-
China is planning to ban exports of AI tools that write or rewrite malware to attack key infrastructure, defense, or core government systems.
-
Tools that find software flaws, top AI models, and AI chip designs would need a license instead.
-
The list is still a draft. But a registration rule took effect October 16, and it covers deals already underway.
China’s commerce and science ministries have proposed export limits on some powerful AI hacking tools. The draft, Announcement No. 48, came out October 16.
It covers 40 technologies in AI, biomedicine, and solar power. Of those, 23 are in AI. The public can comment until November 15. Meanwhile, the registration rule for exporters already applies. Nothing in the draft is final yet.
The Category of AI Tools China Wants to Ban
Fourteen of the 40 technologies face an outright ban. AI cyber tools are among them. The ban applies only to tools that could attack highly sensitive systems. The draft names critical information infrastructure, defense and military industry, and core government affairs.
First, the draft targets AI that writes and mutates malware on its own. A tool falls under the ban if it beats one mainstream antivirus program 85% of the time. It also falls under the ban if it beats multi-engine malware detectors 60% of the time. The same goes for a 90% success rate against machine learning models.
Second, the draft covers malware that adapts as it runs. One test is whether the code can detect sandboxes or escape them. Another is whether the code rewrites 50% of its structure or control flow on every run.
Two more AI items sit on the banned list. The first is AI agents built mainly for critical infrastructure, defense, or core government work, if they perform at a high level. The second is large models trained on China’s “core data.” That term comes from the Data Security Law. That term comes from the Data Security Law.
Which Tech Tools Would Need a License?
Twenty-six technologies would need a license. For cyber tools, the target is AI that hunts for software flaws. A tool needs a license if it meets any one of six tests.
For example, one test covers a tool that finds more than five unknown high-risk flaws in a single pass. It must sit in a major open-source project or operating system. Another test covers a tool that builds a full exploit chain for known flaws. It must work at least half the time on mainstream operating systems or browsers.
Large models face limits too. The core technology behind a model needs a license if it meets any one of three tests. Those tests are 10^26 training operations, 2 trillion parameters, or a global top 10 rank in public rankings. Models trained on China’s “important data” need a license as well. A tiny share of cleaned data, 0.1% or less, gets a pass.
The list also takes in AI chip designs, memory chip designs, and technology for clusters of more than 10,000 AI accelerator cards.
Some Tools will Remain Free
Technology that is already public stays exempt. That includes open-source releases and published research papers. The ministry says most AI technology stays free to export.
Selling access to a restricted model does not count as an export. The ministry named API access, apps, websites, software-as-a-service, and light versions on user devices. Installing a restricted model on servers abroad does count.
Even so, some cases get fast approval, called automatic licensing. Those cases include open-source releases, Chinese firms’ own overseas data centers, chip production abroad, and joint research.
What’s Next for Exporters
Until the final list takes effect, exporters must register on the ministry’s online platform before they act. The ministry says registration helps it track demand and spot risks. Three moves trigger the rule. They are transferring ownership abroad, licensing technology for use abroad, and shifting control of the owner to a foreign party.
Exports that have started but not finished must register as well. Exporters must name both parties, the destination, the technology, and its value. Companies must decide for themselves if the rule applies to them. Officials have not set a date for the final list.
Why Beijing is Making this Move
A ministry spokesperson called the revision routine and said it targets no specific country. The stated goal is to keep AI under human control and stop misuse. The spokesperson also noted that major economies already control similar technology.
The exposure of sensitive personal information remains another major cybersecurity concern, as large dumps of driver license data can fuel identity fraud and other forms of abuse. The move comes as the technology race with the United States tightens. U.S. rules limit advanced chips flowing into China. China’s rules target models, agents, and chip designs flowing out.
Dean Ball, who works at OpenAI, said the framework lets Beijing shut off future open-weight models. He added that it mirrors U.S. rules on model weights. As a result, Western firms may lean harder on American open models.
For now, the final text could still change. Therefore, companies with Chinese AI deals should check their exposure. They should also file comments before November 15.
