China’s Ministry of Commerce and Ministry of Science and Technology issued Announcement No. 48 on Oct. 16, 2026, proposing to add 40 technologies in artificial intelligence, biomedicine and photovoltaics to the Catalogue of Technologies Prohibited and Restricted from Export. Of those, 23 fall under AI. The catalogue revision is now out for comment, and a pre-export interim filing process for technologies listed in the annex has already begun.
For AI companies whose business may involve technologies named in the annex, the immediate task is to review current and planned overseas activity. The filing requirement covers transfers of technology ownership to overseas parties, licensing for overseas use, and cases where the owner or actual controller of a domestic technology becomes a foreign entity. Exports that have started but are not yet complete are also expressly included.
For teams negotiating overseas deployment, technology licensing or equity transactions, the practical starting point is to line up contract terms with actual technical delivery: what exactly will be handed over, what the counterparty will be able to do with it, what has already been delivered and what remains in progress. The legal analysis begins with that factual list.
Two timelines need to be separated
The article says the current arrangement has two parts: the catalogue revision itself and the interim filing requirement during the transition period. Public comments on the revision run from Oct. 16, 2026 to Nov. 15, 2026, and the final scope, thresholds and management measures may still change. At the same time, the announcement states that from the date of release until the formal revised catalogue takes effect, technologies listed in the annex are subject to pre-export filing.
That leaves companies with a near-term compliance job: complete scope checks and filing preparation now, then assess later whether formal licensing or convenience measures apply once the final catalogue is in force. The article suggests keeping two parallel records for each project, one for the current filing and another for items that may need to be added or adjusted after the final rules arrive.
In a Q&A on Oct. 20, the Ministry of Commerce said that of the 40 proposed additions, 14 are proposed for export prohibition and 26 for export restriction. Those figures cover all three sectors combined. For AI, companies still need to compare their business against the specific annex entries. The announcement lists AI directions including large models, agents, computing clusters and information processing.
On the legal side, Article 2 of the Regulations of the People’s Republic of China on the Administration of Import and Export of Technologies treats cross-border technology transfers conducted through trade, investment or economic and technological cooperation as technology import and export. That includes patent assignment, licensing, transfer of technical secrets and technical services. In practice, the article notes, technology export can arise in software licensing, R&D cooperation and investment transactions, not only in straightforward software sales.
The interim filing should also be tracked separately from existing contract registration for freely exportable technologies and export licensing for restricted technologies. They are different compliance tracks with different requirements. Companies can use a single project list to mark the legal basis, responsible filing entity and completion milestone for each item, rather than assuming one completed procedure clears the whole project for delivery.
That was the state of the rules as of Oct. 24, 2026, according to the article.
Use actual deliverables, not labels, to define the business scope
The first step in the review is for technical staff to produce a detailed delivery list. Model weights, training or inference code, algorithm documents, deployment scripts, technical support permissions and update services should all be described separately. Legal teams can then compare those items one by one against the technical scope and thresholds in the annex.
The article draws a distinction between different delivery structures. Delivering a model and deployment tools to an overseas customer so the customer can run them on its own equipment is not the same as providing output through an online service. In its Q&A, the Ministry of Commerce said that if large-model technology later falls within the restricted export category, overseas local deployment should be handled under the relevant rules. By contrast, services provided through APIs, applications, web interfaces and SaaS, as well as lightweight local deployment on end devices, do not fall within the large-model technology export management scope described in that explanation.
Even so, the article says companies still need to match that explanation against the facts of the product and the exact annex entry. A single contract may combine online services, customized model delivery and technical support. It cannot be classified solely by the title on the cover page, such as “service agreement.” Once each deliverable is listed separately, the applicable requirements become easier to identify.
The same logic applies when a group plans to deploy a model on overseas computing resources and then provide services externally. Companies need to spell out the overseas receiving entity, server operating arrangements, model control rights, follow-up maintenance and the way external authorization will work. The Ministry of Commerce has already pointed to convenience measures for scenarios such as self-built and self-operated overseas computing centers, but the article says each project still needs to be checked against the final text and actual filing requirements.
Open-source projects also need records showing what has already entered the public domain. The announcement includes scope language for technologies that have already become public through open-source release or academic papers. For future open-source and similar technology exports, the Q&A mentions convenience arrangements such as automatic licensing. Companies are advised to preserve the publication date, version, scope and license terms so they can distinguish between material already made public and proprietary technology that has not yet been delivered.
