China’s draft export rules cover big open models like Kimi K3.1 Pro. What changes

What China proposed

On October 16, 2026, China’s Ministry of Commerce (MOFCOM) and Ministry of Science and Technology published Announcement No. 48 of 2026. It proposes adding 40 technologies to China’s Catalogue of Technologies Prohibited and Restricted from Export: 23 in AI, covering “large models, agents, compute clusters and information processing,” and the rest in biomedicine and solar power. The quotes from MOFCOM in this memo are our translations of the Chinese.

Two things happen at once:

• A draft list, open for comment. Anyone can comment until November 15, 2026. China hasn’t said when the final list will take effect.
• Registration, now. From the day of the announcement until the revised list takes effect, a company must register on MOFCOM’s technology trade system before it exports anything on the draft list, including exports “already begun but not yet completed.” Registration covers transferring a technology’s ownership abroad, licensing it for use abroad, a foreign owner or controller taking it over, and “other situations” MOFCOM names.

MOFCOM’s spokesperson said “the vast majority of AI technology can still be exported freely,” and that companies must judge for themselves whether what they export needs registering.

The draft got a second wave of attention this week, when a Cloud Security Alliance research note on it reached the front page of Hacker News on November 2, two days before Moonshot’s deadline for Kimi K3.1 Pro’s weights.

Which models and agents it reaches

The draft has two tiers: prohibited, which can’t be exported at all, and restricted, which needs a license. These are the AI items that matter most to people who use models and agents:

What	Tier	Covered when
Large models	Restricted	Compute of 10²⁶ floating-point operations or more, 2 trillion parameters or more, or capability “at the global leading level”
Large models trained on China’s “important data”	Restricted	With exceptions, such as when that data is legally public
Large models trained on China’s “core data”	Prohibited	Always
Agents	Restricted	Any of four tests, such as breaking an instruction into chains of 20 or more steps with 90% average success, or coordinating 60 or more agents or 200 or more tools at set success rates
Agents for critical infrastructure, defense or core government work	Prohibited	When they reach the restricted agents’ levels
AI-assisted vulnerability discovery	Restricted	Any of six tests, such as chaining two or more low- or medium-severity bugs into a working multistage attack
AI that writes and mutates malicious code	Prohibited	When it reaches set evasion rates, such as getting past multi-engine malware detectors 60% of the time

For a large model, the restricted item covers its “weight parameters, key checkpoints, underlying source code, architecture design,” and the techniques for training and running it efficiently. Any one of the three tests is enough.

The third test has its own definition. A model is “at the global leading level” if, at the time of export, it ranks in the global top 10 in public assessments by major evaluators or large industry platforms, in China or abroad, of “overall performance, specialized capability, global call volume, safety performance, training efficiency and so on.” The draft doesn’t say which rankings count, so a model under 2 trillion parameters could still qualify by ranking in the top 10 for use.

What it means for open weights

Three rules decide it.

1. What’s already public stays out. “Technology that has already entered the public domain through open-sourcing, the publication of academic papers and similar means is not brought within the scope of management,” the announcement says. Kimi K3, at 2.78 trillion parameters by Hugging Face’s count, is over the line but already out, so it isn’t covered, and neither is any other model already released.
2. New open releases of restricted models get “automatic licensing.” The draft applies “automatic licensing and other facilitation measures” to open-sourcing this kind of technology. The spokesperson said the aim is “to support building an open-source innovation ecosystem for AI,” and that it would “basically achieve ‘cleared as soon as it’s filed’.” A new open model over a threshold would need a license, but one the ministry means to be a formality.
3. Prohibited items can’t go out at all. No size or score alone puts a model in the prohibited tier; training on China’s “core data,” or being built for critical infrastructure, defense or core government work, does. A trade lawyer told Caixin that “where it touches the red line of the prohibited category, outward export in the form of open-sourcing is strictly prohibited,” as AI Safety in China, a newsletter from Concordia AI, quotes it.

The announcement doesn’t say in so many words that open-sourcing is an export. The draft’s note on automatic licensing treats it as one, and AI Safety in China quotes a Chinese lawyer who reads it the same way: “This revision explicitly identifies ‘open-sourcing’ as a form of technology export.”

Releases haven’t stopped. DeepSeek posted DeepSeek-V4.1-Flash-1017 to Hugging Face on October 17, the day after the draft, under the MIT license, and MiniMax posted MiniMax-M3.1-Flash the same day. AI Safety in China reports that a state-affiliated social media account said DeepSeek and MiniMax had “smoothly” completed registration.

What it doesn’t touch

MOFCOM’s spokesperson was asked directly about Chinese models used abroad. The answer: companies “using restricted large models to provide API calls, app or web interaction, SaaS applications or lightweight local on-device deployment” abroad are “not within the scope” of the rules on exporting large-model technology. Running a restricted model on servers abroad is within it: “overseas localized deployment” counts as an export, and on a company’s “own overseas cloud” it gets automatic licensing.

For people outside China, that means:

• APIs and apps carry on. Using Kimi, DeepSeek or Qwen through the companies’ own APIs and apps isn’t an export under the draft.
• Weights you’ve downloaded aren’t affected. Weights already public are outside the rules, and the duty falls on the company exporting, not on the people who download.
• Big releases to come are the open question. They may come with a filing step, and the ministry wants that step to be quick.

Kimi K3.1 Pro, due November 4

Moonshot announced Kimi K3.1 Pro on October 23, a week after the draft, as “our most capable 3T-class open-weight model to date,” and wrote: “Full model weights will be released by Nov 4, 2026.” A 3T-class model is over the draft’s 2-trillion-parameter line. If open-sourcing is an export, its release has to be registered first now, and would need an automatic license once the list is final.

Moonshot hasn’t said anything in public about the rules that we could find, or whether it has registered. On November 3, its Hugging Face page still showed Kimi K3 as its newest model, with no K3.1 repository.

Moonshot has already trimmed what the open model can do in one area. For the open-weight release, it says it removed cyber-related data from training, and that “we aim not to release open weights that would extend the absolute frontier of cyber capability.” It doesn’t connect that to the draft, but AI-assisted vulnerability discovery is one of the draft’s restricted items. Our memo on K3.1 Pro covers what it costs and how to use it today.

What hasn’t been said

• When the list takes effect, and how it changes after November 15.
• Which rankings count toward the global top 10.
• Whether open-sourcing counts as an export during registration. The announcement’s four registration triggers don’t name it; the draft’s note on licensing does.
• Whether registration can hold a release back. Some Chinese lawyers suggest regulators could use it to suspend exports in especially sensitive cases, AI Safety in China reports. MOFCOM hasn’t said so.
• Moonshot’s plans, beyond its November 4 promise.

What to do

1. If you use Chinese models through their APIs or apps, change nothing. By MOFCOM’s account, the draft doesn’t reach them.
2. Keep using the open models you have. Nothing in the draft reaches back to weights already published.
3. Don’t plan on a big release by date alone. A filing step could move a date. Keep a model that already works for your tasks on hand, such as one from our guide to local coding agents, or Mistral Large 4 from France. Enjoy runs local models through OpenCode beside Claude Code, Codex and the other labs’ agents, and a conversation can switch between them midway, so the work doesn’t have to wait for one model.
4. Comment by November 15 if this affects you. The announcement takes comments by email at jinxianmulu@mofcom.gov.cn, by fax or by post. Label them as comments on the revision of the catalogue, 《中国禁止出口限制出口技术目录》公开征求意见, and include a contact name, organization and contact details; comments sent in an organization’s name need its official seal.

We’ll update this memo when Moonshot releases the weights or China publishes the final list.