The most important number in China's proposed AI export controls is not 23, and it is not 40. It is two trillion. Because when you strip away the alarming headlines about agents, clusters, and chip design methods, you find a threshold that no publicly disclosed Chinese model can currently touch — and a regulatory architecture whose real function is not restriction but redirection.
This is the hunt for alpha in the noise of the herd. Everyone is reading the ban. Almost nobody is reading the exemption list.
Context: what the draft actually says
The proposal, framed as a catalog of technologies subject to export controls, splits 40 items into 14 prohibited and 26 restricted. Twenty-three of those touch AI directly. The headline-grabbing provisions cover AI agents designed for sensitive environments, computing clusters, and chip design methodologies. The prohibitions activate on models exceeding two trillion parameters, or models whose performance and safety benchmarks rank in the global top ten. Interim measures take effect immediately. The public comment window runs to mid-November. Transactions already initiated but not completed are captured.
That last clause deserves more attention than it received. Locking review authority before the rule is finalized is not a drafting oversight — it is an anti-circumvention mechanism designed to prevent companies from front-running the consultation period. It signals enforcement intent far more clearly than the parameter threshold does.
The sourcing matters here, and I flag it plainly. The report I am working from carries no link to the original announcement, no direct quotation from the issuing ministry, and no itemized list of the 23 technologies. It was published by an outlet with no discernible blockchain connection, which tells me to treat it as aggregated secondary coverage rather than primary policy text. The internal arithmetic is self-consistent — 14 plus 26 equals 40, and 23 sits inside that — and the exemption language is clear. The definitions are not. When I audit this kind of document, the gap between the numbers and the definitions is exactly where the regulatory teeth hide or fail to hide.
Core: the threshold is a signal, not a gate
Start with the parameter count. As of my last verifiable data point, the largest publicly disclosed Chinese models — DeepSeek's mixture-of-experts releases, Kimi's trillion-parameter class system, Qwen's large variants, GLM's mid-hundreds-of-billions architecture — none reach two trillion total parameters. Globally, you can count the plausible members of that club on one hand, and most of them are unconfirmed rumors. If the threshold is measured on total parameters, the prohibition clause has essentially zero live targets among Chinese model developers today.
That is the first thing that should make you suspicious of the framing. A prohibition with no current violators is not a prohibition. It is a reservation — a shelf space cleared for a model that does not yet publicly exist, or one that the regulator believes is being trained.
Which brings us to the second clause, and this is where the design gets interesting. "Performance and safety benchmarks in the global top ten." I have spent years grading technical claims, and I can tell you this standard is not automatable. It requires three answers that the draft does not provide: which benchmarks, evaluated by whom, at what point in the development lifecycle. Without those, a compliance officer cannot determine ex ante whether their model is covered. And when the penalty is criminal liability, ambiguity does not produce caution — it produces over-declaration. Every borderline model gets filed. Every ambiguous transaction gets paused.
The pairing is deliberate, and it inverts the way most people read the rule. A hard, high, explicit threshold combined with a soft, low, discretionary one produces a regime where nearly nothing is formally banned and almost everything is practically negotiable. That is a governance style, not an accident.
Now the exemptions, which constitute the actual policy.
Service delivery through cloud API is explicitly excluded. Models already released under open-source licenses or published in academic literature are excluded. Read those two clauses together and a different document emerges from the one the headlines described. Closed weights crossing a border requires permission. An API call crossing the same border requires nothing. An open-weight repository on a global hub requires nothing, because it is already out and cannot be recalled.
I have watched enough protocol design to recognize this shape. This is not a wall. It is a funnel. It is engineered to make "buy the model" expensive and "rent the model" free, to make "deploy weights in your own data center" a licensing event while "call our endpoint" remains ordinary commerce. For the sovereign-AI contractors chasing seven- and eight-figure build-outs in the Gulf and Southeast Asia, the friction is real and immediate. For the cloud regions of the major Chinese platforms, this is a structural tailwind that almost nobody priced in.
