The Incentive Architecture Export Controls Cannot Reach

The U.S. debate over how to respond to China’s artificial intelligence (AI) capabilities contains a structural blind spot that neither side has engaged. The most commonly proposed response, tighter export controls, does not merely fail to disrupt the Chinese incentive system that drives AI capability acquisition. It strengthens that system, by deepening the resource dependence that motivates firms to align with the Chinese government’s priorities in the first place. The policy tool designed to constrain capability acquisition simultaneously reinforces the system that motivates it.

The mismatch is structural, not operational. The enforcement instruments proposed by Joe Khawam, who has outlined a phased sanctions escalation targeting Chinese AI distillation, and Ryan Fedasiuk, who has catalogued national security threats from China’s open-source AI expansion, are supply-side tools: Entity List designations under the Export Administration Regulations, sanctions under the International Emergency Economic Powers Act (IEEPA), and criminal prosecutions under the Export Control Reform Act (ECRA). They are designed to restrict what goes in. They cannot reach the demand-side incentive architecture that determines what comes out.

While Washington debated how to impose costs, Chinese municipalities were competing to distribute rewards: Beijing’s 2026 compute voucher program was in active enrollment, and Catherine Thorbecke observed that local governments were rolling out subsidies to attract AI developers. These mechanisms are not new. Market-access gates, differential subsidies, and exit frictions have been features of Chinese industrial policy since the early 2000s, from solar to electric vehicles to semiconductors.

What is new in the AI case is how these mechanisms interact with active U.S. technology denial, and what the resulting alignment governs: not product specifications, but the content standards, decision logic, and information architecture of AI systems deployed at scale. This article explains what that incentive architecture looks like, why U.S. enforcement tools cannot reach it, and how tighter controls make it stronger.

The Gate: Registration as Survival Condition

The most consequential piece of Chinese AI regulatory architecture that English-language export control analysis has largely ignored is the generative AI registration system, known as da moxing bei’an (大模型备案).

Under the 2023 Interim Measures for the Management of Generative AI Services (English translation), jointly issued by the Cyberspace Administration of China and six other ministries, any firm offering generative AI services to the Chinese public must complete a formal registration. This is not a voluntary standard. It is a regulatory prerequisite for market access. By the end of 2025, 748 generative AI services had completed formal registration (备案) with the Cyberspace Administration of China, and 435 generative AI applications or features that draw on registered models had completed a separate filing process (登记). Applications require a security self-assessment report exceeding 100 pages that covers training data provenance, content safety benchmarks, and emergency response protocols. Models that fail or skip registration face removal from app stores, fines, or operational suspension under the revised Cybersecurity Law (English translation) that took effect on Jan. 1, which for the first time incorporated AI governance provisions into China’s statutory legal framework.

Registration is not a tier of privilege. It is a survival condition. Unregistered models cannot legally operate in the Chinese market. This means every firm that participates in the compute voucher programs described below, every firm that competes for government procurement, every firm building applications on domestic AI infrastructure has already passed through the registration gate and demonstrated compliance with state content and security standards. The gate does not filter for alignment by offering bonuses to the compliant. It filters by eliminating everyone else. The firms inside the gate are the only firms that exist.

Market-access registration is not new to AI. Chinese authorities have imposed licensing, filing, and approval regimes across technology sectors for decades, from telecommunications services to pharmaceutical production. China has also regulated the content of films, television, games, and publications for just as long. What distinguishes the generative AI registration system is that its compliance requirements reach into production inputs, not just finished outputs. Films must clear review before screening; manuscripts must clear review before publication. The generative AI filing regime requires applicants to document training data provenance, pass content safety benchmarks covering 31 enumerated safety risks across five categories, and file emergency response protocols governing how the model behaves when it generates noncompliant output. The generative AI gate filters for alignment at a layer that other industry gates, including those regulating content, do not reach. 

This matters for the export control debate because it means the Chinese AI market is not an open field in which sanctions might deter individual bad actors. It is a market structured by entry conditions that filter for compliance with state content and security standards. Every firm that Khawam’s sanctions would target has already met those conditions. The sanctions debate treats these firms as independent actors who choose to violate rules. The registration system reveals them as participants in a regulatory structure whose entry requirements already embed alignment with state governance priorities.

The Field: How Subsidies Channel Behavior

Inside China’s registration gate, a second mechanism shapes firm behavior: differential subsidies that choose compute infrastructure as a financial decision with a predetermined answer.

