The scaffold has no parameter count

What the draft says

China's Ministry of Commerce and Ministry of Science and Technology jointly published a draft on 16 October 2026 — Announcement No. 48 of 2026 — proposing to add 40 technologies to the country's export-control catalogue. Twenty-three are artificial intelligence, twelve photovoltaics and five biomedicine. Across all 40, reporting puts 14 in the prohibited category and 26 in the licence-required category. Public comment runs to 15 November 2026, and a pre-export registration requirement is reported to have taken effect immediately on 16 October, covering shipments already in progress.

One caution before any of this is used for planning. The clause-level detail here comes from news reporting and law-firm commentary, not from the published annex, and sources differ on wording — one describes the ranking test as "globally leading," another as a top-ten placement; one lists inference optimisation among the controlled methods, others say training methods only. It is a draft under consultation, so the thresholds and the scope may both move. What is stable enough to reason about is the shape, and the shape is unusual.

Three tests for a model, and one of them is not about your model

Parameter count is the familiar kind of threshold: a fact about an artefact, written in its config, stable for the artefact's lifetime. Training compute is nearly as good, with the qualification that you can only check it if the developer published it — which, for a model you downloaded rather than trained, is often not the case.

The third test is a different animal. A control that attaches to a capability ranking is a control whose trigger is other people's results. A model that sits eleventh on whatever index is being used is out of scope on Monday and in scope on Friday because a competitor's submission was withdrawn, or a new evaluation was published, or a scoring methodology changed — with no change to the model, its licence, its weights or your deployment. Compliance status becomes a function of a leaderboard, and leaderboards are maintained by third parties with no duty of care towards your shipping schedule.

That is a real operational problem and not a rhetorical one. It means a model's export status is not a durable property you can clear once and record; it is a condition you have to monitor, with a trigger you cannot see coming. Anyone maintaining an agent inventory and registry now has a field in it whose value is set by someone else's benchmark run.

The agent item has no threshold at all

Here is where the draft departs from every AI control that preceded it. The model items are defined by magnitude. The agent item, as reported, is defined by function: an agent that plans over long horizons, or that coordinates many other agents. There is no number to be under.

Think about what an orchestration layer actually is. It is a prompt, a tool catalogue, a planner, a memory policy and a termination rule — a few thousand lines that may call a model it does not contain. It has no parameters, no training run, no FLOP count. The three model tests cannot apply to it even in principle, so the question "is this in scope" has to be answered by reading the behaviour description against the system, which is a judgement, not a measurement. And the two attributes named are the defining attributes of the field: long task horizons and multi-agent coordination are what distinguishes an agent from a chat completion. A description that catches those catches most agent frameworks worth the name.

The practical consequence is that the thing you must now classify is your system, not your model. A team that reasoned "we use an open-weight model under a permissive licence, so export control is not our problem" has been reasoning about the wrong object. Under this draft the scaffold is its own controlled technology, and the scaffold is the part you wrote.

It is worth being fair about why a drafter would do this. A capability threshold expressed in parameters has aged badly: the last two years of agent progress came disproportionately from scaffolds, harnesses and tool design rather than from larger models, which is the finding our pages on the agent harness and benchmark landscape keep running into — the same weights score very differently inside different loops. A control that only counted parameters would miss the layer where the capability now lives. Naming the scaffold is technically correct. It is also unbounded in a way a parameter count is not.

The exemptions are the control

Read the exemptions first and the control comes into focus. Technology already public through open-source release or academic publication is excluded. Access through an API, website, app or SaaS platform is reported as not constituting an export. What remains — and it is the whole of the control — is the private movement of artefacts and know-how: weights, checkpoints, source, architecture, methods, and, by one commentary's reading, a restricted model installed on servers abroad.

Three things follow, and none of them is obvious from the headline.

• Publication is the fast track. A lab that open-sources a model has put it outside the control; a lab that keeps it proprietary and licenses it to a foreign customer has not. This inverts the default instinct of almost every company, which is to keep model work private and release only what it must. Here, privacy is what attracts the licence requirement.
• Capability can be exported as a service but not as an artefact. If hosted access is out of scope, the predictable equilibrium is more top-end Chinese capability reaching the world through endpoints and less through downloadable weights, with open-source publication remaining the explicit alternative. For a buyer, that is a push towards the dependency our build-versus-buy page treats as the central trade — and away from the self-hosting that data residency and sovereignty requirements often demand.
• The controlled act is deployment, not download. If an overseas install of a restricted model is an export, then the moment of exposure is not pulling weights from a hub — it is standing the thing up on your own infrastructure in another jurisdiction. That is the opposite of how most teams think about where their compliance boundary sits.

What to do if you build on Chinese open weights

Most readers of this will be on the receiving end: a team outside China that fine-tuned, serves or embeds a Chinese open-weight model, or that licenses a Chinese agent product. The draft is not final and the thresholds may move, so the work now is to know your exposure rather than to restructure around a consultation document.

• Record the route by which each model reached you. Public hub download under an open-source licence, hosted API, or a private transfer under contract. Under this draft those three routes have entirely different statuses, and most inventories do not record which one applied.
• Write down whether anything in your stack would read as an agent under the behaviour description. Long-horizon planning and multi-agent coordination are not edge cases in a modern stack; they are the architecture. Knowing which of your components a classifier would name is cheap now and expensive later.
• Separate the capability you need from the artefact you hold. For each dependency, ask what breaks if the weights stop being transferable but the endpoint stays available — and what breaks the other way round. Those are two different contingency plans and most teams have neither.
• Treat the ranking trigger as a monitoring task. If a model's status can change because a third party published a score, then someone has to watch for that, the same way third-party model and vendor risk already asks you to watch licence changes and deprecations.
• File comments if you are affected. The consultation closes on 15 November 2026. A behaviour-described agent item is exactly the kind of clause that gets narrowed during consultation when affected parties explain what it sweeps in.

The larger point survives whatever happens to this particular draft. Regulators have been writing AI rules against model artefacts because artefacts have numbers attached. The capability that matters now lives in the loop around the model, the loop has no numbers, and the first regulator to notice has reached for a description instead. Expect more of that, and expect your own compliance surface to be the code you wrote rather than the weights you downloaded.

Further reading

On this wiki:

• Regulatory landscape — where this sits among the other agent rules in force.
• Open-weight licences — what a permissive licence does and does not settle.
• Data residency and sovereignty — the requirement that pushes teams towards self-hosting in the first place.
• The agent harness — why the scaffold, not the weights, carries much of the capability.
• Third-party model and vendor risk — the monitoring function a ranking trigger belongs in.
• Agent inventory and registry — the record that now needs a provenance field per model.
• Air-gapped agent deployments — what running without a vendor endpoint actually costs.

Reporting:

• Taipei Times (Bloomberg): China proposes AI export curbs to manage security
• The Next Web: China proposes export controls on its advanced AI models and chip designs
• Geopolitechs: temporary export registration and the proposed restrictions