For the last two years, the open-weight story has run in one direction: China gives, the world takes. DeepSeek, Qwen, GLM, Kimi, MiniMax, the models that closed the quality gap while the closed frontier was still charging by the token, all of it shipped with the weights attached, and the shipping was the part that changed the economics for everyone else. This week, China's commerce and science ministries released a draft update to the nation's catalog of banned and restricted export technologies, and the draft is a gate. It does not say the gate is closed. It says the gate now exists, and the country that built the gate gets to decide, for the next five years or so, when and how fast it swings.
The catalog covers 23 key AI technologies across large models, agents, compute clusters, and data processing, and the way to read it is to read the two ends. At one end, there is a total export ban on AI tools that can write or alter malware on their own to attack critical infrastructure, the military, or government agencies. Vulnerability-finding tools are not banned outright, but they get new export limits. At the other end, the fast-track: publishing restricted AI technology and weights as open source qualifies for automatic licensing, and the same goes for Chinese firms that run their own data centers abroad, tape out chips overseas, or sit in on international standards. The draft is, in other words, a machine that sorts the open world into what is already out the door and what is still in the building. Everything already public, through open-source releases or research papers, skips the new rules entirely. Everything that is not yet public is about to have a filing requirement attached to it, and the filing is the one that is the optionality.
The thresholds that do the sorting
The draft applies export controls to large models in two cases, and the two cases are doing different jobs. The first is the data case: models trained on China's "important data," as defined by the Data Security Law and its companion rules, that offer services based on it. Lawfully public data is exempt, and tiny amounts, up to 0.1 percent, are allowed if the data was cleaned beforehand, never shows up in the model's outputs, and does not substantially boost the model's research capacity for core technology in that field. That case is mostly about keeping the training data out of rival hands, and it is the quieter of the two. The second case is the one that will move markets, because it is the one that reaches the weights themselves. Controls kick in on the core technologies behind large models, the weights, the checkpoints, the source code, the architecture, and the training and inference methods, once a model hits 10 to the 26th power FLOPs of training compute, or has at least 2 trillion parameters, or ranks in the global top 10. Export officials determine top-10 status from public rankings of major domestic and foreign evaluators, looking at overall performance, specific tasks, safety, or global usage numbers.
Those three triggers are the heart of the draft, and they are worth reading slowly, because they are the first time a government has put hard numbers on what counts as a controlled model. 10 to the 26th FLOPs is not a number that comes from a lab's press release. It is a number that has to be estimated from public information, and the estimating is the part that creates the compliance problem. A company that built a model at the edge of the threshold has to know, before it ships, which side of the line it is on, and the knowing is the one that is going to require either public accounting of training compute or a self-assessment that a regulator can check later. The 2-trillion-parameter trigger is simpler and coarser, and it is the one that a frontier lab can game by splitting a model into pieces, and the splitting is the one that the draft's definition of "core technology" is going to have to catch, if it is going to catch it at all. The top-10 trigger is the strangest of the three, because it is a market-position test, not a technology test, and a model that is fourth today and ninth next year has just crossed a control line that no one engineered around.
The mirror, and the one it is not quite
Dean W. Ball, the head of strategic futures at OpenAI, wrote that the move "does not mean China is shutting down open-weight models," but it does indicate the government establishing the optionality to shut down future open-weight models at will, and that Beijing's framework is a mirror image of the model-weight export controls the US government has already put in place. The mirror framing is the one that the industry has been waiting for, and it is mostly right, with one difference that changes everything for Europe. The US controls its weights going out, and the weight going out is the one that is the American frontier. China is controlling its weights going out, and the weight going out is the one that is the open one, and the open one is the one that Europe has been building its independence on. That is the gap in the mirror, and the gap is the one that is the EU sovereignty strategy, and the strategy is the one that was the bet that Europe could run open-weight models in domestic clouds and stay independent from both the American and the Chinese closed frontier.