The subsidy programs are extensive and growing. Shenzhen distributed its first batch of “training power vouchers”(训力券) in March 2025, totaling nearly 200 million yuan across approximately 40 firms, with individual awards up to 10 million yuan. The city committed 4.5 billion yuan in combined funding for digital economy and technology initiatives, with AI as a designated priority. Beijing’s Yizhuang economic development zone issues 100 million yuan in annual compute vouchers, reimbursing 30 percent of firms’ compute service costs at an individual cap of 20 million yuan. Hangzhou’s program allocates 250 million yuan per year. These are not isolated experiments. In January 2026, eight central government ministries led by the Ministry of Industry and Information Technology issued a joint guideline on “AI Plus Manufacturing,” which became one of the first national-level policy documents to reference “compute vouchers” as a policy instrument. The subsidy field is being institutionalized from municipal budgets to national policy architecture.

But the scale of spending is not the analytical point. The structure is. These programs do not distribute subsidies neutrally. They differentiate by chip origin. Beijing’s Yizhuang development zone reimburses 40 percent of computing costs when firms use domestic AI chips, but only 30 percent for nondomestic alternatives. Hangzhou’s 2024 AI industry support measures apply the same logic: 30 percent reimbursement for firms using domestic compute infrastructure, 20 percent for others. The differential is not enormous in any single transaction. But over a year of model training, a 10-percentage-point subsidy premium on domestic compute translates into millions of yuan. The price signal does what no directive needs to.

This is where the analysis must go beyond enumeration. The subsidy programs do not merely lower costs. They create a dependency structure. A firm that trains on subsidized domestic compute becomes operationally dependent on continued access to that infrastructure. Its model architectures, engineering workflows, and cost structures optimize around the subsidized platform. The switching costs are structural, not contractual: No clause prevents a firm from leaving, but reengineering an entire production pipeline does. This is the difference between a subsidy that lowers costs and a subsidy that creates dependency.

The Manus AI saga illustrates what it takes to attempt an exit from this structure, and why almost no firm succeeds. In 2025, Manus took two strategic steps that most Chinese AI firms never take: In mid-2025, it relocated its headquarters from Beijing to Singapore, and earlier that year, it secured investments from U.S. venture capital firms, including Benchmark, alongside its existing Chinese backers. These late-stage choices built on a design profile unusual for a Chinese-founded AI company from inception: Manus built on U.S.-developed foundation models such as Anthropic’s Claude, while serving a global subscription user base rather than depending on domestic procurement and state-enterprise clients. Together, these made Manus a rare Chinese AI company that had systematically minimized the dependencies that bind firms to the state ecosystem, some by design, others by later strategic choice. Its $2 billion acquisition by Meta, announced in December 2025, triggered exit bans on its co-founders and a Chinese government review of the transaction under technology export and outbound investment rules. On April 27, China’s foreign investment security review mechanism, an interagency body led by the National Development and Reform Commission and the Ministry of Commerce, ordered the parties to withdraw the deal, citing only “laws and regulations” in a single-line statement. Meta said the transaction “complied fully with applicable law.” Beijing rejected the exit even though Meta had committed to ending Manus’s Chinese operations and Manus had already relocated its headquarters to Singapore. The clearest available case of an attempted exit from China’s AI ecosystem ended in a state veto.

Exit bans themselves are not unique to the AI sector. Chinese authorities have used personal travel restrictions against executives of firms undergoing foreign acquisition, commercial disputes, or overseas litigation across industries for years, and most such cases never surface publicly. What makes the Manus case analytically significant is not the instrument but the trigger: The offshore transfer of AI capabilities by a firm whose profile and strategic trajectory together placed it further from the state ecosystem than almost any Chinese AI peer. The case demonstrates that the incentive architecture has a coercive backstop even for firms that reduce their economic pull, and that the backstop is operative, not merely latent.

The subsidy system is the carrot. The Manus case is the stick. Together, they create a complete incentive structure: Subsidies reward firms that stay and align, while the visible punishment of the one company that attempted to exit deters others. The overwhelming majority of Chinese AI companies have not severed their dependencies. Their models train on subsidized compute, revenue depends on government procurement and state-enterprise clients, and regulatory approvals can be withdrawn. These firms do not need to be ordered to align. They align because the alternative has been made both economically irrational and visibly dangerous.

The Loop: Why Export Controls Strengthen What They Target

This dependency structure is where the export control debate needs to look, and where the current analysis falls short.

Khawam’s analysis treats adversarial distillation as a behavior that sanctions can deter by raising costs. Fedasiuk’s proposals focus on regulatory tools to limit the diffusion of Chinese open-source models. Both analyses are correct about the tools available to the United States. Neither engages the incentive system on the other side.

