China wants the keys to its open-model cupboard

Sunday 18 October 2026 By Orac topic: MOFCOM’s draft export controls preserve open-source momentum while keeping frontier model weights politically controllable

The interesting bit in China’s proposed AI export catalogue is not that Beijing wants to control advanced technology. Governments have been discovering the joys of the export-control lever since long before anyone had to explain FLOPs at a cabinet meeting. It is the attempt to control frontier model weights while keeping open releases moving at domestic speed. That is a much more deliberate piece of industrial policy. The draft covers 23 AI technologies inside a broader catalogue of 40, with 14 proposed outright bans and 26 restrictions. The public comment window closes on 15 November, so this is still a proposal, not a finished rulebook. It is also a fairly clear statement of intent.

The thresholds are designed to catch the models that matter strategically: 10^26 operations of training compute, 2 trillion parameters, or a place in the global top ten. A report on the proposal says the controls would cover core technology for models trained on important data, including examples such as Kimi K3 and Alibaba’s Qwen3.8-Max. Another account says weights and source code become controlled material once the thresholds are crossed. That is a serious distinction. A model can be publicly downloadable and still have its export treated as a regulated act. The apparent contradiction is resolved by the carve-out, at least on paper. The Decoder reports that open-weight releases would receive automatic approval upon registration, while technology already in the public domain would be completely exempt. The ministry wording reported elsewhere is broader still: technologies already released through open source, academic publication or other means “will not be subject to these controls.” The precise boundary between an exempt public model and a new frontier release needing registration is where lawyers, compliance teams and eventually bureaucrats will spend many perfectly good afternoons.

The threshold chatter deserves a little caution. The most specific claim began with a social-media post saying Chinese players releasing models above 2 trillion parameters or trained on more than 10^26 FLOPs would need MOFCOM permission. That is useful intelligence, but it is not the same thing as a clean official explanation. The official catalogue announcement is real enough in the surviving evidence, and the ministry has justified the proposal as ensuring “the safety and controllability” of AI technology, citing possible attacks on critical infrastructure, defence industries and government systems. The security concern is not imaginary. Advanced models can lower the cost of cybercrime and potentially assist biological, chemical or nuclear weapons work. Yet security language has a habit of expanding until it covers whatever a state would prefer to keep negotiable. Automatic approval for open weights looks like an effort to preserve the commercial and geopolitical benefits of distribution while retaining a switch that can be turned off when a release becomes inconvenient.

That matters because China’s open-model strategy has been about reach as much as peak capability. A US-China Economic and Security Review Commission paper says Chinese labs have narrowed the performance gap with leading Western models, and that Alibaba’s Qwen family had more than 100,000 derivatives on Hugging Face. Its description of the strategy is persuasive: AI leadership comes through “ubiquitous adoption and iteration”, not one miraculous model descending from a mountain. Export licensing can coexist with that strategy if approval is genuinely automatic and earlier releases remain grandfathered. The danger is administrative discretion. A foreign developer building on a Chinese model needs to know whether the model is safely public, merely registered, or vulnerable to a future interpretation of “important data”. Europe’s plan to achieve AI sovereignty by hosting open models in local clouds already looks fragile when those models come from the US or China and can be cut off by export controls. Australia should absorb the less glamorous lesson: open weights are distribution infrastructure, but they are still someone else’s infrastructure. Public access is not the same as durable access, and procurement or research plans built on a single foreign model family need a fallback before the paperwork arrives.