And there is a counterintuitive second-order effect that the coverage missed entirely. If closed-weight export becomes administratively costly while open release remains unencumbered, rational firms shift left toward open. The rule intended to protect frontier capability may accelerate its diffusion through the open channel — because the open channel is precisely the one the draft leaves untouched. Watch the release cadence of Chinese open models over the next two quarters. If it accelerates rather than slows, the exemption did more work than the prohibition.
Then there is the provision I consider the most consequential and the least discussed: computing clusters and chip design methods.
Chinese hardware vendors have spent two years selling turnkey compute infrastructure — rack-scale and supernode-class systems, not individual accelerators — into exactly the markets the model restrictions now touch. If the cluster architecture itself requires an export license, that go-to-market path narrows considerably. The stated ambition of building a domestic accelerator ecosystem capable of contesting the incumbent software stack runs directly into a rule that restricts the channel through which that ecosystem would have scaled. Ecosystems need distribution. Distribution needs exports. You cannot have the first while restricting the second.
On chip design methods, the symmetry with US restrictions on design tooling is obvious and almost certainly intentional. The asymmetry in impact is just as obvious and almost certainly not: Chinese design tool vendors hold single-digit global share. This clause reads as a bargaining chip, not a countermeasure.
Contrarian: three things the draft gets wrong, and one it gets right
Here is where I part company with the consensus reading, which treats this as a hardening regime.
The first blind spot is the ownership question. The draft says nothing about technologies developed by foreign-owned research centers operating inside China. Can a multinational's in-country AI team transmit trained weights to headquarters? If yes, the regime has a canyon-sized hole. If no, it is one of the clearest signals of capital-flight risk the sector has seen in a decade. Either answer is a major finding, and neither is available. I flag this as UNVERIFIABLE rather than guessing, because the difference between the two branches is the difference between a leaky rule and a strategic rupture.
The second blind spot is that the draft almost certainly does not cover what actually leaks. Distillation outputs, fine-tuned adapters, quantized derivatives — these are the everyday carriers of capability transfer, not raw base weights. A rule barring the shipment of a base model while permitting the shipment of a four-bit derivative is a rule with an obvious bypass built into its text. Unless the definition of "technology" is drafted at the artifact level rather than the checkpoint level, the enforcement surface is porous.
The third is the open-source tension nobody wants to name. If the objective is preventing frontier capability from diffusing, exempting open release is a self-inflicted wound, because open weights disperse irreversibly. If the objective is protecting commercial IP, the exemption is coherent. The draft never states its purpose, so we cannot distinguish considered design from negotiated compromise. For anyone working on safety research, that ambiguity matters — because a regime that expands to cover evaluation methodologies and red-team techniques would damage the collaborative substrate that global safety work rests on, one export license at a time.
What the draft gets right, and where I will give it credit, is the API carve-out. Whoever wrote this understood how Chinese AI companies actually earn foreign revenue: endpoint calls and hosted inference, not weight handoffs. That is a regulator reading the industry accurately rather than theorizing about it.
Takeaway
So here is the trade nobody is pricing. The friction lands on three groups: sovereign deployment contractors whose high-margin build-outs become licensing events, compute infrastructure vendors whose turnkey export channel narrows, and every party to a cross-border AI asset transaction now subject to a registration step with unknown latency and unknown approval rates. The beneficiaries are equally clear: cloud regions as the only low-friction delivery path, open-weight ecosystems as the only unencumbered distribution channel, and a compliance services layer that just acquired a mandatory line item on every deal.
But the whole structure rests on an unverified foundation. The key definitional clauses are missing. The event timing sits beyond my ability to independently confirm. What I have built is a reasoning chain over a limited fact skeleton, and I label it as such. The public comment window closing in mid-November is the verification node — the itemized technology list, the cluster definition threshold, and whether the open-source exemption survives contact with the final text.
If it does survive, and if release cadence accelerates, then the loudest reading of this document will have been wrong in the most interesting way. The story behind the token was never the ticker. It was the carve-out.