The chart above illustrates the trend of legal ties under Order 837
across different entities. It also indicates the corresponding
technology isolation and IP verification measures each should
implement.On July 1, 2026, State Council Order 837, the Outbound Investment Regulations, officially took effect. This is China’s first administrative regulation specifically governing outbound investment, consisting of 34 articles. Previously, outbound investment oversight was scattered across departmental rules issued by NDRC (National Development and Reform Commission) and MOFCOM (Ministry of Commerce). Order 837 consolidates and elevates these rules while introducing three critical new changes. First, it extends jurisdiction to individual residents. Second, it equates cross-border personnel services with technology exports. Third, it establishes an outbound investment security review regime.
What triggered this regulation was the forced reversal of a completed acquisition. Manus is an AI agent company founded by a Chinese team. In June 2025, Manus relocated its place of incorporation to Singapore. In December of the same year, Meta acquired Manus for approximately $2 billion. On April 27, 2026, NDRC issued a prohibition order directing Meta to unwind the transaction. NDRC pierced through Manus’s Singaporean shareholding structure. It traced the Chinese origins of the technology, talent, and intellectual property. The conclusion: as long as the core technology was developed in China, China asserts jurisdiction. Where a company is incorporated does not grant immunity. Order 837, published in the aftermath of the Manus case, institutionalizes this logic.
The regulation does not specifically target AI. But the globalization path of Chinese AI companies happens to rely heavily on the very mechanisms it is designed to scrutinize. Two extreme reactions have emerged within the industry. Some believe China’s AI sector is about to close itself off. Others think that simply changing the place of incorporation puts them beyond reach. Neither view is correct. The actual impact depends on one core variable: how deep your legal ties to China run. Chinese companies incorporated domestically, companies founded in China but now based overseas, and Chinese citizens employed abroad — these three categories face entirely different legal constraints. The following analysis examines each group in turn: what each should worry about, what they needn’t worry about, and what they should do now.
For AI companies incorporated domestically, the new regulation raises the threshold for going global. The friction costs for conventional paths to international expansion and liquidity exits have risen substantially. This category includes startups preparing to go public overseas through VIE (Variable Interest Entity) structures, as well as teams that have accepted USD venture capital or are considering acquisition by foreign buyers.
A domestic company pursuing cross-border restructuring now faces five overlapping layers of review. These are not newly invented; they represent the consolidation of powers previously dispersed across various agencies.
The first layer is foreign investment security review. Under the 2021 rules, any foreign acquisition of control over core technologies requires upfront filing. The second layer is technology export licensing. Transferring large model weights and core algorithms abroad requires a license from MOFCOM. The third layer is data outbound security assessment. Sending training datasets and user behavior data overseas must pass CAC (Cyberspace Administration of China) review. The fourth layer is outbound investment security review. Under Article 15 of the new regulation, post-investment overseas transfers and asset disposals are now subject to oversight. The fifth layer is personnel movement compliance review. Article 13 of the new regulation explicitly equates personnel movement and cross-border services with technology exports.
The most direct impact is that the cost of conventional exit paths has risen sharply. Previously, the industry’s default playbook was remarkably smooth: do R&D in China, relocate incorporation to Singapore, raise USD funding, and ultimately sell to an American buyer. On April 27, 2026, NDRC formally blocked that very acquisition. The deal was valued at $2 billion. This case became the first acquisition in the AI sector to be forcibly unwound. It also demonstrates that exit transactions involving a transfer of core control carry enormous risk. Without upfront regulatory approval, the transaction simply cannot close.
Why did this case cause such a shockwave? Manus had relocated its place of incorporation to Singapore in June 2025. Yet in the eyes of regulators, its technology and talent remained deeply rooted in China. Meta’s 100% acquisition would have resulted in the complete loss of core control. NDRC at the time relied on the 2021 Measures for the Security Review of Foreign Investment. This shows that the security of core technology assets has long been a focus of scrutiny. The new regulation now further institutionalizes this review logic.
