China's AI Models Face Export Restrictions

China Weighs Locking Down Its Best AI Models — a Mirror to Washington

China's Ministry of Commerce is drafting a tiered export regime for frontier AI models — a move that would treat Qwen and DeepSeek weights the way Washington treats Nvidia chips, and split the global open-model economy in two.

Beijing is preparing to do to its own AI models what Washington has done to advanced chips. Over the past month, China's Ministry of Commerce (MOFCOM) and National Development and Reform Commission have held closed-door meetings with Alibaba, ByteDance and Z.ai on a tiered system that would restrict overseas access to the country's most advanced artificial-intelligence models, criminalise leaks under national-security law, and vet who can fund domestic AI start-ups. The load-bearing fact is this: China now leads the United States in global open-model downloads — and is preparing to switch that leadership off at the source. Reuters first reported the discussions on July 7, 2026, and the Sri Lanka Guardian's account adds that a summary in an official Supreme People's Court journal has already sketched the tiering.

The immediate story is regulatory. The deeper story is that AI models — not just chips — are now the object of state-level export control on both sides of the Pacific. That reframes every China-related debate in tech policy from AI regulation to cross-border data to semiconductor countermeasures. It also raises a sharper question for European and Global South buyers: whose "open" AI can they still count on next year?

What the meetings actually cover

According to the Reuters account carried by The Express Tribune and The Edge Malaysia, officials are considering three linked measures: overseas-access restrictions on frontier models (including those not yet released), stiffer criminal penalties for AI-related technology leaks under China's national-security laws, and new limits on foreign funding of domestic AI start-ups. Alibaba's Qwen, ByteDance's Doubao and Z.ai's GLM series are the primary subjects; DeepSeek, notably, has not been named as a participant.

The tiered framework — the operative design — is the piece worth watching. A summary published on Easterngifts describes a three-band system: simple filing for basic tools, security review for mid-capability models, and domestic-only restrictions on the most sensitive frontier systems. That architecture is almost a mirror image of the three-tier AI Diffusion Rule that the Biden administration's Bureau of Industry and Security issued on January 15, 2025 before the Trump administration withdrew it in May — which grouped countries into tiers of trust and, for the first time, imposed controls on advanced AI model weights alongside chips.

China already has the plumbing. The Ministry of Commerce's Catalogue of Technologies Prohibited and Restricted from Export, overhauled in Announcement No. 57 of December 2023 and revised again on July 15, 2025 by Announcement No. 28, already covers information-processing, encryption and computer-network technologies. AI interface technologies — speech recognition, personalised recommendation algorithms — were added back in August 2020, the rule used to block ByteDance from freely selling TikTok. Slotting large language models into that catalogue would be an administrative act, not a legislative one.

Why now: a global download share that shocked Beijing

The trigger is not chips. It is market share. A December 2025 arXiv study by Nathan Lambert and colleagues analysing 851,000 models and 2.2 billion Hugging Face downloads found that China's share of open-weight downloads reached 17.1% in the year to August 2025, overtaking the United States (15.7%) for the first time. DeepSeek and Alibaba's Qwen together captured 14% of downloads. As of October 2025, cumulative Chinese open-model downloads had crossed 540 million, Al Jazeera reported, citing Atom Project data.

That success has flipped Beijing's strategic calculus. For two years, Chinese "open" releases were a soft-power play — free tools that undermined US export controls by showing that Nvidia curbs had not stopped Chinese labs. In February 2025, DeepSeek's R1 wiped roughly $600 billion off Nvidia's market capitalisation and became the emblem of that argument. By late 2025, US start-ups were quietly training on Qwen, Kimi, GLM and DeepSeek — a shift Airbnb's Brian Chesky made public when he told developers his platform had switched to Qwen because it was "fast and cheap."

The result: Chinese frontier AI is now an asset Beijing wants to fence in, not diffuse. The June 12, 2026 US decision to force Anthropic to deny non-US access to its Mythos and Fable models — described by the Peterson Institute's Martin Chorzempa as an "ad hoc" gift to Chinese AI — gave Beijing both the pretext and the template.

The distillation problem — and the cyber angle

Two other pressures are pushing Beijing toward controls. The first is intellectual property. On June 10, 2026, Anthropic wrote to Senators Tim Scott and Elizabeth Warren accusing Alibaba-linked operators of running "the largest campaign to illicitly extract Claude's capabilities" — almost 29 million exchanges from thousands of fraudulent accounts, per BBC's account. The Council on Foreign Relations, in its analysis of DeepSeek V4, documented similar White House claims that Chinese labs ran industrial-scale distillation campaigns against OpenAI and Google. Foreign Affairs' Sam Winter-Levy has argued Washington should extend the foreign direct product rule to Chinese models built on U.S. capabilities. If China's frontier models were themselves built partly through unauthorised distillation of U.S. systems, Beijing has a defensive interest in enclosing them before Washington can subject them to licensing.

