⚠️ Editorial note: The open source ecosystem in China operates under a distinct institutional framework — characterized by state-led initiatives, intranet-like boundaries, and top-down governance. Readers should be aware that this context differs from the community-driven open source model common in other regions. The term “open source” as used in Chinese media may refer to practices that diverge from the conventional definition.

China Open Source Daily — 2026-10-26

⚖️ Legal & Licensing — Article 13: What the Supreme People’s Court Just Wrote About Open-Source Liability, and Why the Conditions Are the Story

1. The instrument, and its standing. On 2026-09-07, the Supreme People’s Court (最高人民法院) issued 法发〔2026〕10号, the Opinions on the Lawful Adjudication of Disputes Involving Artificial Intelligence (《最高人民法院关于依法审理涉人工智能纠纷案件的意见》). The text was released at a press conference the same day and published through the court’s own channels; this briefing read it in full in the Chinese original. It comprises 24 articles in five parts: (i) guiding principles; (ii) AI tort liability; (iii) AI intellectual property disputes; (iv) procedural and evidentiary rules and criminal liability; (v) working mechanisms. Multiple commentaries describe it as the first judicial rule-making document on AI issued by a national supreme judicial body — a category distinct from a statute (which the NPC enacts) and from an administrative measure (which a ministry issues). It is not a law. It is the interpretive frame within which every lower court in the country will now hear AI disputes, and in a civil-law system that is close to dispositive.

2. The clause that matters here, in the original. Article 13 is headed “依法合理认定涉人工智能开源软件相关方的法律责任” — the lawful and reasonable determination of liability for parties involved in AI-related open-source software. It has two limbs.

Limb one — the factors. Adjudicating an open-source software case, and determining the infringement liability of open-source software developers, providers, and subsequent developers and providers (开源软件开发者、提供者以及后续开发者、提供者), the court shall comprehensively consider: the type of open-source licence agreement (开源许可协议类型); the specific content of the rights restrictions (权利限制的具体内容); security and compliance measures (安全合规举措); and the degree of information disclosure (信息披露程度) — and on that basis lawfully grant open-source software developers and providers appropriate liability exemption (依法给予…适当的责任豁免).

Limb two — the safe harbour, stated as a rule. Where an open-source software developer or provider supplies, on a free and open-source basis, some of the code modules required for AI software development (以免费开源的方式提供涉人工智能软件研发所需要的部分代码模块), and publicly explains their functionality and security risks (并公开说明其功能和安全风险), and another person’s use of those code modules causes infringement, the court may find that the open-source software developer or provider bears no infringement liability (人民法院可以认定…不承担侵权责任).

3. The three companion findings a reader needs to place this. (a) The Opinions are not open-source-specific. The same document establishes fault-based liability as the default regime, with strict liability and presumed fault confined to narrowly defined scenarios, and directs courts to distinguish general-purpose from specialised models, and open-source from closed-source systems, on the explicit reasoning that each presents a different risk profile — that distinction appears in Article 2’s security-baseline principle, before any of the operative articles. (b) On generative AI service providers, the Opinions adopt a notice-and-takedown safe harbour by analogy (Article 7): providers that take timely and necessary measures after a rights-holder’s notification — including stopping generation of infringing content and blocking related prompts — are not liable. The “red flag” rule, which would have imposed proactive monitoring obligations, was discussed during drafting and deliberately excluded from the final text. (c) On the two largest questions in AI copyright, the Opinions are deliberately silent: whether AI-generated content is eligible for copyright protection, and whether training on copyrighted works constitutes infringement. Both are left open. Article 12’s burden-shifting device is the operative fact instead — an AI developer raising a non-infringement defence shall be ordered to produce training-data sources, training-process records, model operating patterns, and scientific-theoretical grounds to substantiate it.

Institutional Analysis & Commentary:

Read Article 13 against what a licence actually does, and it becomes clear that the Supreme People’s Court has just supplied the half of the open-source bargain that licences have never contained.