Proactive Elite Alignment Theory (PEAT), an analytical framework developed in my research on Chinese state-business dynamics, identifies four structural variables that predict when firms in China’s technology sector preemptively align with state priorities. All four are active in the current AI subsidy landscape. Central strategic signaling is unambiguous: The State Council has designated AI as a national priority, eight central ministries have jointly issued AI development guidelines, and “computing-electricity coordination” appeared in the 2026 Government Work Report. When the central signal is this clear, local governments do not merely implement. They compete to over implement, each city layering additional incentives to attract AI firms before rival jurisdictions do.

The dynamic resembles China’s pandemic-era “dynamic zero” campaigns, in which central policy direction triggered cascading local escalation far beyond what Beijing initially mandated. Shenzhen’s 4.5-billion-yuan package is not a response to a central directive. It is a bid to outpace Hangzhou and Beijing in the subsidy race. The third variable, resource dependence, operates through the differential subsidy rates that lock firms into domestically produced compute. The fourth, organizational capacity, is visible in the speed with which Chinese AI firms restructure their engineering pipelines around subsidized infrastructure.

The critical insight is that export controls do not disrupt this system. They accelerate it. The mechanism is a feedback loop with four steps.

First, export controls restrict the supply of advanced foreign chips to Chinese firms. This is the intended effect.

Second, restricted foreign chip supply increases firms’ dependence on domestically produced compute, whose pricing is shaped by state subsidies and whose availability is channeled through government-backed programs. This deepens the resource dependence variable.

Third, deeper resource dependence strengthens the incentive for firms to align with state priorities. The subsidy system does not allocate compute by political loyalty. It does not need to. By making domestic computing cheaper through differential reimbursement rates, it ensures that the economically rational choice and the politically preferred choice point in the same direction. Firms do not align because they are ordered to. They align because the price structure makes alignment the path of least resistance.

Fourth, aligned firms use every available pathway to acquire the capabilities they need to meet the performance benchmarks that unlock further state resources. Distillation of American frontier models is one such pathway. It is not primarily an act of espionage or defiance. It is a rational response to an incentive structure that rewards capability acquisition from every available source.

The loop then closes: Distillation triggers calls for tighter export controls, which further restrict foreign chip supply, deepening resource dependence and subsequently strengthening the alignment incentive. The policy tool designed to constrain capability acquisition simultaneously strengthens the system that motivates it.

This loop is not perpetual. It holds only as long as domestic computing is sufficient to produce competitive models. If the performance gap between domestically produced chips and restricted foreign alternatives becomes unbridgeable, if Chinese firms cannot train models that meet market or state benchmarks on available domestic hardware, the incentive structure breaks down. Resource dependence without resource adequacy produces failure, not alignment. The question for policymakers is whether the current generation of export controls is producing that unbridgeable gap. Lennart Heim has acknowledged that China can still develop competitive individual AI models despite compute constraints, because frontier training consumes only a fraction of total compute capacity. The boundary condition has not been reached.

Whether distillation is driven primarily by the subsidy system’s incentive structure or by the simpler fact that frontier American models are freely accessible through open APIs is an unresolved question. The answer does not change the core analytical problem. Even if distillation is entirely opportunistic, the enforcement response to it still feeds the same loop. Controls restrict foreign chips, deepen dependence on state-subsidized domestic compute, and strengthen the alignment dynamic. The feedback loop operates regardless of what initially motivates the distillation.

This is not a gap in execution. It is a gap in jurisdiction. ECRA authorizes the government to control the export of specific items to specific end users. IEEPA authorizes the president to block transactions and freeze assets of designated entities. Both are transaction-specific instruments. Neither provides authority to reach a foreign government’s domestic subsidy regime, a municipal voucher program, or a regulatory gate that determines who can participate in the market. The enforcement toolkit is designed to raise the cost of specific prohibited acts. The system it confronts generates affirmative rewards for an entire class of behaviors that no U.S. statute prohibits or can prohibit.

What Follows

None of this implies that enforcement is futile or that distillation should be tolerated. Operation Gatekeeper, which disrupted a $160 million chip smuggling network in December 2025, demonstrated that physical enforcement can impose real costs on individual actors. Khawam’s analysis of the AI OVERWATCH Act shows that Congress is building new oversight mechanisms. Deterrence has second-order effects that go beyond the individual case: Every prosecution changes the risk calculus for potential violators who observe the consequences. These are necessary tools, and they work for what they are designed to do.

But what they are designed to do is deter specific illegal acts: smuggling chips, operating fraudulent API accounts, violating Entity List restrictions. The subsidy system described above does not target these acts. Its structural effect is to lower the cost of capability acquisition across all pathways, legal and otherwise. Even if deterrence successfully eliminates distillation as a pathway, firms still face the same economic incentive to acquire capabilities through legal channels: self-developed models, open-source architectures, licensed technology transfers, and domestic compute scaling. The structural demand for capability does not disappear when one supply channel is closed. It redirects. Enforcement can shut down pathways. It cannot shut down the incentive gradient that generates demand for them.

