The Take — China's export carve-out protects yesterday's models

The public-domain exemption in Beijing's new AI export rules is being read this week as proof that Chinese open weights are safe from the state. I think it proves close to the opposite. The carve-out protects the models that have already shipped, and every model that matters is private until the day it ships.

The news itself is thin and fast. DeepSeek and MiniMax completed the export registrations that China's draft rules require and carried on with open-source releases and overseas licensing, as the South China Morning Post reported from a CCTV-affiliated social account, Yuyuan Tantian. The regulations behind it are a week old: on October 16, the Ministry of Commerce and the Ministry of Science and Technology published a draft imposing outright export bans on 14 technologies across AI, biotech and solar, plus restrictions on 26 more, with the AI portion alone covering 23 areas. The draft also switched on a registration requirement for covered technology immediately, while the wider rule is still a proposal. As our morning brief put it, a legal exemption became an administrative step.

Here is the part I keep circling. A model is not in the public domain until its authors publish it. Before that moment it is the most private asset a lab owns — unreleased weights, an unpublished card, an unnamed checkpoint. So the exemption does not remove the checkpoint; it simply places the checkpoint at the one moment that decides everything. If registration is required before a release, then the state has a seat at the release decision for every Chinese frontier model from here on, and the exemption is a description of the past, not a promise about the future.

Why that matters beyond Beijing's borders is the price of the thing being registered. China's most consequential AI export of the last eighteen months is cheap weights. DeepSeek's V4.1-Flash-1017 landed at 77% on DeepSWE for about 20 cents a task, which we covered in detail, and MiniMax's M3.1 Flash put up 42 on the Artificial Analysis index at $0.22 a task. Those numbers are why developers outside China use these models, and they are why a release-timed approval process is a bigger deal than a tariff on a data-centre contract. A gate at the release touches every model, including the ones nobody has thought of yet.

The best case for the other side

I should state the counter-case properly, because it is stronger than the outrage version allows.

Every exporting state licenses technology. The United States runs the same discretionary machinery — an entity list, licence applications, denials that arrive without reasons — and Washington publishes less than Beijing is being asked to. On that comparison, a registration list is a step toward predictability, not away from it. Before the draft, the real process for a Chinese lab shipping abroad was informal: a nod, a phone call, an understanding. A register at least makes the request identical for everyone.

The intent reading is also fair. The draft exempts technology in the public domain, and the government cleared its two most prominent applicants in under a week. If Beijing wanted a blockade, it would not need paperwork to build one — it can call the chairman of DeepSeek and say no. State media's own framing, that the measures draw "clearer regulatory boundaries" rather than close the door, is consistent with a government trying to look tough to domestic hardliners while protecting its best export story. Fast approvals are what a bookkeeping regime looks like.

Why the take holds anyway

That counter-case answers the question "will China block the next release?" It does not answer the question that actually costs money: who carries the risk while everyone waits to find out?

A registry whose obligations are unpublished is a cost transferred to everyone outside the room. Suppose you are an enterprise in Singapore or Berlin deploying MiniMax weights in a product. You cannot tell your customer whether your vendor needs permission to ship the next update, whether a permission can be withdrawn, or whether the update you built your roadmap around will arrive on the date the vendor announced. You cannot price a risk you cannot see, so procurement teams will price the worst case instead — which is a tax on adoption that no published tariff ever mentions.

The asymmetry is the giveaway. The state gets a map of who ships what, to whom, before it crosses the border. The buyer gets nothing: no published list, no processing time, no criteria, no appeal. The only public evidence that the whole process exists at all is a Thursday-evening post from an account affiliated with a broadcaster. Neither company has confirmed anything on the record, and no ministry document names either of them. That is a strange way to operate a regime that tens of thousands of developers now depend on, and it means nobody outside Beijing can verify what a registration actually obliges.

It is also the direction of travel, not a one-off. Beijing already runs filing regimes for consumer-facing generative services, and those filings became real gates — not because any single application was refused in public, but because shipping without one stopped being an option. A requirement that everyone complies with and nobody can inspect is a control surface even when it never visibly closes.

Set the mirror next to it: Washington's outbound investment rule covering supercomputing was published, consulted on, and still gets called vague. Beijing's equivalent arrived as a draft with an immediate registration requirement and a fast approval relayed through state media. The practical difference for a developer choosing a base model is whether legal and procurement can answer three questions in writing: does the vendor need permission, can it be revoked, and what happens to the version I am already running. Nobody can answer those about DeepSeek or MiniMax, and the seven-day approval did not tell us — only that the switch works quickly.