A licence allocates permission. It has never allocated liability. Apache 2.0 and the GPL both contain broad disclaimers of warranty, and every lawyer who has ever read one knows what they are worth in practice: a disclaimer is a contract term between the licensor and the licensee, and it does not bind a third party who was never in privity and who sues in tort. That is the structural gap. The MIT grant says: take this, use it, no conditions. It does not say: and if your downstream user is harmed, the person who wrote the code is not your defendant. For twenty-five years the working answer has been a combination of practical obscurity, corporate risk tolerance, and the assumption that suing a volunteer maintainer is not worth anyone’s time. Article 13 replaces the assumption with a rule — and in a civil-law jurisdiction, a rule from the court of last resort is worth more than an assumption.

Note the structure of the exemption, because it is not a blanket immunity and the conditions are doing specific work. Limb two requires four things: free and open-source provision (免费开源); of code modules required for AI software development rather than a finished product; with public explanation of functionality and security risks; and the infringement arising from another’s use. Limb one adds four factors: licence type, the content of the rights restrictions, security and compliance measures, and disclosure. This is a fault-based safe harbour conditioned on transparency, and it maps, with unusual precision, onto the logic of the licences themselves. A developer who publishes under a permissive licence has imposed few rights restrictions — the factor cuts in their favour. A developer who publishes under a copyleft licence has imposed many — and the court is instructed to read those restrictions as evidence of the governance the developer attempted, which is what a reciprocal licence actually is. And the disclosure condition converts the disclaimer from boilerplate into a duty: a security notice nobody reads is not a notice; a documented risk disclosure is.

Which is the real institutional change, and it is a change in the direction the incentives run. Before Article 13, the rational move for a Chinese firm worried about downstream liability was to not publish, or to publish without documentation. Every risk-management instinct pointed toward opacity: say less, disclaim more, keep the code behind an API. Article 13 reverses the arrow. It makes documentation the instrument of protection — the developer who writes down what the module does and what it can break is the developer who gets the exemption, and the developer who publishes silently gets the factors weighed without that credit. That is a liability rule deliberately engineered to reward the behaviour a commons needs and to punish the behaviour that free-riding produces. In Calabresi’s terms this is not deterrence pricing; it is rule-shaping through the allocation of a defence, and it is the cheapest possible way to buy transparency.

The second-order effects are where this gets interesting, and two of them cut against the policy’s own intent. First: the exemption is written for code modules — 部分代码模块 — which is the vocabulary of a component supplier, not of a platform. Nothing in Article 13’s limb two obviously covers a lab that publishes a full set of model weights. Whether a 2.8-trillion-parameter checkpoint is a “code module” is not a question this document answers, and the answer matters enormously, because the labs that tightened their licences all year — Kimi K3’s revenue-triggered clause, GLM-5.3’s discretionary security review, Qwen3.8’s custom licence — have been tightening precisely at the point where the publication of weights creates downstream exposure that a component supplier does not face. If Article 13’s safe harbour reaches only modules and not weights, then the tightening documented in this series over the past fortnight is not a choice the labs made freely; it is what a firm does when the liability default for the expensive form of publication has not been settled. The licence complexity may be a symptom, and Article 13 may not cure it.

Second: “free of charge” (免费) is a condition. That single word does an enormous amount of exclusion work. A firm that publishes an open-weight model and monetises the API is not publishing “free of charge” in the sense Article 13 uses, even if the weights cost the downloader nothing — and the entire 2026 Chinese open-weight business model is exactly that configuration. The condition is defensible on its face: the exemption protects the gift, and a company earning revenue from the artefact is not making an unconditional gift. But its practical effect is to draw the safe harbour around individual maintainers, academics and foundations, and to leave the commercially-motivated publishers — who are the ones actually releasing frontier weights — outside it. That is coherent as a matter of tort principle and awkward as a matter of industrial policy, and someone will have to decide which register the rule is in.

The comparison with the mainstream reading deserves to be made honestly, because it is not flattering to everywhere else. Every jurisdiction with significant open-source exposure has the same underlying problem and has largely refused to legislate on it. The European Union’s Cyber Resilience Act — the most serious attempt anywhere to impose duties across a software supply chain — spent years negotiating how it would treat open-source stewards, and settled on layered categories with open questions at the edges. The United States has produced no general rule at all. Here, a supreme court issued a rule-making document, published all 24 articles, held a press conference, and wrote an explicit exemption for free open-source publication with named conditions attached. A rule with conditions you can read, argue about, and plan around is a better institutional state than an unanswered question — even where the conditions are narrower than one might prefer. The court also chose the two ways one would most want it to choose: it declined the proactive-monitoring rule that would have made every service provider a copyright police force, and it declined to resolve the two genuinely hard questions rather than resolving them badly.

