China's draft AI export rules set a top-10 leaderboard threshold

Ronni Holmvig Strøm · 2026-10-19

On October 16, China's Ministry of Commerce and Ministry of Science and Technology opened a month of public comment on 40 technologies proposed for the country's restricted-export catalogue. Twenty-three of them are AI: large models, agents, compute clusters, information processing. Two of the three thresholds for large models are the ones anyone following the field would have guessed. The third has no precedent we can find in any export control regime.

A model's core technology becomes restricted if it meets any one of three tests. It was trained with 10^26 or more floating-point operations. It has 2 trillion or more parameters. Or it is globally leading, which the draft defines as ranking in the global top 10 on any public evaluation run by a major testing body or large industry platform, assessed at the moment of export. The evaluation can measure overall performance, specialist capability, worldwide usage, safety, or training efficiency. One leaderboard is enough. Core technology here means weights, key checkpoints, source code, architecture, and training and inference methods.

Bloomberg and the Associated Press put Moonshot's Kimi K3 and Alibaba's Qwen3.8-Max above the parameter line. The draft itself names no model, and a pre-export registration requirement for everything on the list took effect the same day, covering deals already underway.

The first two tests describe an artifact. Fourteen nanometers is a fact about a wafer. 10^26 FLOP is a fact about a training run, fixed on the day the run ends. Export control has worked this way since COCOM, because an inspector needs to look at a thing and say whether it is the thing.

Top ten is a fact about everybody else. A set of weights sitting untouched on a server in Hangzhou can cross into restriction because a lab in Menlo Park shipped on a Tuesday, and can cross back out the same way, and nothing in the file changes either time. The draft has indexed a legal category to a moving external measurement that no Chinese agency controls.

That conscripts the organizations that run public evaluations. A leaderboard refresh is now an event with customs consequences, and the people maintaining the arena did not apply for the job. It is the first case we know of where evaluation infrastructure has become regulatory infrastructure by direct reference rather than by committee.

The reading that traveled fastest over the weekend was that Chinese labs can now only open-source small models. The documents point the other way. Technology already in the public domain through open-source release or published research falls outside the rules entirely, in the announcement's own words.

Open-sourcing restricted technology qualifies for automatic licensing, which the ministry's Q&A describes as approval on filing. Serving a restricted model through an API, an app, a website, or a lightweight on-device build is not a technology export at all. Deploying the weights on foreign servers is, though a Chinese firm running them on its own overseas cloud gets the fast lane.

Give the weights to everyone and you get the fast lane. Sell them to one buyer abroad and you need a license. The controlled object is custody. A security-minded regulator would be expected to control capability.

Automatic licensing is still a checkpoint, and the draft does not say how long it takes or whether it can be withheld. A fast lane without a published service level is a fast lane at someone's discretion, and that gap is the most consequential unanswered question in the document. It is also precisely what a comment period is for. The window closes November 15 and the filing address is in the announcement.

The 10^26 figure is borrowed. The United States drew the same line in its October 2023 executive order to decide which training runs required reporting. Two governments that agree on almost nothing have now settled on the same unit of account and the same judgment that access is not transfer. A training run that trips a reporting trigger in Washington now trips a licensing trigger in Beijing at the same FLOP count.