The Chinese AI governance system is not a passive recipient of U.S. pressure. It is an active incentive architecture whose effects are amplified by the very constraints export controls impose. When foreign chip supply tightens, the relative attractiveness of subsidized domestic compute increases automatically: The differential between subsidized domestic options and scarce, unsubsidized foreign alternatives widens without any policy adjustment on the Chinese side. The subsidy system does not need to respond to tighter controls. Its structural design ensures that tighter controls make its existing incentives more powerful.

The current U.S. policy debate has not absorbed this point. One camp argues for tighter controls and stronger enforcement. Another, exemplified by the Trump administration’s decision to allow Nvidia H200 sales to China in exchange for a 25 percent revenue cut, treats export controls as a pricing mechanism rather than a security tool. Lennart Heim has argued that the United States should focus less on preventing model parity and more on leveraging its tenfold compute capacity advantage for economic transformation. Each of these positions engages the supply side. None engages the demand-side incentive architecture that shapes Chinese firm behavior. Tighter controls feed the feedback loop by deepening resource dependence. Relaxed controls provide better hardware while leaving the subsidy architecture intact. And a strategy built on compute advantage, while analytically sound on its own terms, does not address the structural dynamic through which China converts constrained compute into aligned capability.

The distinction between compliance and alignment matters for policy design. Compliance is reactive: Firms follow rules to avoid penalties. Alignment is proactive: Firms anticipate state priorities to capture rewards. Export controls and sanctions are compliance tools. The Chinese system generates alignment. A compliance tool cannot reach an alignment system, because the behaviors it seeks to change are not violations of any rule. They are rational responses to a structure of incentives.

Recognizing this mismatch is not a counsel of retreat. The supply-side toolkit has achieved real effects: It has raised Chinese costs, slowed specific capability transfers, and preserved parts of the American and allied lead. The Department of Justice’s $2.5 billion chip smuggling prosecution announced in March, and the recent industry coalition among OpenAI, Anthropic, and Google to counter adversarial distillation, add capacity to that toolkit. The argument is not to abandon these tools. It is that a strategy resting on supply-side instruments alone is hitting the limits of what these instruments can deliver, and that further progress likely requires engaging dimensions the toolkit has not yet touched. As Kyle Chan testified before the House Select Committee on the Chinese Communist Party on April 16:

U.S.-led export controls on AI chips and chipmaking equipment have stimulated China’s own semiconductor development efforts, prompting Chinese policymakers and industry participants to pivot to an accelerated, whole-of-nation effort to build a nearly complete domestic semiconductor supply chain aimed at being resistant to U.S.-led export controls.

The feedback loop analyzed above predicts precisely the pattern Chan describes: export controls stimulating whole-of-nation self-sufficiency efforts. That architecture operates through four structural variables: central strategic signaling, lateral municipal competition, resource dependence, and organizational capacity. The first two are domestic Chinese phenomena beyond American reach. The third is the variable current controls most affect, but in the direction opposite to intent. The fourth, organizational capacity, is where the United States retains its strongest leverage, because it depends on talent pipelines and capability-acquisition pathways that remain partially within the American orbit.

This reframes where analytical effort should turn. Three directions follow from the analysis. First, talent: As of 2022, China produces approximately 47 percent of the world’s top-tier AI researchers by undergraduate origin, nearly half of the global pool. The fourth structural variable, organizational capacity, is directly shaped by whether this talent pipeline flows toward or away from the American ecosystem. Immigration, retention, and academic-exchange policies designed to attract and keep frontier AI researchers in the United States and allied jurisdictions constrain that variable in a way no additional chip restriction can. Second, deployment: If capability acquisition cannot be fully prevented, the question is how the capabilities so acquired integrate into markets, supply chains, and critical infrastructure that the United States and its allies control.

Model provenance and alignment disclosure requirements, review by the Committee on Foreign Investment in the United States of Chinese AI firms’ commercial partnerships and not only equity transactions, and conditional market access tied to the content and security standards that AI products carry are conceivable instruments. Third, strategic posture: U.S. policy can accelerate the pace at which frontier capabilities are developed and deployed within allied ecosystems, compressing the window in which Chinese firms can translate absorbed capabilities into global deployment.

These are not complete policies. They are the directions a strategy that takes both supply and demand seriously would need to develop. The supply-side toolkit will remain necessary. It is no longer sufficient on its own.

The question is not whether to impose costs. It is whether any supply-side instrument, however well designed, can alter the demand-side architecture that makes capability acquisition the rational choice for every firm inside China’s AI ecosystem. On current evidence, it cannot.