China drafts export controls on 23 AI technologies

China drafted export controls on 23 AI technologies, including frontier models above set thresholds and a ban on autonomous malware tools.

China's commerce and science ministries published a draft update to banned and restricted export technologies covering 23 AI areas, including large models, agents, compute clusters, and data processing. Tools that can independently write or alter malware to attack critical infrastructure, the military, or government agencies would face a total export ban, while some vulnerability-discovery tools would face new limits. Large-model controls would apply to models trained on China's important data and to core assets such as weights, checkpoints, source code, architecture, and training methods once a model reaches 10^26 training FLOPs, at least 2 trillion parameters, or a global top-10 ranking. Technology already public through open-source releases or papers would be exempt; publishing restricted technology as open source could receive automatic licensing; and API, app, and SaaS use would not be controlled, while foreign on-premises installation would still need a license. One headline says China is tightening the rules, but both reports describe a draft rather than a finalized measure.

• China's commerce and science ministries drafted an export-control update covering 23 AI technologies.
• The draft covers large models, agents, compute clusters, and data processing.
• AI tools that autonomously write or alter malware to attack critical infrastructure, the military, or government agencies would face a total export ban.
• Some vulnerability-discovery tools would be newly restricted.
• Large-model controls cover models trained on China's important data and core assets such as weights, checkpoints, source code, architecture, and training methods at 10^26 training FLOPs, at least 2 trillion parameters, or a global top-10…
• Already-public open-source releases and papers are exempt, and publishing restricted technology as open source can qualify for automatic licensing.
• API, app, and SaaS use would not be controlled, while installing restricted technology on foreign local servers would need a standard license.