The honest counterweight. A “may find not liable” (可以认定…不承担侵权责任) formula is discretionary at the margin; only the case law will tell anyone how the four factors weight against one another, and the first five decisions will effectively be the rule. The disclosure requirement is also, unavoidably, a duty to predict your own failure modes — which favours established publishers with legal teams and disfavours exactly the one-person maintainers this series has spent the week counting. A rule whose protection is conditioned on documentation quality protects the documented. That is the price of the rule, and it is worth saying that the price is real.

The checkable question. Three observables, all public. First: does any court apply Article 13 to a model weight release? The clause says code modules. A published judgment that extends it to weights settles the question the labs need settled; a stream of cases that do not reach it leaves the ambiguity intact. Second: what does the first reported application of the four factors look like — does licence type dominate, or does disclosure? The entire practical value of the rule turns on that weighting, and no amount of drafting tells anyone in advance. Third, and the one that ties this series’ month together: does any of the six Chinese labs that tightened its licence in 2026 cite legal uncertainty as the reason, now or in a later filing? If one does, then the licence turn was partly a liability turn, and Article 13 is two years late rather than a week. If none does, the tightening was what it looked like: an attempt to stop a reseller. The difference is not rhetorical. It is the difference between a regulatory problem that a rule can fix and a commercial strategy that a rule cannot.

Sources:

🏛️ Policy & Regulation — 国产化率 as a Reference Item: What a Xinchuang Practitioner Says Has Changed, and Why the KPI Was the Problem

1. The document. On 2026-10-21, the WeChat outlet 行业观察 published “叫停盲目换系统后，信创难道就此熄火了？” — After the halt on blind system replacement, is Xinchuang finished? The piece reached this briefing through the manual WeChat input channel that supplies this series, and it is a follow-up to an earlier article by the same author that had drawn several hundred reader messages, most asking the same question: is Xinchuang being abandoned, has the wind changed? The article’s answer, stated in its fourth paragraph, is the load-bearing claim:

叫停的是形式主义、是为了凑指标而硬上的替换，不是叫停信创本身。

(What has been halted is formalism — replacement forced through to make up the quota numbers. Xinchuang itself has not been halted.)

2. The failure mode, described from the inside, and it is specific. The author’s account of the first phase is an operations narrative, not a political one, and this is what makes it usable. Tasking came down; units calculated how many machines to swap; procurement, bulk installation, 台账 (the register) showing the domestic-localisation rate maxed out, the report looking immaculate. What came second was the part nobody scored: whether the finance system still ran, whether industrial software would open, whether frontline staff spent the day on lockups and error reports and chasing the operations team.

The author’s illustrations are the kind that circulate because they are recognisable: units whose Xinchuang machines sat on the desks for acceptance while staff kept Windows hosts privately to do the actual work — equipment replaced, business logic untouched, a set of display pieces bought with real money.

硬件替换是最简单的一步，也是最容易做成面子工程的一步。

(Hardware replacement is the easiest step, and the easiest to turn into a face-project.)

3. Why the second half is harder, in the author’s own causal chain. The budget went overwhelmingly into visible hardware — whole machines, servers — because that chain is short, the results fast, and the reporting convenient. But “机器只是个壳子” — the machine is only a shell. What determines usability is the layer above: thousands of industry-specific applications, industrial-control programs, and old business systems. Terminal replacement is now broadly saturated, and the market has moved from “selling computers” to “doing adaptation, fixing the ecosystem” — the hard work.

The specific hardness is technical and the author states it with the right level of detail: there are several chip routes — 龙芯 (Loongson), 飞腾 (Phytium), 海光 (Hygon), 鲲鹏 (Kunpeng), 兆芯 (Zhaoxin) — with different instruction sets, which means a single industry application must be maintained in several versions, and every version change forces re-testing across all architectures. Many niche professional applications are made by small vendors with neither budget nor staff for adaptation, and the outcome is: system installed, core tool will not open, employee stuck.