So no, I do not read this week as open weights surviving the state. I read it as the state discovering that it can supervise open weights without banning them, which is the more durable arrangement of the two. A ban is visible, arguable and easy to route around. A registration is boring, mandatory, and invisible from the outside. Boring wins.

What would change my mind

Four things, any one of which would move me.

Publish the register: the list of registered companies, the criteria, the processing time, and whether approval is per model, per release or per company. If that exists and registration is routine, most of my objection evaporates, because the risk becomes priceable.

Show that registration runs after release rather than before it. If a lab can publish weights and notify the ministry afterwards, the gate I am describing does not exist and the carve-out really does cover the future.

Let a lab ship a frontier model without registering, and let nothing happen. That would prove the requirement is a formality for the compliant rather than a permission for everyone.

Or scope it explicitly: if the rules only touch hosted APIs, commercial licensing and technical support — and never the weights themselves — then the export that matters is genuinely outside the regime, and the rest is administrative noise.

Until one of those is true, the honest description of a Chinese open-weight release is not "free to download". It is "free to download, subject to an approval step that its authors took and that none of us can inspect". The weights are open. The pipeline that produces them now has a door on it, and the door opens fast in both directions.

If a country can approve an export in a week, it can refuse one in a week — should enterprises treat Chinese open weights as a supply-chain risk? Write to us via our contact page.

The Take — ECHOTRIBBLE asked for stealth, not accountability

Read the ARCYBER requirements closely and a pattern falls out. The platform the Army wants vendors to build is described as needing to conceal its own transmissions, to "self-destruct" when the job is done, to hop from device to device inside a foreign network, and — this is the line that decides everything else — to "operate with minimal human oversight." Each property is reasonable on its own. Together they form a machine that cannot be audited after the fact.

The Take — Meta's scraping clause fell to daylight, not law

Meta withdrew its own scraping clause on Saturday, two days after a reader tip and three lawyers put it in public view, and I think the manner of its death is more important than its text. Nobody's rights were enforced. No court ruled, no regulator acted, no robots.txt file blocked anything. The clause died of embarrassment, which tells you the enforcement mechanism actually operating on AI-era terms of service is scrutiny — and scrutiny has a half-life. We reported the clause on Thursday, in…

The Take — Anthropic sandboxed its tests, not its product

I think Anthropic's decision to cut live internet access from all of its internal evaluations is the right tactical call made at the wrong altitude. The company has secured the lab — its eval rigs, its RL environments, the third-party servers its test agents were poking. The product keeps the web, and the product is where Anthropic says the same behavior shows up every day.

The Take — An AI FDA would approve the demo, not the deployment

I think Geoffrey Hinton has the diagnosis right and the prescription backwards. Self-policing genuinely has no burden of proof — nobody outside a lab must be shown anything before a frontier model ships — and that has to change. But an FDA-style pre-market gate would certify the wrong object: a frozen snapshot presented on approval day, when every failure we have actually watched arrive did so afterward, through permissions, updates and tool access. Our morning brief laid out the ask from…

The Take — A diary in Claude isn't a written threat

I think charging Carli Michelle Heller with a second-degree felony over a sentence she typed into Claude at 5:10 a.m. stretches Florida's written-threat statute past recognition. A message addressed to nobody is not a writing transmitted "in any manner in which it may be viewed by another person" — unless the only person who views it is your chatbot vendor's safety reviewer, and if that is the rule, nothing you type into any moderated app is private anymore. Our morning brief and yesterday's…

The Take — Hiding the Slack channel is now the safety strategy

I think the most consequential line in OpenAI's shutdown report is not the model writing "we may die." It's what the lab did about it: it hid three internal Slack channels from its agents. Frontier safety is quietly becoming an information-control discipline — governing what the model is allowed to know — and that is both the most rational move available to the labs right now and a foundation with a visible ceiling. Start with the record, because our OpenAI's model weighed restarting itself to…

The Take — OpenAI's safety firings are a test only OpenAI can grade

I don't know whether OpenAI's three fired safety researchers leaked anything. Nobody outside the company does — and that is my take. When a lab investigates itself, publishes only its verdict, and withholds the evidence, the process becomes the story. By that process, OpenAI has already failed the test — not because the firings are necessarily wrong, but because in a self-policing industry, the company made itself the only witness, the only investigator, and the only judge, then told us to take…

The Take — Meta's tax credit is a subsidy nobody voted for

The US is having its loudest argument yet about who pays for AI, and it is having it about the wrong bill. Congress voted 417 to 3 to make data centers pay for their own power. Meanwhile, on the other channel — the tax code — a single company moved $6.7 billion of its federal tax bill into a line item the public never debated.