R&D cooperation deserves special attention as well. A joint development agreement may provide for shared background technology, exchange of interim results and continued development by an overseas partner. Technical teams need to document those rights and the scope of information sharing so legal teams can determine when a transfer occurs, which entity should file and how future results should be handled.
Changes in control are part of the review too
Announcement No. 48 expressly includes cases where “the owner or actual controller of domestic technology changes to an overseas entity” as a filing scenario. That means financing, M&A and group restructuring teams need to be part of the same review, with technology delivery and equity transactions examined together.
The article says the review can begin with current ownership. Which company holds the relevant technology, how employee-created results are assigned between staff and the company, and whether there are outside licenses, co-owned rights or restrictions from cooperative development all affect whether the company can transfer or license the technology externally. If the chain of rights is not clear, later filing statements may conflict with one another.
From there, companies should compare the structure before and after the transaction. Who holds the equity, who can decide how the technology is used or disposed of, who appoints key personnel and what governance rights an overseas party will obtain should all be described in transaction documents. The article notes that the announcement does not resolve actual-control questions through a single universal shareholding threshold. Companies need to examine the agreements and the real governance arrangement.
For deals already in progress, the article suggests adding a handover checklist for technology and control rights. That checklist can mark the rights expected to change, the timing, internal approvals, filing steps and the relationship to closing documents. It gives the lawyers handling the equity deal and the team handling technology licensing a common factual record.
If the technology was originally obtained from a third party, the company also needs to check whether the original license allows sublicensing, territorial expansion or a change in control. Separate from regulatory filing, the contract itself may impose consent and notice obligations. For the overseas recipient, those documents also affect whether the acquired technology can be used as planned.
What companies should prepare for the interim filing
The designated filing portal is the technology trade management information application within the Ministry of Commerce’s unified business system platform. The filing information mainly covers the technology exporter and recipient, the export destination country or region, the technology to be exported and its intended use, and the expected export amount. The article says the final details should be checked against the platform and the filing form attached to the announcement.
Companies can start by assembling an internal package of materials: corporate registration documents and contact details, recipient information, the contract or proposed transaction arrangement, a description of the technical scope, analysis of the corresponding annex entry, the delivery plan and an estimate of the amount involved. The package is meant to support filing and internal review. What must actually be submitted should follow the current platform page and guidance from the competent authority.
Descriptions of the technology should rely on verifiable facts. The model or technology name, version, functions, key indicators, intellectual property ownership and intended use should remain consistent across materials. R&D teams confirm the technical content, business teams confirm the recipient and delivery method, finance confirms the amount methodology, and legal or compliance teams consolidate and review the package.
Where multiple technologies are exported to the same recipient in the same transaction, the announcement allows combined filing. Other situations should in principle be filed separately. If a group has multiple overseas entities, or the same customer receives different technologies in stages, the article says companies should first identify the recipient and delivery arrangement for each transaction and then decide how to file.
Existing contracts need a separate review. The announcement expressly covers exports that have started but are not yet complete, so companies can map each project by “already delivered content, pending content, continuing updates and support.” Long-term licenses and staged R&D contracts especially require technical staff to participate, rather than relying on the signing date alone to decide whether a project is over.
After submission, companies should keep the filed version, system receipt, submission time and records of follow-up communication, and link them to the contract and delivery list. If the technical scope, recipient or implementation method changes, they should check whether supplemental explanations or a new procedure are needed. Good records reduce the need to reconstruct the entire transaction later if questions arise.
Where the boundary is unclear, the article recommends presenting the facts and the technical comparison to the competent authority for consultation. The more specific the question, the more useful the response is likely to be. A description of the intended deliverables, deployment location, model control and recipient permissions is more helpful than a broad question such as whether “AI going overseas” is restricted.
Contracts need room for compliance procedures
Technology export contracts directly affect delivery schedules, payment timing and liability for breach. The article says companies should build regulatory procedures into the timetable during negotiations and specify which side will provide which materials, who will communicate with authorities and who will keep the records.
Article 30 of the technology import and export regulations provides that restricted export technologies are subject to licensing. Articles 31 through 35 set out the sequence for application, the letter of intent for technology export licensing, substantive negotiations and signing, and the application for the license itself. Article 35 states that the relevant technology export contract takes effect on the date the license is issued. For projects in that category, contract structure and negotiation timing need to line up with the statutory process.
Freely exportable technologies, by contrast, fall under the contract registration regime in Articles 36 through 38. Those contracts take effect when lawfully formed, while registration remains a separate procedural requirement. Companies should first determine the classification and then design the effectiveness, delivery and payment clauses. For projects touched by the current interim filing, they also need to add the filing milestones required by this announcement.