Furthermore, domestic companies easily overlook the restrictions Article 13 imposes on everyday R&D collaboration. The regulation prohibits transferring technology through cross-border personnel dispatch, technical guidance, or other such means. Regulators now look at whether substantive technology capability transfer has occurred. If a domestic team provides remote model tuning to an overseas subsidiary via video conference, or if overseas branch employees come to China for training on technical frameworks — these routine collaborations may, from a compliance standpoint, constitute unauthorized technology exports.
Although compliance frictions have increased significantly, domestic companies need not panic. Two facts provide a firm boundary of certainty.
First, conventional paths to overseas listing and fundraising remain open. The VIE structure has not been categorically invalidated by law. CSRC (China Securities Regulatory Commission)’s filing-based regime for overseas issuance by domestic companies continues to function normally. In 2026, MiniMax and Zhipu successfully listed on the Hong Kong Stock Exchange. This demonstrates that compliant overseas fundraising and public market exit channels remain accessible. Routine minority equity investments, so long as they do not involve a transfer of control, are not substantially affected.
Second, the security review implementing rules under Article 15 have yet to be issued, and purely domestic operations are unaffected. The Article 15 outbound investment security review currently lacks detailed rules and is rarely invoked in practice. Purely domestic operations — training on domestic servers, serving domestic users — need only undergo algorithm filing. The new regulation imposes no additional administrative burden on businesses that operate entirely within China.
In the face of these constraints, domestic companies can take three proactive measures.
First, conduct a dedicated audit of global collaboration channels. Review the frequency and content of technical support provided by domestic R&D teams to overseas affiliates. Any guidance involving core model parameters or agent workflows should be self-audited. Where potential red lines are identified, proactive compliance assessment must be conducted immediately.
Second, implement physical separation of technology pipelines. At the system design level, decouple domestic R&D from overseas development. Fundamental large model R&D stays in China; application-layer development goes overseas. Ensure that technology used by overseas entities is independently developed and does not rely on real-time domestic support. Avoid cross-contamination at the source that could bring the entire overseas entity under domestic jurisdiction.
Third, incorporate compliance clauses into cross-border transactions. If a company is planning an overseas restructuring or accepting USD venture capital, one thing must be explicitly stated in the contract: obtaining Chinese regulatory approval shall be a condition precedent to closing. Contracts should reasonably allow for a 6-to-12-month approval window. This prevents the risk of severe financial liquidation should the transaction be abruptly halted.
This category is commonly referred to in the industry as “overseas-founded companies.” Their typical profile: founded by Chinese entrepreneurs, with core technology originating domestically, but having relocated their place of incorporation to Singapore or the United States mid-journey for overseas fundraising purposes.
The foremost concern for these overseas-founded companies is the regulator’s piercing enforcement principle. It asserts substance over form. The piercing traceback process in the Manus case taught the entire industry a lesson. It proved that relocating a company to Singapore to evade regulation is a dead end. The expectation that changing incorporation alone confers safety — that loophole has been firmly closed.
Even if the company is incorporated in Singapore and the executive team has moved overseas, as long as the core technology, talent, and early-stage accumulation originated in China, China asserts jurisdiction. In the Meta acquisition case, NDRC applied this piercing approach. Regulators pierced directly through the Singapore entity’s shareholding structure and traced back to the Chinese source entity of the underlying intellectual property, ultimately issuing a prohibition order. This means that overseas-founded companies may still face regulatory review in major future transactions. These include acquisitions by foreign tech giants, asset transfers, and technology licensing. Even when both parties to the transaction are overseas entities, they cannot fully insulate themselves from review. As foreign media have reported, the model of washing one’s background by relocating incorporation has ceased to work.
For overseas investors, this is also a clear signal. A Morgan Lewis case analysis articulates this same point. When evaluating projects with Chinese origins, the traditional approach of looking only at the place of incorporation is no longer valid. Investors must now trace where the technology was developed and how the intellectual property was transferred.
