Beijing just proposed treating the open-sourcing of a frontier model as an export. Calling a Chinese model’s API from Frankfurt stays untouched. Running the next one on your own racks needs paperwork. Europe’s Plan B just grew a footnote.
The week the escape hatch got a hall monitor
Let me lay out the calendar, because the sequencing is the story.
In early July, Reuters reported that China’s Ministry of Commerce had spent the past month meeting Alibaba, ByteDance and Z.ai about limiting foreign access to their most advanced models, open-weight ones included, and possibly some not yet released [6]. Officials had decided nothing yet. Plenty of buyers filed it under “rumor” and kept downloading.
On Thursday, September 24, Politico reported that the White House’s Office of the National Cyber Director had asked OpenAI and Anthropic to hold new models back from the UK’s AI Security Institute until US agencies reviewed them first [8]. I covered it at the time. Allies, please take a number.
By Monday, October 12, London confirmed its testers were back in, after a minister lobbied for it [9][10]. About two and a half weeks in the hallway, counting from the day the story broke. Britain’s AI minister, Kanishka Narayan, summed it up better than I can: “When you’re reliant on someone else’s technology, you have to be clear-eyed about the permanence of any outcome.” [9]
On Tuesday, October 13, Lawfare published a close reading of the framework behind that hold. Washington gets access to covered frontier models up to 30 days before release. The threshold is classified. The text has never been published, and reportedly even the companies subject to it couldn’t keep a copy. A court filing commits the government to release it by October 30 [7].
Then on Friday, October 16, Beijing handed in its homework. Announcement No. 48 from the Ministry of Commerce and the Ministry of Science and Technology proposes 40 technologies for China’s export-control catalog, 23 of them in AI [1]. Registration with MOFCOM applies from the same day [2]. Comments close November 15 [1].
And in the ministry’s own Q&A sits the sentence this edition is about. Open-sourcing AI technology is a technology export. It qualifies for “automatic licensing and other facilitation measures,” so that exports can “basically” run on a “report and export immediately” basis (即报即出, my translation) [2].
Basically. Immediately. Automatically. Three adverbs doing the work of a hall monitor.
That’s the whole edition. For the better part of two years, the non-US answer to “what if Washington switches us off?” has been the same: download a Chinese open-weight model and run it yourself. Hi, Europe. Hi, Gulf. Hi, Southeast Asia. As of last Friday, the next one comes with paperwork. On the draft’s terms, a permission slip. Signed by a parent you didn’t choose.
What Beijing actually wrote
Before the jokes, the text. Same discipline as always: read the source.
A large model’s “core technology” is in scope if it meets any one of three tests. Training compute of 10^26 FLOPs. Two trillion parameters. Or “globally leading,” which the draft defines as a top-ten place in a qualifying public evaluation, judged at the time of export [3][5]. Core technology means the weights, key checkpoints, source code, architecture, and training and inference techniques [5]. Bloomberg named Moonshot’s Kimi K3 and Alibaba’s Qwen3.8-Max as examples over the line [4].
Some items are banned outright: models trained on China’s “core data,” high-performance agents for critical infrastructure, defense and core government systems, and AI with advanced offensive cyber capability [3]. Agents get their own thresholds, including the use of more than 200 external tools [3]. Computing clusters above 10,000 accelerator cards are in. So is AI chip design at 14 nanometers and below [3].
Exporters register before they export: the technology, the exporter, the recipient, the destination, the end use and the value. Deals already underway count if they aren’t finished [3].
Read that list twice. It isn’t a chip list with a model paragraph bolted on. Washington tried controlling weights once. The January 2025 AI Diffusion Rule covered closed model weights above 10^26 operations and left published weights alone [11]. It was rescinded that May [12]. Beijing’s draft goes where Washington never did. It puts the act of open-sourcing itself under license.
Why Beijing’s draft deserves real credit
Before anyone accuses me of picking a team: I’m grading the dependency, not the company. Or the country.
And on process, Beijing’s draft is the better-written document this month. That will be an unpopular sentence in some inboxes. Here is why I’ll stand behind it.
First, it says what it does not cover. Technology that has already entered the public domain through open-source release or academic publication is proposed to stay outside export management [1][2]. The weights you downloaded last spring are yours. In writing.
Second, it carves out services. MOFCOM says restricting core model technology exports does not restrict AI services to overseas customers. API calls, apps, web interaction, SaaS, and lightweight on-device deployment fall outside the large-model controls [2].
Third, it publishes its thresholds. You can argue with a number. You can’t argue with a secret.
Fourth, it has a comment period, an email address and a deadline [1].
Washington’s equivalent has a classified threshold, a text nobody outside the room has read, and a release date set in a joint status report [7]. The executive order even states that nothing in it authorizes a “mandatory governmental licensing, preclearance, or permitting requirement” [7]. Adam Conner’s reading at Lawfare is that it works as a de facto licensing system anyway [7].