The bet, in plain terms, is that Europe picks whichever frontier model is available, hosts it on European soil, and therefore is not dependent on either Washington or Beijing for the inference that runs the continent's offices. The draft kills the bet in one move, because the bet assumed the open models would stay open, and the open models are the ones that the draft is sorting into the building. If the best open models come from the US or from China, and both of them can cut the supply with an export control, the host on European soil is the one that is the empty one, and the empty host is the one that is the sovereignty, and the sovereignty is the one that is the strategy, and the strategy is the one that is the bet. The bet is still alive, in the sense that what is already out the door stays out the door. The open weights that are public today, the Apache 2.0 licenses that are already under a third party's roof, are not the ones that the filing requirement reaches. What the requirement reaches is the next model, and the next model is the one that the open camp is going to release in the next two quarters, and the two quarters are the one that is the gap between the open model that Europe is running and the open model that is coming.
The fast-track, and the one it is quietly keeping open
The fast-track is the part of the draft that the headlines are going to miss, and it is the part that tells you what Beijing actually wants to happen. Publishing restricted AI technology and weights as open source qualifies for automatic licensing, which is to say, the act of opening the model is the act of clearing it for export, and the clearing is the one that happens the moment the company files the paperwork. The same automatic treatment applies to Chinese firms that run their own data centers abroad, tape out chips overseas, conduct research with foreign partners, or help set international standards. Read that list again, because it is a list of the things that a closed-country policy would not include. The draft is not trying to stop the open camp. It is trying to put the open camp inside a filing system, and the filing system is the one that is the optionality, and the optionality is the one that is the gate, and the gate is the one that is the 10 to the 26th FLOP.
Using restricted models through API calls, apps, websites, SaaS tools, or lightweight versions on local devices stays free of these export controls. Installing restricted AI technology on local servers abroad, however, requires a standard export license, and companies running the software on their own overseas cloud can still use the streamlined process. That distinction will shape the next product cycle, because it puts the on-premises deployment on the license side of the line, and the license side is where the delay lives. The delay is the competitor's head start. The company that can serve the model by API, through the fast track, ships now; the company that has to sell it into a customer's data center files first. The enterprise sale is the one that gets slowed down, and the API is the one that does not.
Beijing also pledges to back AI development in the Global South, and to ease exports for capacity building, tech sharing, and joint rulemaking within the World Artificial Intelligence Cooperation Organization, the bloc China launched to counter the Western AI bodies. That is the soft side of a hard draft, and it is where the market is. The Global South is the buyer, and the buyer is the one who wants the open model, and the open model is the one that gets the fast track. The pledge tells you where the demand is supposed to be, and the filing system tells you how much of it has to clear a counter first.
The model the draft was not meant to catch
There is one release that lands in the exact gap this draft opens, and it is the reason the timing of the two stories matters. Reflection, the company built by former DeepMind researchers Misha Laskin and Ioannis Antonoglou, just announced Beam, its first freely available model, and the way the coverage frames it is the tell: the most capable open-weight model built outside China. Beam is a 501-billion-parameter mixture of experts that activates 23 billion per token, and on demanding reasoning tasks it matches GLM 5.2 while using three to four times less compute, and it comes close to the much larger Qwen 3.8 Max on coding and agentic benchmarks. It got there with a reinforcement-learning phase that ran ten thousand five hundred Nvidia GB300s for over four weeks, one of the largest open-lab training runs to date, and the weights are shipping under Apache 2.0.
Read that against the draft and you have the whole argument. Beam is a non-Chinese open model, built to compete with the Chinese open models on their home turf of cost, and it is exactly the kind of asset that the US is going to want to protect and that Europe is going to want to host. It is also, in the draft's own terms, the model that a mirror of the Chinese controls would reach first, because the American version of this filing system is the one that sorts the American and European open weights into the same building. The gap the US controls leave, the gap that keeps the non-Chinese open camp alive, is the one that Beam is sitting in, and the filing is the one that is going to decide whether it stays there.