Contract language can address assistance with materials, changes in regulatory requirements, suspension of delivery, extension of deadlines and fee treatment after termination. If an overseas customer changes the final use or the identity of the receiving entity, for example, the contract can require prompt notice. If additional procedures become necessary, both sides can cooperate and adjust the delivery schedule accordingly.
Technical appendices matter as much as the main agreement. The files to be delivered, the permissions to be opened, the number of permitted users and the scope of update services should all be traceable directly from the contract. That gives commercial and technical teams a common execution reference and helps prevent actual delivery from drifting beyond the scope originally reviewed.
For projects with staged payments, the article suggests tying payment conditions to verifiable milestones. Internal approvals, filing or licensing steps, technical delivery and acceptance can each leave a record. If policy or factual circumstances change, both sides can then identify what has been completed and which fees may need to be renegotiated.
Article 40 of the regulations also states that if the main terms of a licensed or registered technology export contract change, the relevant procedures must be handled again, and if the contract is terminated, a filing must be made as required. The article recommends building change checks into routine contract management so that added deliverables sent by email do not leave the compliance record outdated.
Technology export checks should run alongside cross-border data review
Model deployment or technical support may involve the movement of training materials, test data, logs and user information. At that point, the article says, companies should map the data flow as well: what data is provided from within China, what overseas personnel can access, where the data is stored and whether it is returned after processing.
Where personal information is involved, Article 38 of the Personal Information Protection Law sets conditions for providing personal information overseas, Article 39 addresses notice to individuals about the overseas recipient, the purpose and method of processing and separate consent requirements, and Article 55 requires a prior impact assessment for activities such as providing personal information overseas. The article says the analysis should also take into account the applicable supporting rules and any exemptions for cross-border data transfers.
In actual projects, companies can prioritize synthetic test data or materials that do not contain personal information. If real data must be used, they need to distinguish de-identification from anonymization. Article 73 of the Personal Information Protection Law distinguishes the two, and Article 4 excludes anonymized information from the scope of personal information. Data that can still identify an individual when combined with other materials remains subject to personal information rules even if names are removed or phone numbers are masked.
Access in test environments should also be limited. Whether debugging staff can download data, whether logs record user inputs and whether third-party support personnel can enter the environment should all be defined in permissions settings and contracts. After testing, companies should keep records of the scope of use and processing, then determine what cross-border data arrangements are needed for the formal business.
For datasets and code, the source rights also need review. Who supplied the training or test materials, whether the license permits the proposed use and whether customer data can be used for further development all affect how the technology may be used after delivery. The article says companies should preserve source evidence and license restrictions together with the relevant technical version.
If important data, dual-use items or other specifically controlled matters are involved, the project also needs to be checked under the corresponding regimes. One delivery list can support reviews across technology export, data, intellectual property and contracts, with each specialist team reaching its own conclusion and unresolved coordination points handled together.
A first screening can start now
The article says a first round of screening can cover overseas projects expected to be signed or delivered in the next three months, as well as signed contracts that still involve technical delivery. Project leads can first collect the business facts, then have R&D and legal teams compare them against the annex and produce a working list of items that require filing, require more facts or require consultation.
Each project should have one person responsible for consolidation so that different departments do not explain the policy to customers in different ways. External communication can focus on concrete arrangements: what recipient information needs to be added, when filing preparation will be completed, which delivery milestones need adjustment and how both sides will cooperate. The article says that is usually more useful than sending a generic risk notice.
The consultation period is still open. If companies find that technical thresholds are hard to apply, that certain service-delivery models are difficult to interpret, or that convenience measures need clearer operating rules, they can submit specific comments before the deadline. The article says those comments should ideally include the business scenario, the technical facts and proposed wording so the authorities can see exactly where the issue arises.
Once the final catalogue is released, project leads can continue using the same checklist, marking whether the applicable entry has changed, what additional procedures are needed and whether the next delivery will be affected. For contracts still being performed, the result should also be shared with technical and commercial managers and reflected in the delivery plan. Filing receipts, technical versions and contract appendices can be stored under the same project number so that the next model upgrade or change in recipient starts from a documented review point.
The original article also states that it is provided only for legal, policy and industry research exchange and does not constitute investment advice, legal advice, tax advice or any other professional advice, nor does it amount to a recommendation, promotion or solicitation for any financial product, digital asset or commercial project. It adds that the regulatory rules, market data and institutional information cited are mainly drawn from public materials and may change with laws, regulation, market conditions and project developments, and that readers should make their own judgment based on the latest public information and comply with the laws and regulations applicable in their jurisdiction.