At the same time, overseas-founded companies face another underappreciated complication: the data wall of Article 22. Article 22 provides that when a domestic Chinese entity participates in litigation related to outbound investment, or when it is subject to investigation by overseas regulatory or law enforcement agencies, the provision of evidence is restricted. Providing evidentiary materials to overseas parties must comply with data security and other laws and follow prescribed procedures. For overseas-founded companies whose R&D teams remain in China, this creates a two-way dilemma.
Suppose an overseas-founded AI company faces a patent infringement lawsuit abroad, or is under investigation by the US SEC (Securities and Exchange Commission) or foreign CFIUS (Committee on Foreign Investment in the United States). Under overseas discovery rules, the company must produce R&D logs and source code. Yet if the company directly hands over materials from its domestic affiliated entity, it risks violating Article 22. If it refuses to produce them, it faces the direct risk of losing the overseas litigation. This effectively erects a mandatory data isolation wall between domestic operations and overseas headquarters. The flow of data and information between the two sides has been legally severed. Navigating the conflict between these two legal regimes is the thorniest challenge for overseas-founded companies.
Although the illusion of absolute immunity has been shattered, routine operations and non-sensitive M&A remain within the safe zone.
First, normal overseas sales, model API calls, and other global go-to-market activities do not trigger review. The industry generally views API calls as conventional cross-border digital services. Overseas users are merely consumers, and this does not constitute a substantive transfer of technology capability.
Second, non-sensitive transactions that do not involve a change of control remain unimpeded. The key reason regulators blocked the Manus case was Meta’s 100% acquisition, which would have caused the control of an advanced agent platform to be thoroughly lost to an American tech giant. If an overseas-founded company chooses a buyer from Europe, the Middle East, Southeast Asia, or other regions, or if the transaction does not involve a change of control, the probability of obtaining regulatory approval remains very high. Bloomberg’s report also notes that the regulatory objective is security, not normal commerce.
For companies that have already relocated or are in the process of relocating, the following two actions are recommended.
First, establish a technology IP provenance registry. Overseas-founded companies need to conduct a compliance audit on every line of core algorithm and every model parameter. If certain technology was indeed transferred from a domestic entity, evidence must be preserved to show that complete technology export and filing procedures were completed at the time of transfer. Ensure that the legal severance is thorough, to guard against the risk of retrospective enforcement.
Second, build compliance channels between the domestic affiliated entity and the global headquarters. Overseas-founded companies must redesign workflows for cross-border data transmission, internal auditing, and the like. Should overseas litigation arise, domestic R&D logs must not be exported without authorization. Companies must establish rigorous internal pre-review to ensure that every step is lawful and compliant.
Chinese citizens in the overseas AI sector find themselves in a somewhat awkward gray zone. This includes engineers doing research at giants like Meta, Google, as well as founders who have started AI companies overseas, and academics and students at foreign universities. A Jamestown analysis notes that the regulatory provisions applicable to this group are marked by extensive ambiguity.
To dispel compliance anxiety, one must grasp a core legal boundary: an employment relationship is categorically not an investment activity. This is an essential premise for understanding the regulation’s impact on individuals.
The regulation governs outbound investment activities undertaken by Chinese investors. When a researcher joins Google or a Singapore-based company, what they sign is an employment contract. In this relationship, the individual provides intellectual labor and receives a salary. There is no cross-border capital outflow, nor is there any acquisition of actual control over an overseas entity. Employee stock options and similar benefits do not constitute a direct investment proactively initiated by the individual. Therefore, the filing, approval, and penalty provisions of the new regulation do not directly apply to employment. So long as you are simply writing code and training models, you will not cross any red lines.
Of course, the inapplicability of the new regulation does not mean individuals face no legal boundaries whatsoever. Specialist law firms note that the red lines of technology export control exist independently of the investment domain. Even without an equity transaction, privately transferring domestically restricted technology is unlawful. Existing laws such as the Export Control Law continue to have full jurisdiction. But these restrictions existed long before Order 837 was issued; they are not new risks created by the regulation.