不是国产操作系统不行，是整个生态链条太长，之前硬件跑得太快，软件、适配、运维、迁移全部掉队了。

(It is not that domestic operating systems are no good. The ecosystem chain is too long: hardware ran too fast, and software, adaptation, operations and migration all fell behind.)

4. The two structural shifts the author names. The first is budgetary: money stops stacking into hardware first and shifts to filling in the software ecosystem and doing sector-targeted adaptation. The blanket slogan “全行业替代” gives way to accounting by scenario — office OA, official documents, ordinary reporting are low-risk and well-adapted and can land early; financial trading, power industrial control, hospital HIS, factory DCS are systems where one move affects everything and are absolutely not to be cut over on impulse.

The second is the recognition of dual-track as normal for a long period: two systems running simultaneously, the mature legacy stack continuing to carry core business while the Xinchuang environment runs parallel verification, stress testing and data comparison; only after the verification cycle completes — no data loss, no downtime, no production impact — does traffic move over gradually. “不是不换，是慢换、稳换、分批换” — not “don’t replace” but “replace slowly, replace steadily, replace in batches”, using pilots to find the errors rather than betting an entire business line on an acceptance signature.

5. The mechanism the author identifies as the root cause — and this is the institutional claim. The piece’s own diagnosis of why the first phase produced display pieces is not vendor malice and not policy error. It is the assessment criterion:

过去很多项目，考核清单第一条就是国产化比例。数字达标，项目就算成功。至于使用率、故障工单数量、业务迁移成功率、一线员工的真实反馈，权重很低。这种考核方式，天然催生了"重替换、轻使用"。

(In many past projects the first item on the acceptance checklist was the domestic-localisation ratio. Hit the number and the project was a success. Usage rate, fault-ticket volume, business-migration success rate, and frontline staff’s real feedback carried very low weight. This assessment method naturally produced “heavy on replacement, light on use”.)

The author’s account of who this served: “厂商拼着抢硬件订单，甲方盯着报表数字，所有人都在围着指标转，唯独没人对业务连续性负责” — vendors scrambling for hardware orders, the client staring at the spreadsheet figures, everyone revolving around the indicator, and nobody accountable for business continuity.

And then the change, stated flatly: “现在风向改了，考核标尺换了。国产化率只是参考项，不再是硬门槛” — the wind has changed, the measuring rod has been swapped; the localisation rate is now a reference item, no longer a hard threshold. The replacement hard standard is: can it carry the business stably; can faults be cleared fast; will migrated data be intact; will daily efficiency visibly decline. And: “红利期结束，混子、套壳厂商的好日子到头了” — the dividend period is over; the good days for the sloppy and the shell-wrapping vendors are finished.

6. Two statements in the piece that prevent it from being read as a retreat, and they belong in the record. The author is explicit that the gap is real and large — high-end industrial software and professional tools are extremely hard and extremely expensive to adapt, expecting total replacement in the near term is unrealistic; and that “信创的底层目标，是构建安全可控的备选底座，不是追求不计代价、不计成本的一刀切替换” (the underlying goal is to build a secure, controllable alternative base — not cost-no-object, one-size-fits-all replacement). The closing formulation: the first half was speed, installed volume and localisation rate; the second half is stability, adaptation and the capacity to carry business. “不是信创减速，是它终于从一场运动式替换，回归它本来该有的定位。快，是好看的政绩；稳，才是自主可控真正的目的。” — not a deceleration, but a return from campaign-style replacement to its proper position: fast is a good-looking achievement; stable is the real purpose of autonomy.

Institutional Analysis & Commentary:

This piece is worth real attention for one reason that has nothing to do with whether it is right: it identifies the incentive structure as the causal mechanism, which is the analysis the policy literature never performs on itself.

Start with what an indicator is, in institutional terms. A performance metric is not a measurement. It is a contract with an uninformed principal. The principal — here, the supervising body — cannot observe the quality of what it is buying, so it specifies a proxy it can observe and prices against that proxy. Campbell’s law is the standard statement of what happens next: any quantitative social indicator used for decision-making is subject to corruption, because effort flows to the measure and away from the thing measured. The Xinchuang first phase is a textbook specimen, and the author writes the mechanism out in the same terms an economist would: maximising 国产化率 is cheap; achieving business continuity is expensive; the criterion rewarded the cheap thing; therefore the cheap thing was delivered. The display pieces were not a moral failure at the point of delivery. They were the unique equilibrium of the contract.

