---
id: "lib-2026-10-25-china-s-draft-export-thresholds-for-agents"
type: "library"
title: "China's draft export thresholds for agents"
title_original: "Сколько «агентских сил» под капотом?"
lang: "RU"
org: "abuzovboris (Habr)"
source_type: "Practitioner post"
date: "2026-10-25"
week: "2026-W44"
url: "https://nosov.ai/library/lib-2026-10-25-china-s-draft-export-thresholds-for-agents/"
original_url: "https://habr.com/ru/articles/1099142/"
tier: "B"
tier_name: "Useful, limited"
tier_reason: "Commentary by an AI security and governance consultant that accurately relays the thresholds in China's draft export-control catalogue and adds a useful buyer checklist; secondary reading of a primary document, with no new data."
summary_basis: "full-text"
original_minutes: "9"
tags: ["ai technology", "export controls", "china", "agent benchmarks"]
frames: ["verification-capacity"]
---

# China's draft export thresholds for agents

Original title: Сколько «агентских сил» под капотом?

Tier B (Useful, limited): Commentary by an AI security and governance consultant that accurately relays the thresholds in China's draft export-control catalogue and adds a useful buyer checklist; secondary reading of a primary document, with no new data.

Summary based on the full text.

## In short

A Habr post (25 October 2026) by Boris Abuzov, an AI systems security and governance consultant, on Announcement No. 48 of China's Ministry of Commerce and Ministry of Science and Technology (16 October), a draft revision of the catalogue of technologies prohibited or restricted for export. The draft defines restricted AI agents by scale plus quality thresholds. The author uses it to ask what "a more capable agent" means in practice: on which tasks, how repeatable, at what budget, and who verified the result.

## Key numbers

- 20 / 60 / 200: draft thresholds for agents: executable subtasks, concurrently cooperating agents, integrated third-party tools
- at least 90%: minimum average subtask success and tool-selection accuracy attached to those thresholds (80% for decomposition accuracy)
- 10²⁶ FLOP: training compute that would restrict a large model's core technology (or 2 trillion parameters, or global top-10)
- 15 November: deadline for comments on the draft catalogue; temporary export registration applies from 16 October

## What it reports

- Planning and decomposition: at least 20 executable subtasks, decomposition accuracy at least 80%, average subtask success at least 90%.
- Multi-agent work: at least 60 concurrently cooperating agents; total time no more than twice the minimum single-run time for the same effect; final output matching the reference answer at least 85%.
- Tool use: at least 200 integrated third-party tools, selection accuracy at least 90%, end-to-end success at least 90% in scenarios combining at least three tool types. A fourth category covers decision-making in game scenarios.
- High-performance agents designed mainly for critical infrastructure, defence or key state systems would move to the prohibited list.
- Large models are restricted if any of: at least 10²⁶ FLOP, at least 2 trillion parameters, or a global top-10 position at export time in public rankings. The EU AI Act Article 51 uses 10²⁵ FLOP as one presumption of systemic risk.
- Scope: technology transfer only. Open-source or published work is excluded; MOFCOM says ordinary API, web or SaaS access is not export of model technology.
- Buyer questions the author proposes: what was tested and where; repeatability (one success in eight runs versus eight in a row); which system build (model, memory, tools, retries, sub-agents); budget in time, tokens and attempts; how much a human helped; who confirmed the result; what the agent may do and what happens if it errs.

## How they got it

Reading of the draft announcement, with references to Cloud Security Alliance and ChinaTalk analyses, METR's task-completion time horizon, UK AI Security Institute work on test-time compute, and two of the author's own lab cases (an agent barred from CRM writes still changing the CRM through a downstream component; three individually valid ALLOW decisions of 40 summing to 120 against a limit of 100).

## Limits

- Secondary commentary; the thresholds should be checked against the announcement text itself.
- The draft does not say on which task sets the percentages are measured or how reference answers are set; the author raises this but cannot answer it.
- The 85% versus 92% agent comparison is a hypothetical example, not a measurement.
- The author's lab cases are deterministic test benches, not production incidents, as he notes.

## Why it matters for companies

Firms selling or licensing agent technology out of China, or partnering with Chinese developers, may need export registration already, and the scope rests on transfer of technology rather than service access. For any buyer, the checklist is the practical part: a vendor claim of "more capable" means little without the task set, repeatability, run budget, human assistance and verification method. Capability and risk also differ: an agent with five irreversible actions may need tighter control than one with 200 harmless tools.

## Key passages in translation

> не менее 20 исполнимых подзадач, точность декомпозиции не ниже 80%, средняя успешность подзадач не ниже 90%

At least 20 executable subtasks, decomposition accuracy not below 80%, average subtask success not below 90%.

> Агент с пятью необратимыми операциями может требовать более жёсткого контроля, чем система с двумястами безобидными инструментами.

An agent with five irreversible operations may need tighter control than a system with two hundred harmless tools.

> мощнее в какой работе, насколько стабильно, при каком бюджете и кто это проверял?

More capable at what work, how consistently, on what budget, and who checked it?

Original: https://habr.com/ru/articles/1099142/