So Beijing showed its work. Washington handed in a sealed envelope.
Now read the fine print.
The permission slip is still a permission slip
Here is the part nobody is saying out loud. “Automatic” describes how a license is granted today. It says nothing about tomorrow.
The documents don’t say how long an automatic license takes, or on what grounds one could be withheld [5]. Automatic is a promise about the mood in the principal’s office. It is not a right you can enforce from Frankfurt.
Now look at the trigger. A top-ten place on a public evaluation, judged at the time of export [5]. That is a rule that gets stricter as the model gets better. The weak release sails through. The one you actually wanted is the one with the form attached. One Chinese AI commentator’s first reaction on X was reportedly “完蛋了,” roughly “it’s over,” predicting Chinese labs might only open-source small models from now on [5]. That’s one reading, not the ministry’s. The ministry reportedly says “the vast majority” of AI technology stays freely exportable [5].
Fine. I’m not alleging bad faith, and I don’t have to. The ministry says the measures target no particular country and exist to ensure AI “remains under human control” [4]. Washington says much the same about its framework. Both may be sincere. Both now hold a switch.
The escape hatch didn’t close. It got a hall monitor.
The fast lane runs through their cloud
This is the paragraph I’d put in front of every European CIO this week.
For restricted AI technology, “overseas localized deployment falls within technology export management” [2]. In other words: a Chinese vendor installing a frontier-class model on your servers in Milan is an export. It gets the automatic-license fast lane when it sits on an overseas self-owned cloud or a similarly “controllable” setup [2]. Self-owned by the exporter. Controllable by whom? The draft doesn’t need to say.
Sit with that for a second. The easiest way to get the next frontier-class Chinese model deployed abroad is on a Chinese company’s own cloud.
Sound familiar? It should. Washington’s sovereign AI offers to allies have mostly run on American hyperscalers. Beijing has now designed the same product. Each superpower’s fast lane runs through its own national champions’ data centers.
That is not two sovereignty offers. That is two landlords with matching leases.
And look at what the draft leaves alone. Calling Kimi or Qwen through an API from Frankfurt, with your prompts flying to someone else’s servers: untouched [2]. Running the next version on your own racks, under your own keys: an export somebody has to license.
The least sovereign way to use a Chinese model got a free pass. The most sovereign way got the paperwork
The five pillars, under pressure
Same test as always. This week the buyer is a European, Gulf or Asian enterprise whose “sovereign” baseline is a Chinese open-weight model on its own GPUs, with a US frontier API for burst. That architecture was the smart money six months ago. I’ve recommended baseline-on-open-weights since this newsletter launched, and I still do. Here is how it holds when Beijing’s draft becomes Beijing’s rule.
01 Territorial
The question. Where do the weights, the data and the compute physically reside?
The story. On your racks. That part still works. Technology already in the public domain is excluded [1].
Under pressure. Your roadmap assumes the next release. The next release is an export that gets registered first, and if a Chinese vendor installs it for you, so is the deployment [2][3].
Verdict. Pass for what you hold. Pending for what’s still on the syllabus.
02 Operational
The question. Who runs it, who holds the keys, and who can pull the plug?
The story. You do, for the model on your disk. Nobody in Beijing can switch off a file you already mirrored.
Under pressure. Your upgrade path does have an off switch now, and it sits in a registration system that records your name as recipient [3]. Your burst path sits in Washington’s pre-release queue. Britain just found out that early access is a favor, not a feature [9][10].
Verdict. Holds today. Your upgrades need a hall pass.
03 Technological
The question. Can you audit it, fork it, self-host it?
The story. Yes, and for once a government wrote that down. The already-public carve-out is the most useful sentence in the whole announcement [2].
Under pressure. You can fork the version you have. You can’t fork the version that hasn’t shipped. Every fine-tune you build ages from the day you build it.
Verdict. Pass. The best news in the draft is what it doesn’t cover.
04 Legal
The question. Which jurisdiction governs, and can anyone enforce it?
The story. Two now. Beijing’s rules bind the exporter. Washington’s framework binds the labs, under a text you can’t read until a court-agreed deadline [7]. Neither binds you directly. Both bind your supply. Contracts lose to statutes. In both directions. Export controls are statutes too.
Under pressure. Your contract with a Chinese model vendor promises the next version. The ministry has the final word on whether it can deliver it, and your contract can’t overrule the ministry.
Verdict. Fail. Two capitals grade the papers. You’re not in the class.
05 Financial
The question. Can you leave? On your timeline, at a survivable cost?
The story. The open-weight baseline was the cheapest sovereignty on the market. That price assumed the next model would arrive free, on time and on Hugging Face.