Which is why the interesting change here is not the budget shift or the dual-track policy — both of those are downstream — but the substitution of the criterion. “国产化率 is now a reference item, no longer a hard threshold” is a sentence about what the principal will and will not pay for, and it changes the game in a way that no amount of exhortation about quality could. Once acceptance turns on fault-clearing time, migration integrity and measured efficiency, the vendor who can only supply boxes has nothing to sell — and the article says so with an unflattering directness that the genre rarely permits: 混子、套壳厂商 (the sloppy operators and the shell-wrappers) are finished. This is a textbook move from an input contract to an output contract, and the theory of why it works is not subtle. When you cannot verify quality, you buy the closest verifiable substitute for it. When you can verify the outcome, you stop buying inputs.

Then note what this reveals about the thing this series has been documenting all year, and it is the uncomfortable part. The entire apparatus examined over the past month — openness grading on an L1–L5 scale, enterprise governance-maturity tiers, transparency levels, agent-community membership registers, contribution rankings tied to a national standardisation institute’s governance standard — is a set of input metrics for open source. Each measures something an organisation can produce on demand: a grade, a membership, a ranking, a filing. Each is therefore open to the same corruption the Xinchuang localisation rate suffered, and for the same structural reason: the measuring body cannot observe the thing it actually cares about, which is whether the code works and whether anyone outside the graded organisation depends on it.

The author of the WeChat piece, writing about desktop replacement rather than about open source, has inadvertently stated the strongest available critique of that apparatus. The failure mode is not that the metrics are wrong. It is that the metrics are the only thing being bought. A unit that installed the machines and left the Windows hosts running is exactly parallel to an organisation that secured the grade and never merged an outside patch — and in both cases the diagnosis is the same: the criterion selected for the observable and the observable was decoupled from the objective.

The counterweight, because this piece is not a neutral document and should not be read as one. It is an industry observer writing for practitioners, largely sympathetic to the enterprise, and it does not name specific units or vendors; the author states this explicitly and disclaims any reference to particular parties. Its claims about the change in assessment criteria are asserted, not sourced to a document — no administrative notice, no procurement rule, no evaluation guideline is cited. This matters. A practitioner’s report that the measuring rod has changed is evidence that practitioners believe it has changed, and belief is itself economically consequential — vendors who believe the localisation rate no longer sells will stop building for it. But it is not evidence that any rule has been amended, and the two should not be conflated. The honest reading is that the article documents a change in the shared expectation of what gets accepted, which may precede, accompany, or entirely substitute for a change in the written rule.

Which opens the real question, and it is a question about discretionary criteria generally. If the hard threshold is genuinely gone and the new test is “can it carry the business”, then who decides whether it can? Fault-clearing time, migration integrity and efficiency decline are not self-reporting quantities. They are judgment calls made by an evaluator, and the shift from a published ratio to an evaluator’s judgment is not obviously a shift toward objectivity — it is a shift from a crude number that anyone can check to a soft standard that only the evaluator can apply. In Williamson’s terms, this is a move from low-powered to high-powered incentives, which raises the productivity of the competent vendor and simultaneously raises the discretion rent available to the evaluator. The localisation rate was gameable. “Business continuity” is gameable in a different and less visible way. Neither is a neutral instrument, and the argument for the second is not that it is incorruptible — it is that the corruption costs more to arrange and shows up later, in the form of systems that fail.

The checkable question. Three observables, and the third is the one nobody will publish. First: does an official document appear — a procurement guideline, an evaluation standard, an acceptance rule — that replaces 国产化率 with a named outcome measure? If the change is real, it will be written down somewhere with a number in it; the standard pattern in this system is that a change in practice is retrospective, and a change in rule is prospective and citable. If nothing appears within two quarters, the article documented a mood. Second: what happens to the vendor population? The article predicts that shell-wrappers exit and engineering capability becomes the competitive axis. A sector that consolidates toward fewer, deeper-engineering vendors is the prediction confirmed; a sector that renames the same vendors’ solutions and continues is the prediction falsified, and it is a claim that can be tested against procurement awards, which are public. Third, and decisive for this series: does anyone apply the same substitution to open source? The insight that an input metric rewards input and therefore produces display pieces applies with full force to openness gradings and governance-maturity tiers. Whether the ecosystem learns that lesson from the desktop-replacement episode — or repeats it one layer up, in software it never wrote — is the thing to watch, and it is not a rhetorical question. It has an answer, and it will be visible in what the grading bodies measure next year.