Another question of greatest concern to overseas individuals: does the knowledge one possesses count as a technology export? The answer depends on whether your technology falls within China’s catalog of restricted export technologies.
At present, the directly relevant items in the catalog mainly include Chinese-language speech recognition and synthesis technology, data-analysis-based push service technology, and parallel processing technology. If you work overseas on general open-source model architecture design, write prompts, or reproduce algorithms based on publicly available academic papers, these all fall within the domain of public-domain technology. The normal flow of public-domain technology does not constitute an unlawful technology export.
The truly high-risk scenario is taking away a former employer’s unpublished proprietary technology assets. For example, if, when leaving a domestic company for an overseas position, you take with you proprietary data, or a former employer’s undisclosed model fine-tuning know-how, evaluation sets, or acceleration frameworks. Such conduct seriously violates trade secret law and simultaneously runs a very high risk of crossing regulatory red lines. It would be deemed a transfer of restricted technology by “other means” and trigger joint sanctions.
For Chinese citizens who start their own companies overseas and hold equity, they fall squarely into the investor category and face the gray conditions of Article 33.
Article 33 states that the specific administrative measures for outbound investment by domestic individuals shall be formulated by relevant departments. This is a legal pronouncement of piercing jurisdiction over individual entrepreneurship. The official English version of Order 837 on the Chinese Government website also provides an official translation of this provision. The uncertainty lies in the fact that, as of July 12, 2026, the regulation has been in force for 12 days. Yet these specific administrative measures for individual outbound investment remain entirely nonexistent. The relevant authorities have not issued any implementing rules, resulting in a gray vacuum. The law says it governs, but the administrative agencies have yet to establish any filing or registration channels. At this stage, it is simply impossible for an overseas individual starting a company to complete compliance registration. Moreover, the regulation provides no transitional exemption clause for this situation.
Given the absence of implementing rules and the fact that the regulation has been in effect for only 12 days, overseas individuals need not panic excessively. Each should adopt differentiated preventive measures based on their specific circumstances.
In sum, Order 837 has reshaped the landscape of the AI industry since taking effect. The legal constraints faced by different entities, and the actions they should take, vary accordingly.
The following table summarizes the three categories:
| Applicable Group | Strength of Legal Ties | Current Concrete Compliance Obligations | Primary Sources of Compliance Risk |
|---|---|---|---|
| Domestically Incorporated Chinese Companies | Strongest ties | Filing and approval, technology export licensing, data security assessment | Restructuring or acquisition deals blocked; routine R&D triggering unauthorized technology export. |
| Companies Founded in China, Now Overseas | Moderate ties | No current corporate filing channel; Article 15 security review rules pending | Incorporation does not immunize against jurisdiction; exits face retrospective review; facing the Article 22 data isolation wall. |
| Chinese Citizens Abroad | Weaker ties | Employees: no current obligations; equity-holding founders: implementing rules not yet issued | Founders face future retroactive filing; taking former employer’s proprietary technology triggers existing laws. |
It should be particularly noted that only 12 days have passed since Order 837 took effect. Due to the extensive absence of implementing rules, there have been no actual enforcement cases to date. This means that current compliance judgments rest primarily on rational inferences drawn from the statutory text, combined with the regulatory posture NDRC demonstrated in the Manus case and white paper interpretations from specialist cross-border law firms — not on tested administrative practice. In the next 6 to 12 months, the issuance of supplementary implementing rules will be critical. In particular, the timing and stringency of the detailed measures under Article 33 and Article 15 will directly determine how many of the red lines identified through reasoning will become routine regulation. During this window period, maintaining a prudent compliance-defensive posture is necessary. Conducting a self-audit of one’s technology asset provenance remains the soundest strategy for all founders.
The chart above illustrates the trend of legal ties under Order 837
across different entities. It also indicates the corresponding
technology isolation and IP verification measures each should
implement.