Under pressure. Your US competitors get the frontier through an API on launch day. You get the next open frontier model when it clears registration, or you get a smaller one. Price the lag. Put a number on it.
Verdict. Fail, unless the lag is priced in. Free weights were never free. The invoice just arrived from a ministry.
The executive TCO
Three line items, none of which show up on the invoice:
- The lag. If the next open frontier model reaches you a quarter late, or arrives smaller, that’s a quarter of capability your competitors had and you didn’t. Model your unit economic alpha at 3x token prices for the months you’re forced back onto a frontier API.
- The second family. A baseline that depends on one country’s release pipeline is one dependency wearing two flags. Qualifying a second open-weight family from a different jurisdiction costs evals, fine-tunes and engineering time. Budget it now.
- The mirror. Hashing, pinning and archiving every model, tokenizer and license in your path. Cheap this month. Expensive the month you need a copy and the download page has a form on it.
Same baseline-and-burst strategy as always. Baseline on open weights you hold, burst to the frontier through a gateway you own. The amendment: “open weights you hold” means on your disk, today. Not on a release calendar in another capital.
Own the crown jewels. Rent the edges.
What to do Monday
- Get the weights on your disk. Every open-weight model in your path, mirrored with its license, its hash and its tokenizer. Already public is exempt. Tomorrow is a draft.
- Add a column to your model register: release jurisdiction. Whose export regime, and whose pre-release review, governs the next version of each model you run.
- Run the drill in a new variant: the next version never arrives. Can you stay on the current one for 18 months? If not, which second family do you move to, and how long do the evals take?
- If a Chinese vendor deploys models on your premises, ask whether that deployment has been registered with MOFCOM, and what happens to your support contract if a license is delayed.
- If you have a stake in the outcome, comment. The consultation is open until November 15, and it takes email [1]. One of the two capitals is actually asking.
- Then put one question to every model vendor you buy from: “If your next release needed a government’s signature to reach me, which government, and how would I find out?” If they answer in under a minute, you have a partner.
Beijing showed its homework. Washington still owes its own.
I’ll say it once more, because it will get clipped out of context. This is not a US-versus-China edition. Both capitals have now done the same thing. They have decided that the best models are strategic exports and that early access is something they grant.
Two deadlines are worth watching. October 30, when Washington is due to publish the framework it has kept sealed [7]. November 15, when Beijing’s comment period closes [1]. One capital is grading its homework in public. The other has a court-ordered due date.
Neither asked you.
So the open-weight strategy survives, with one amendment. The model you already hold is a diploma. The next one is a permission slip.
Get the weights on your disk. While that’s still a thing nobody has put in a queue.
Amit
Amit Eyal Govrin is lead analyst for sovereign AI at theCUBE Research and CEO of Agentcy Labs, which designs and builds sovereign AI platforms for enterprises and governments. His research for theCUBE Research is conducted under theCUBE Research’s editorial standards and is not sponsored or directed by Agentcy Labs. Agentcy Labs may hold commercial relationships with vendors covered in this research.
References
[1] Ministry of Commerce and Ministry of Science and Technology of the PRC, 商务部 科技部公告2026年第48号 (Announcement No. 48 of 2026), public consultation on the revised Catalog of Technologies Prohibited and Restricted from Export, Oct 16, 2026. Link
[2] Ministry of Commerce of the PRC, policy Q&A on Announcement No. 48 (政策解读), Oct 16, 2026. Link
[3] Geopolitechs, analysis of China’s proposed AI export controls, Oct 2026. Link
[4] Bloomberg, report on China’s proposed export controls on AI models, chips and agents, Oct 16, 2026, republished by the Taipei Times, Oct 17, 2026. Link
[5] Tech City Authority, report on China’s AI export draft and its open-source fast track, Oct 2026. Link
[6] The Next Web (citing Reuters), report that China is weighing curbs on overseas access to its top AI models, Jul 7, 2026. Link
[7] Adam Conner, Lawfare, “The Many Open Questions About the Trump Administration’s New De Facto AI Model Licensing System,” Oct 13, 2026. Link
[8] The Decoder (citing Politico, Sep 24, 2026), report that the White House told OpenAI and Anthropic to let the US review new models before sharing them with British testers, Sep 25, 2026. Link
[9] The Next Web, report on the UK AI Security Institute’s restored pre-release access (citing Bloomberg and The Telegraph), Oct 12, 2026. Link
[10] The Decoder (citing The Telegraph), report on the White House reversal restoring UK access to frontier models, Oct 2026. Link
[11] Morrison Foerster, “BIS Issues Interim Final Rule on Artificial Intelligence Diffusion as Biden Exits,” Feb 2025. Link
[12] Akin Gump, “BIS Rescinds AI Diffusion Rule and Issues New Guidance,” May 2025. Link