Sources:

🏗️ Institutional Change — Fifteen Billion Dollars and a Filing Date: What DeepSeek’s Round Says About Who Is Allowed to Publish

1. The round. On 2026-10-22, The Wall Street Journal reported that DeepSeek had raised USD 15 billion in its second private financing round, nearly doubling its initial target “thanks to strong investor interest”, and that the company is accelerating its IPO timeline, aiming for a Shanghai listing early next year. The WSJ framing adds a competitive detail: DeepSeek could go public ahead of OpenAI and Moonshot AI.

2. The round’s composition and the numbers behind it, from the Chinese-language reporting that preceded it. On 2026-10-14, Seoul Economic Daily (citing Caijing) reported the round at RMB 100 billion — about 20 trillion won — four months after a RMB 50 billion first round in June, targeting a valuation of RMB 500 billion. The original target was RMB 50 billion; it doubled within two weeks as demand accumulated. Joining existing backers Tencent and CATL were new investors across industries: chip designer GigaDevice, foundry operator SMIC, and Geely Automobile. On 2026-10-07, Sing Tao reported the round at RMB 800 billion-plus to nearly RMB 1,000 billion, with CATL and Tencent leading, and noted that after the round closes the company will undergo restructuring in preparation for the IPO.

3. The profitability numbers, which are the actual reason the round is oversubscribed, and are unusual enough to record. Annualised revenue climbed past USD 1 billion from USD 500 million within a few months, per The Information. Demand held even after the company raised API prices in August to two to four times previous levels. And before that increase, gross margin on the API business reached 82.9 percent in January–July 2026, with overall gross margin at 44.6 percent. Caijing’s characterisation: the company “built an entry barrier with a low-price strategy and is now converting its technological edge into profitability through price increases.”

4. The pre-IPO engineering, documented and dated. On 2026-09-21, DeepSeek hired Yan Wentao, a former partner at Hillhouse Ventures, as chief financial officer — filling a post that had been vacant for three years. The listing venue is the STAR Market (科创板), the Shanghai Stock Exchange’s technology board, with CITIC Securities retained and a filing expected as early as end-2026 and listing in 2027. The proceeds are earmarked in part for a large data centre under construction in the Inner Mongolia Autonomous Region, where the company plans to deploy more than 160,000 of Huawei’s Ascend chips.

Institutional Analysis & Commentary:

Put the capital and the governance side by side and the interesting fact is not the size of the round. It is the sequence: the money arrived, and then the company acquired a chief financial officer after three years without one.

A CFO vacancy of three years is a governance fact, not an HR fact. A firm with USD 1 billion of annualised revenue, 82.9 percent API gross margin and a contested frontier position had no chief financial officer from 2023 to September 2026. Under any conventional account of the firm this is either recklessness or — the more likely reading — a deliberate refusal to build the reporting apparatus that an outside capital provider requires. A CFO is the executive who exists to translate an organisation’s activity into the standardised, comparable, auditable form that markets price. Not having one is a statement about whom the firm was accountable to, and the answer was: nobody outside itself. That is what a private, founder-controlled, self-funded research lab looks like. It is also, in the institutional literature, the exact configuration that cannot be scaled through arms-length capital — because the investor’s problem is not the quality of the model, it is the verifiability of the claim.

Which is why the capital and the reporting apparatus arrived together, and why the order of events in this fortnight is the analysis. The RMB 100 billion round required investors — SMIC, GigaDevice, Geely, CATL, Tencent — whose own governance makes them unable to write a large cheque against unaudited narrative. A CFO installed on 2026-09-21, a round closed on 2026-10-14, a STAR Market filing targeted for end-2026: that is not three decisions, it is one decision executed in the only order available. The firm bought the capacity to be legible, and then sold the legibility. North’s account of institutional change — that organisations invest in the rules and enforcement mechanisms that reduce the uncertainty of exchange — is usually applied to states. It applies with unusual literalness to a company hiring its first CFO.

