Export Control Law

Establish a classification workflow covering everything within Art. 2, including “technical data and other data relating to the items”. Items on the export control list or subject to temporary controls require a licence from the national export control authority. Where an exporter cannot determine whether goods, technology or a service is a controlled item, it may consult the authority, which must respond promptly — a formal route to reduce uncertainty that should be exercised in writing with the reply archived.

Applies when

Exporters of AI chips and accelerator cards, intelligent robots and unmanned systems, and high-performance sensing and imaging equipment; and software and algorithm companies transferring model weights, algorithm source code, training and evaluation datasets, or chip layouts and process files abroad.

Evidence to retain

• · Classification register giving, for each product, technology or dataset, the conclusion, the list entry relied on and the assessor
• · Classification records for technical data and datasets: model weights, source code, datasets and design files
• · Archived written classification enquiries to the national export control authority and the replies received
• · Description of the review and refresh mechanism, including re-classification after a list adjustment

Estimated first-time effort: 20–50 person-days (estimate, not a commitment)

For goods, technologies and services outside the control list and outside temporary controls, an exporter must apply for a licence where it knows or should know, or is notified by the national export control authority, that the items may endanger national security and interests, be used to design, develop, produce or use weapons of mass destruction or their delivery systems, or be used for terrorist purposes. “Not on the list” is therefore not a safe conclusion, and exporters must operate a red-flag identification mechanism and keep the resulting determinations.

Applies when

Every company supplying goods, technology or services abroad. Typical red flags for AI companies: the customer is a defence or nuclear-related institution; the stated end use does not match the product’s capability; unusual specifications or supercomputing-scale volumes are requested; end-user information is withheld; the delivery address differs from the registered address; or the purchase runs through layered intermediaries.

Evidence to retain

• · Red-flag checklist and the documented screening procedure
• · Per-transaction red-flag screening records and conclusions, including records where no flag was raised
• · Escalation approvals and licence applications where a flag was raised
• · Archived notifications from the national export control authority and the responses made
• · Catch-all training records for sales and commercial staff

Estimated first-time effort: 15–35 person-days (estimate, not a commitment)

The national export control authority maintains a control list of importers and end users that have breached end-user or end-use requirements, may endanger national security and interests, or have used controlled items for terrorist purposes, and may prohibit or restrict transactions in the relevant items or order exports suspended. Exporters must not transact with listed importers or end users in breach of the rules; where a transaction is genuinely necessary in exceptional circumstances, an application may be made to the authority. In addition, no organisation or individual may provide agency, freight, delivery, customs-clearance, third-party e-commerce platform or financial services in support of an export-control violation (Art. 20).

Applies when

All exporters, and the affiliates providing freight forwarding, customs clearance, payment, or e-commerce platform services to them — Art. 20 brings those service providers within the prohibition, so an outbound company’s cross-border payment and logistics partners also need screening.

Evidence to retain

• · Control-list screening policy and tooling documentation, naming the list sources and refresh frequency
• · Per-transaction screening records for counterparties and end users, with retained evidence
• · Handling and escalation records for hits, and archived applications and approvals for any exceptional transaction
• · Compliance undertakings and screening arrangements for service providers in freight, customs, payments and platforms

Estimated first-time effort: 10–25 person-days (estimate, not a commitment)

Art. 2 §3 expressly brings within export control the act by PRC citizens, legal persons and unincorporated organisations of providing controlled items to foreign organisations and individuals. On that basis, providing an item to a foreign person can be a controlled export even where the item never leaves China. Companies therefore need access-management controls covering foreign nationals and foreign entities across HR, R&D collaboration, investment due diligence, code repositories and model-weight access, applying for a licence where required. Art. 45 separately provides that transit, transhipment, through-transport, re-export and export from customs special supervision areas and bonded facilities are governed by this Law.

Applies when

AI companies with foreign-national researchers, offshore R&D centres, foreign shareholders or offshore investor due-diligence processes; and teams that host code repositories, model weights or internal technical documentation offshore or open them to offshore teams.

Evidence to retain

• · Inventory of controlled technical data with classification markings
• · Authorisation workflow, approval records and access logs for foreign nationals and foreign entities
• · Screenshots of geographic and personnel access controls on code repositories, model weights and technical documentation
• · Approval and redaction records for technical disclosures in investment and commercial due diligence
• · Export licence applications and approvals where required

Estimated first-time effort: 15–40 person-days (estimate, not a commitment)