What it means, and what it does not
The first thing it means is that the open camp is now a regulated market, and a regulated market carries a compliance cost that the small lab feels first. The cost is not the model. It is the filing, and the filing is the thing that a company with a legal department and a filing history can absorb and a company without one cannot. The DeepSeek class of lab, the one that changed the world's price by shipping fast and shipping open, is the one that the compliance line reaches before the frontier, and the reaching is the one that the next open release is going to have to clear before it ships. That is a real change in the cost of being open, and it is the one that the 1.70 revenue-per-compute number was built on, because the 1.70 assumed the open model stayed cheap to run and cheap to ship.
The second thing it means is that Europe's sovereignty bet now has a clock on it, and the clock is the next open model. The EU strategy was to host whichever frontier model was available on European soil and stay independent of both the American and the Chinese closed frontier. The strategy assumed the open models would stay open. The draft is what happens when they stop, because the best open models come from the US or from China, and both of them can now cut the supply. What is already out the door, the Apache 2.0 weights that are already under a third party's roof, stays out the door. What the requirement reaches is the next model, and the next model is the one the open camp is going to release in the next two quarters. The gap between the open model Europe is running today and the one that is coming is the length of the clock, and the clock is the one that is the five-year window the optionality gives Beijing.
The third thing it means is that the US is going to read this as a mirror and respond in kind, and the response is the one that the American open camp is going to feel. The US controls its own weights going out, and the weight going out is the American frontier, the closed one, and the closed one is where the price is, and the price is where the war is. When both the best open model and the best closed model are each behind a filing system, the thing that is left uncontrolled is the gap between them, and the gap is the one that Beam is sitting in, and the gap is the one that the next two quarters are going to decide.
What it does not mean is that the open models stop shipping. The already-open weights, the public releases, the Apache 2.0 licenses that are already running on a third party's cloud, are the ones the filing system does not reach. The world's price, the 1.70, was built on the open model staying cheap to run and cheap to ship, and that is still true for everything that is out the door. The draft changes the next model. It does not change the ones that are already running, and the ones that are already running are the ones that the tier, the agent economy, and the profitable inference are built on.
Hot takes
1. The 2-trillion trigger is the line the next Qwen is going to cross, and the crossing is going to be the first real test of the filing system. The threshold that matters is not the 10 to the 26th FLOP, because that number is a compliance estimate. It is the 2 trillion parameters, because that is the number the open camp is going to hit in the next two quarters, and the hitting is the filing, and the filing is the license, and the license is the delay, and the delay is the competitor's head start. The company that can serve the model by API, through the fast track, ships now. The company that has to file first, ships later, and the later is the one the API wins.
2. Europe is going to be the first to feel the gap, because the gap is the sovereignty, and the sovereignty is the host, and the host is the empty one. The EU bet was the open model on European soil. The open model is now the filing, and the filing is the gate, and the gate is Beijing's optionality, and the optionality is a five-year window. The window is closing on the next model, and the next model is the one that the empty host was supposed to fill.
3. The US is going to mirror this, and the mirror is the control, and the control is the American weight, and the American weight is the closed frontier, and the closed frontier is the price, and the price is the war, and the war is the tier, and the tier is the sector. When both the best open model and the best closed model are each behind a filing system, the only thing left uncontrolled is the gap between them, and the gap is where Beam is sitting. The next two quarters decide whether the gap stays open, and the deciding is the one that is the test.
The bottom line
The gate is the optionality, and the optionality is a five-year window, and the window is the next release cycle. The open camp is now a regulated market, and the regulated market carries a compliance cost that the small lab feels first, and the small lab is the one that changed the world's price. The world's price, the 1.70, was built on the open model staying cheap to run and cheap to ship, and that is still true for everything that is already out the door. The draft changes the next model, and the next model is the one that Beam is sitting in, and the one that the 2-trillion trigger is going to reach, and the one that the filing is going to sort. The things that are already running are the ones the tier, the agent economy, and the profitable inference are built on, and they stay running. The things that are not yet shipped are the ones that have to clear a counter first, and the counter is the gate, and the gate is the one that is the five-year window, and the window is the one that is the test, and the test is the one that is the next two quarters.