Now the part that connects this to everything else this month, and it is not the valuation. This series has spent a fortnight documenting a registration regime: Announcement No. 48’s pre-export registration triggers, the 2026-10-22 report that DeepSeek and MiniMax had completed registration and open sourcing, and the reading that the permission step has moved from the licence to the release form. Set the STAR Market filing beside that, and the two are not adjacent instruments. They are two filings about the same thing.

A STAR Market prospectus requires, among other things, disclosure of the firm’s material assets, its material risks, its licences and permits, and the regulatory status of its principal business lines. For a Chinese AI lab in 2027, that means the prospectus must say something about the legal status of open-weight releases — whether the company’s published models were filed, under what provision, and what regulatory risk attaches to publishing more. The registration record already exists inside the firm, was submitted to a ministry, and is the exact evidence a sponsor needs to write the risk section. The export-control registration and the IPO prospectus are, in an important sense, the same disclosure asked twice by two different principals — and the firm has now been given a powerful reason to answer the first one carefully and completely, because the second one will be read against it.

This is the mechanism by which an administrative regime becomes self-enforcing, and it deserves to be stated precisely because it is usually described as a burden. A firm planning a public listing cannot afford an unresolved regulatory ambiguity in its business model. It therefore has an incentive to convert ambiguity into a documented precedent — to be the first filer, to be the firm whose registration was accepted, to have the acceptance on the record. DeepSeek and MiniMax walked the registration path within six days of the regime taking effect. On this reading, the speed was not compliance anxiety. It was capital-markets positioning, and the two are indistinguishable from the outside. The state built a census; the listing calendar turned the census into something firms compete to complete first.

The counterweight, and it is substantial. A company that raises at a RMB 500 billion valuation and files for a STAR Market listing is a company whose releases become material events. Material events require disclosure, disclosure requires timing discipline, timing discipline requires legal review — and the net effect of going public may well be fewer, later, more carefully lawyered open-weight releases, not more. The Kimi K3.1 Pro pattern — service first, weights on a stated date nine days later, licence unstated until the date arrives — is precisely what a pre-IPO firm’s release cadence looks like. Public capital makes a commons possible; it does not make it spontaneous. Every mechanism that makes a firm credible to investors makes it slower and more cautious in what it gives away, and the two effects cannot be separated.

And a specifiable irony worth recording without editorialising. The most consequential open-weight publisher in the world by download volume is becoming a listed company whose prospectus will describe the risks of publishing. Whatever that section ends up saying — whether it treats open weights as a core competence or as a contingent exposure — will be the most informative document about the future of Chinese open source that anyone publishes this decade, and it will be filed not by a foundation, not by a standards institute, and not by a committee of academicians, but by a securities lawyer.

The checkable question. Three, all readable in a filing. First: does the STAR Market prospectus describe open-weight publication as a business model or as a risk? The genre is designed for risk; the question is whether the weights appear in the business chapter as capability or in the risk chapter as exposure, and which one the firm’s revenue depends on. Second: does the prospectus disclose the pre-export registration, and with what description of its outcome? A prospectus that names the filing and its acceptance creates the public record this series has been waiting for; one that omits it makes the filing an unobservable administrative fact, which is the condition the regime’s critics expect. Third: what does the fourteen-month gap between today’s round and a listing do to the release cadence? If DeepSeek’s next frontier release lands within the pre-filing window, the rate of publication and the pace of compliance are complementary. If releases thin out from the moment the sponsor is engaged, then the constraint on Chinese open weights was never the licence, and the calendar that governs them is a listing timetable, which is a far harder thing to liberalise than a catalogue.

Sources:

🔍 Commentary — Three Instruments, One Question: What Counts as a Defensible Act

A court writes an exemption for people who publish code for free, on the condition that they explain what it does and what it can break.

An industry practitioner reports that the acceptance criterion for domestic systems has been swapped — the localisation ratio demoted to a reference item, and the test now being whether the thing carries the business, clears its own faults, keeps its data and does not slow anyone down.