The second is cyber. Two Reuters sources told the wire that Chinese officials worry advanced cybersecurity-capable models could be turned back against Chinese networks — an argument that mirrors Washington's own reasoning for the Mythos embargo. The Cyberspace Administration of China's AI Safety Governance Framework 2.0, released in September 2025 and analysed by Matt Sheehan at Carnegie, for the first time singled out risks from "open-source foundation models" — including "malicious models" fine-tuned by criminals — as a governance priority. The July 2026 meetings operationalise that framework.

Who benefits, who loses

The non-obvious winner is Huawei, not the Chinese state. If frontier weights become controlled technology, Chinese AI hosting and inference will consolidate onshore — precisely the outcome that pushes ByteDance, Alibaba and DeepSeek toward Ascend chips. Regulators barred ByteDance in November 2025 from deploying Nvidia hardware in new data centres. RAND's Lennart Heim has warned that if Chinese hyperscalers "throw their formidable resources toward" Chinese AI chipmakers, a positive-feedback loop kicks off that is hard to reverse. Model export controls make that pivot cheaper: if Qwen can only serve users onshore, there is no commercial reason to keep it CUDA-compatible.

The clearest loser is the European developer. Merics analyst Rebecca Arcesati has documented in her report on China's AI stack how European labs have quietly relied on open Chinese weights as a hedge against U.S. licensing regimes. Cut that off and Europe is left choosing between American closed models under Washington's rules and second-tier open alternatives (Mistral, Meta's Llama derivatives). India, The Daily Jagran noted, faces the same squeeze: its start-up ecosystem has become a heavy consumer of Qwen and DeepSeek, and no domestic frontier model can plug the gap on a two-year horizon.

The Global South is the strategic prize. As CFR's analysis puts it, developing-country buyers "are not choosing between GPT-5 and Claude Sonnet 4.6 but between accessible tools with different values baked in." China's Digital Silk Road has treated open models as a soft-power lever. A tiered regime would keep the cheap, small models flowing — building dependency — while pulling frontier capability inside the Great Firewall. That is not a retreat from AI diffusion; it is a curated version of it.

The precedent Beijing has already tested

The Manus case is the model. On April 27, 2026, the NDRC blocked Meta's acquisition of the Chinese AI start-up Manus, whose parent had reincorporated in Singapore to bypass restrictions. A week later, the State Council issued Decree No. 837 on Outward Investment, which the Asia Pacific Foundation of Canada describes as sweeping scrutiny of any outbound investment touching "Chinese-linked assets, goods, technology, personnel, or training." Penalties reach 10% of deal value with personal criminal liability for executives. The framework Beijing is now considering for AI models — filing at tier one, security review at tier two, domestic-only at tier three — is the same architecture, applied one level up the stack.

MOFCOM has quietly amended the export catalogue three times since 2020 (2020, 2023, 2025). China's Ministry of Foreign Affairs lists the Catalogue of Technologies Prohibited and Restricted from Export among its core non-proliferation and export-control instruments. Adding "advanced large language models" to that list requires only a joint MOFCOM–MOST announcement and a State Council sign-off — the same procedure used in July 2025 to add battery cathode preparation technology.

Diplomat View

Beijing has decided its AI models are a strategic asset, and it is about to say so in law. The July meetings are not a trial balloon; they are the drafting stage of a controlled-technology regime that mirrors Washington's own AI Diffusion architecture with sufficient asymmetry to matter. Expect a formal MOFCOM/MOST catalogue amendment or a State Council opinion adding "frontier large language models" to the Restricted list within six to nine months — plausibly bundled with the anniversary of DeepSeek R1 in January 2027. The falsifiable call: if by end-March 2027 Beijing has issued no export-catalogue amendment and no CAC standard on cross-border model access, the initiative has stalled and this analysis should be revised.

Three second-order effects deserve attention. First, US companies quietly training on Qwen or DeepSeek — a group that reportedly includes Cursor and Cognition — face supply-chain risk they did not face last quarter. Second, Huawei is the sleeper beneficiary: model export controls tilt Chinese labs toward Ascend faster than any subsidy could. Third, the EU's AI Act now has a jurisdictional gap it did not anticipate — its rules on general-purpose AI models with systemic risk assume access; they say little about what happens when the models are simply withdrawn from European servers.

What to watch

• Late July–September 2026: Watch for a MOFCOM–MOST joint announcement amending the Catalogue of Technologies Prohibited and Restricted from Export to add "advanced generative AI models" or "large language model training methods."
• September 2026 anniversary: The CAC's TC260 committee is expected to release the next iteration of its AI Safety Governance Framework and possibly a technical standard for the tiered risk-categorisation system flagged by Carnegie's Matt Sheehan.
• Q4 2026 model releases: Whether DeepSeek's V5, Alibaba's next Qwen and Z.ai's GLM-6 launch with unrestricted Hugging Face weights, geofenced weights, or domestic-only APIs will be the single clearest signal of whether the tiered regime is live in practice, regardless of what is on paper.

For now, the analytical bottom line is uncomfortable but simple: the AI-model layer of the stack has joined chips, cloud and data as an instrument of state power. Two years ago that would have read as speculation. On July 8, 2026, it reads as the base case.