing models that do not transfer ownership in biomedicine get automatic licensing. Annex 1 goes further at the end, listing automatic licensing for open-sourcing the technology, building and operating data centers abroad, chip tape-out abroad, joint R&D using overseas resources, and participation in international standard-setting.
The spokesperson’s Q&A is where the deployment scenarios get addressed, and this layer is separate from the announcement text. According to the Q&A, providing API calls, app or web interaction, SaaS applications, or lightweight on-device deployment of a restricted large model does not fall within the technology export management scope. Localized deployment of a restricted AI technology abroad does fall in scope, and qualifies for automatic licensing when deployed on the company’s own overseas cloud. The spokesperson also said the overwhelming majority of AI technologies will remain freely exportable once the measures take effect.
Pre-export registration
The interim regime runs from the announcement date until the revised catalogue is implemented. Technology exporters must register on the ministry’s unified platform technology trade information application (https://ecomp.mofcom.gov.cn) before exporting anything listed in the annexes, and exports already started but unfinished are covered. The situations that require registration include transferring technology ownership abroad, licensing domestic technology for use abroad, a change in the owner or actual controller of the technology to a foreign entity, and any other case the ministry specifies by notice. Filings record the exporter and recipient, destination country or region, the technology and its intended use, and the expected export value.
Photovoltaics for contrast
The 12 photovoltaic items show how the catalogue is drafted: prohibited items include the cold-hydrogenation fluidized-bed process at ≥250,000 t/yr of trichlorosilane per line, wafer fabrication at ≤70 µm thickness, and perovskite and tandem cell module production; restricted items include polysilicon engineering at ≥30,000 t/yr per line, monocrystalline silicon rod pulling, ultra-thin large-format wafer fabrication, and TOPCon, XBC and HJT crystalline silicon cell processes. The management scope also covers key equipment carrying the controlled technology, with the annex naming reduction furnaces, wire saws, Czochralski furnaces, LPCVD and PECVD deposition tools, atomic layer deposition tools and slot-die coating equipment. Per the spokesperson, photovoltaic technology exports typically travel with production line export, installation, commissioning and upgrade work, and companies doing that need a technology export licence.
Our take
The draft moves cross-border compliance from compute and silicon to models and algorithms, and it does so with measurable thresholds rather than a list of names. Compute volume, parameter count, attack success rate, cluster size — a company can test itself against those numbers, which makes this round more enforceable than any previous one. That is the part worth reading closely if you ship model access across a border.
The genuinely unresolved term is data, not model. Item 266501J prohibits any large model trained on China’s “core data” and then served; item 266504X restricts one trained on “important data”. Both point back to the Data Security Law and neither is defined in this announcement, which leaves the scope to later rules.
Two gaps in the coverage are worth stating plainly. None of the three sources we read carries third-party assessment, company comment or industry response, so this entry reports the official position and nothing more; we found no citable first-hand English reporting on the announcement and therefore make no claim about external reaction. The full list of 23 AI items sits in Annex 1 — this entry quotes the two that carry quantitative thresholds.