A company raises fifteen billion dollars, hires the chief financial officer it went three years without, and files to list on a market that will make it describe, in public, what publishing its models does to its risk profile.

None of the three mentions the other two, and all three are asking the same question. Not who is allowed to publish — that question was answered, in this ecosystem’s case, by a catalogue and a registration desk, and the answer was: you are, if you file. The question underneath it is older and harder: what makes an act of publication defensible? Defensible to a court, in the first document. Defensible to an auditor, in the second. Defensible to an investor, in the third. Three different tribunals, three different standards of evidence, one underlying problem — the publisher has to be able to say, afterwards, that they did what a reasonable publisher does.

And the striking thing is that all three instruments locate defensibility in documentation rather than in outcome. Article 13 grants the exemption to the developer who publicly explains functionality and security risks, and withholds the credit from the one who publishes silently. The Xinchuang piece’s whole diagnosis is that the old criterion measured an input — machines installed — and so produced display pieces, and that the fix is a criterion closer to the outcome. The prospectus is a document whose entire function is to make a firm’s claims verifiable by strangers. Legal liability, procurement acceptance and public capital all converged, in the same quarter, on the same demand: produce the record. In a system where the dominant public register is achievement, that convergence is worth noticing, because it is the one form of accountability that does not depend on anyone being willing to say a project failed.

But there is a real tension between the first two, and it should be named rather than smoothed over. Article 13 is an input standard: it asks what the publisher did — free of charge, disclosed, documented — and exempts accordingly. The Xinchuang reversal is a move away from input standards, on the explicit ground that input standards are cheap to satisfy and therefore get satisfied cheaply. The court, in effect, has just installed at the level of tort liability exactly the kind of criterion the procurement practitioner says produced display pieces. That is not a contradiction in either document — tort law and procurement have different objects, and a liability exemption is designed to encourage an act rather than to verify its quality. It is, however, a warning about what Article 13 will and will not accomplish. It will make publishing safer. It will not make published code better, and a safe harbour conditioned on disclosure is a standard that a diligent publisher of a broken module satisfies as easily as a diligent publisher of a sound one.

The third document is where the tension resolves, and it resolves in an unexpected direction. A firm that publishes documentation to earn a liability exemption, and then has to describe that same publication in a prospectus, is a firm that has been handed a reason to make the two accounts match — and a reason to keep publishing things it can describe honestly. The filing regime that this series spent a fortnight reading as an administrative cost turns out to have a second, quieter function in a listing context: it accumulates the evidence that makes a public account defensible. Whether that is a feature or an accident, it is the mechanism by which a discretionary regime becomes self-documenting, and self-documenting regimes are the only kind that can be audited by anyone who was not in the room.

The counterweight, stated plainly because the week has been generous. Two of these three documents are, at bottom, about protecting institutions from the consequences of publishing — a court limiting who can be sued, and a sponsor limiting what can be misrepresented. Neither makes the commons any larger. The third, the procurement reframe, is the only one that is about making something work, and it is being applied to desktops, not to code. Meanwhile the count this series published yesterday stands: eleven of twenty-three core projects held by one or two people, xz with no confirmed funding since 2024. Nothing in Article 13 pays a maintainer. A liability exemption is a benefit that accrues to whoever is being sued, and the people at the base of the stack are largely not being sued, and are not being paid either. The most defensible act in this ecosystem has just become easier. That is good. It is not the same as making it survivable.

The checkable question, one, and it is the one all three documents are really about. Does the documentation that these instruments now demand get produced, and by whom? Article 13 asks for a public statement of functionality and risk; the Xinchuang criterion asks for fault-clearing and migration records; the prospectus asks for a disclosure of regulatory status. All three are records. Records impose a fixed cost, and fixed costs are the thing that separates a firm with a legal department from a maintainer with a README. If the surviving Chinese open-source ecosystem of 2027 consists of organisations that can produce records and individuals who cannot, then these three instruments — each defensible, each reasonable, each written by someone trying to reduce risk — will have collectively selected for the organisations. That outcome would not be anyone’s intention. It would be the aggregate of three sensible rules, which is how most institutional outcomes actually happen.

Sources: