China AI export controls: act this quarter

What China AI export controls mean right now

China has proposed new export controls affecting artificial intelligence, life sciences and photovoltaic technologies, as reported by legal commentators at Hogan Lovells Cadwalader. A separate note from CMS.law describes broader export restrictions under consideration across these domains.

These are proposals, not final rules, and the details are not confirmed. That uncertainty is precisely why this matters now. If your organisation develops, procures or integrates AI systems, or operates in supply chains that include life sciences or photovoltaic components, the operational risk is immediate: a release, shipment or data transfer you planned for next month could need screening or approval instead. Waiting for perfect clarity will cost you time you don’t have.

Why it matters for boards and CTOs

Export controls don’t just block a transaction; they change how you design, deploy and govern technology. If you rely on Chinese-origin models, tooling or components, you may find that export from China is restricted under the proposals cited by Hogan Lovells Cadwalader and CMS.law. Even if you don’t export from China, your vendors might, and that dependency becomes a delivery risk.

Value: the business case for AI initiatives must now factor jurisdiction and route-to-market. A model fine-tuned in China and packaged for overseas customers could face new hurdles. The safe value path is to design for flexibility in where models are trained, hosted and served, so you can keep delivering regardless of regulatory shifts.

Risk: governance teams must track not only usage risk but provenance risk. If any component falls within life sciences technology controls or photovoltaic technology controls as described by the sources above, product roadmaps and contracts may need rework. Treat this as a portfolio risk that touches data, models, hardware and services.

Cost: compliance is cheaper than disruption. Building screening steps into processes and maintaining alternate suppliers will feel like overhead, but it is less costly than an unexpected stop on a critical release or shipment. Budget a modest uplift for assessment, legal review and rerouting.

Decisions: this is an architectural question as much as a legal one. The choice between shipping a model artefact and serving it from a controlled location is now a core design decision that influences time-to-market, margin and obligation.

The question of who should own these decisions is covered in Do You Need a CTO Yet?.

Map and minimise: products, models and data

Start by mapping your portfolio to the categories referenced by the sources: AI, life sciences and photovoltaic. Maintain an explicit bill of materials across models, datasets, weights, accelerators and third-party services. For each item, record origin, hosting location, and intended destinations. Your aim is simple: know, with evidence, what might be caught by the proposals described by Hogan Lovells Cadwalader and CMS.law.

Where you can, prefer serving to shipping. AI model export in the form of weights or packaged artefacts can create friction if export rules bite; serving models via APIs from permitted locations avoids moving sensitive artefacts across borders. You’ll still need to manage access controls and logs, but you decouple customer delivery from cross-border movement of model files.

Data flows matter as much as binaries. Track cross-border data transfer explicitly: which telemetry, prompts, outputs or training deltas leave or enter China? If a proposal becomes a rule, having this mapped allows you to isolate or reroute specific flows quickly, rather than freezing entire services. Think in terms of per-feature and per-tenant controls so you can apply granular mitigations.

On the product side, consider SKU separation. If a component could fall under life sciences technology controls or photovoltaic technology controls, create region-specific SKUs with clear provenance and deployment options. You’re not committing to change yet; you’re giving yourself room to manoeuvre without rewriting the product under time pressure.

Build controls into delivery: pipelines and contracts

Embed screening where work happens. Add export-relevance checks to CI/CD, model registries and data pipelines so you can flag and gate releases that include sensitive origins or destinations. This is export compliance as an engineering practice, not an afterthought. Automate evidence capture: provenance metadata, approvals and deployment locations should be machine-readable and auditable.

On-demand CTO advice is often enough when decisions like this are occasional but significant.

On operating models, define two pathways now: ship and serve. For ship, maintain a checklist that includes destination screening, customer classification and contract clauses acknowledging possible licensing. For serve, ensure regionally isolated hosting, clear customer routing and strong monitoring. Switching customers from ship to serve should be a configuration change, not a platform rebuild.

Supply chain deserves the same discipline. Ask vendors to declare whether any part of what you buy could be impacted by the proposals referenced by Hogan Lovells Cadwalader and CMS.law, and build contingencies for alternates or regional variants.

On governance, agree an internal decision tree now: when do we seek advice, pause a release, or pursue licensing? I would prepare for possible MOFCOM processes and timelines, even though the sources do not set them out; treat this as readiness, not a prediction. Make one person accountable for maintaining the register of in-scope items and for triggering escalations.

Finally, be transparent with customers. Where there is uncertainty, set expectations early and offer service options. Customers will forgive reconfiguration; they won’t forgive silence followed by outage. Align sales, legal and delivery so the story is consistent and factual.

What to do this quarter

– Establish a single, living inventory of potentially impacted items across AI, life sciences and photovoltaic domains. Include models, datasets, artefacts, components and suppliers, with origins and destinations recorded.

– For each in-scope product, define a ship versus serve posture and the switch criteria. Where feasible, move customers to serving from permitted regions to reduce movement of artefacts.

– Build an export screening gate into CI/CD and data pipelines. Block releases that identify in-scope combinations until reviewed. Capture approvals and artefact provenance automatically.

– Engage legal counsel with experience in China to monitor these proposals from Hogan Lovells Cadwalader and CMS.law. Assume change; plan scenarios. If licensing becomes required, you’ll want your dossier ready.

– Ask your strategic suppliers how these proposals could impact them. Build at least one regional contingency per critical dependency. Bake change-of-law clauses into new contracts.

– Communicate up and out: brief the board on risk, cost and mitigation; brief customers on options. Export controls are a trust topic as much as a technical one.