On 1 July 2026 two instruments take effect on the same day: The State Council Regulation on Outbound Investment (State Council Order No. 837) — China’s first administrative regulation on outbound investment. The high-risk system obligations of the EU AI Act — the core provisions of the world’s most stringent AI regulation.
One governs the step of going abroad; the other governs the ability to remain there. An AI company expanding overseas must now pass both.
From departmental rules to an administrative regulation: a step change in the cost of non-compliance
Chinese outbound investment has hitherto been governed principally by the rules of three departments — the National Development and Reform Commission, the Ministry of Commerce and the State Administration of Foreign Exchange. The consequences of breach were relatively contained. From 1 July the rules are elevated to an administrative regulation of the State Council: the same conduct now breaches an administrative regulation rather than a departmental rule.
The most immediate change is in the penalties:
- Investment in a prohibited category: a fine of 0.5‰ to 10‰ of the investment amount
- Investment without approval, or false declaration: a fine of 1‰ to 5‰, rising to 5‰ to 10‰ on failure to rectify
- Dual liability: a fine of RMB 20,000 to RMB 100,000 on the individual, with the person directly responsible also penalised
- Disqualification: no application for approval or filing accepted for three years, or a prohibition on outbound investment for one to three years
For a USD 100 million overseas project, investment without approval carries a fine in the region of USD 100,000 to USD 1 million. More significant than the fine is the three-year prohibition: its effect on the pace of a company’s expansion far exceeds the monetary penalty.
Four firsts: the changes that matter most to AI companies
1. “Indirect control” brought within scope — the VIE structure is no longer ambiguous
Article 2 of the new Regulation defines outbound investment as activity that obtains control of an overseas enterprise “directly or indirectly”.
VIE arrangements and red-chip structures therefore no longer sit in a regulatory grey zone. The model under which an AI company controls a domestic operating entity indirectly through an offshore holding company falls squarely within scope.
Practical effect: existing VIE structures must be reassessed for compliance — whether ODI formalities need to be completed retrospectively, and whether the structure requires adjustment. The feasibility of the red-chip route must also be reconsidered in designing new offshore structures.
2. Transfer of controlled technology by moving personnel prohibited — aimed at the core model of AI expansion
Article 13 of the new Regulation prohibits the transfer of controlled technology, services and related data by means of “cross-border secondment of technical personnel, cross-border provision of technical guidance, or arrangement of cross-border training”.
This is the provision that affects the AI industry most directly. The most common model of overseas expansion for an AI company is to establish a research centre or subsidiary abroad while the domestic team provides technical support — remote guidance, secondment and cross-border training are almost standard. Under the new Regulation, each of these routine practices must first be assessed to establish whether the technology is within the controlled category.
Practical effect: it is necessary to distinguish which technologies and data are controlled items within the export control catalogue, and which cross-border technical support activities require prior authorisation. The question is not whether to stop, but whether to comply before proceeding.
3. Resident individuals made statutory investors — pressure on founder offshore structures
Article 2 expressly extends the definition of investor to “resident individuals”.
In the AI sector it is common for a founder to establish an offshore holding structure personally and then inject the company into it. From 1 July such personal investment is expressly subject to the new Regulation. Although detailed rules for individual outbound investment are still to be issued, the prohibitive obligations — not to transfer technology in breach of the rules, and to cooperate with security review — take effect immediately for individuals.
Practical effect: founders should review the compliance status of their personal offshore assets — whether the route by which funds left China was lawful, whether Circular 37 registration and foreign exchange registration are complete, and whether offshore income has been declared and taxed as required.
4. Security review extended to exit — both entry and exit are now reviewed
Article 15 establishes a separate security review regime for overseas investment, covering “the transfer and disposal of overseas investments and related assets and interests”.
Security review was previously a factor within the approval and filing process; it is now a standalone regime. More importantly, it covers not only entry but exit: the transfer or disposal of overseas assets and interests may equally trigger review.
Practical effect: exit routes must be planned in advance. Investment agreements should contain provisions addressing review, so that an exit is not obstructed at the final stage.
The dual structure: domestic review and overseas compliance
The outbound investment Regulation governs the step of going abroad — structure, formalities, technology transfer and security review, all completed within China.
The EU AI Act governs the ability to remain — risk classification, compliance obligations and transparency requirements once the product enters the EU market, all performed abroad.
The jurisdictional logic of the two instruments is entirely different, but for an AI company their simultaneous commencement means that compliance is no longer a single-track exercise: it is a two-track undertaking requiring domestic review and overseas compliance at the same time.
| Dimension | Outbound investment Regulation (domestic) | EU AI Act (overseas) |
|---|---|---|
| Jurisdictional logic | Nationality — the outbound investment of a Chinese investor | Territoriality and effect — the provision of AI systems in the EU market |
| Core obligations | Approval and filing, security review, restrictions on controlled technology | Risk classification, compliance systems, transparency |
| Technology focus | Whether technology export is controlled | The risk level of the AI system and compliance fit |
| Data focus | Compliance of cross-border data flows | The GDPR and AI Act two-track data rules |
| Consequence of breach | Fine, three-year prohibition, dual liability | Up to EUR 35 million or 7% of global turnover |
A three-step framework for AI companies expanding overseas
The overlap of the two regimes is not a one-off event but the new normal of overseas compliance. The following framework is recommended.
Step one: review of structural compliance
Whether or not an overseas plan exists, the following should be examined as a priority where present:
- whether the offshore investment structure — VIE, red-chip or direct — has completed ODI approval and filing
- whether cross-border technical support or secondment involves controlled technology
- the compliance status of the founder’s personal offshore shareholding
- whether approval, filing and cross-border fund registration for existing overseas projects are complete
The object of this step is to establish the current position and identify exposure.
Step two: building the overseas compliance system
On the basis of structural compliance, a compliance plan should be built jurisdiction by jurisdiction for each destination:
- bring EU AI Act risk classification into the product development process, so that compliance is considered from the design stage
- establish a compliance assessment mechanism for cross-border data flows, joining the data export and outbound investment reviews
- assess whether an overseas exit route may trigger security review, and provide for it in the investment agreement in advance
The object of this step is to move from retrospective remediation to advance planning.
Step three: continuous compliance monitoring
The rules continue to develop and the product continues to iterate; the compliance framework must be updated accordingly:
- monitor the detailed rules on outbound investment, including those on individual outbound investment
- monitor the implementing guidance and enforcement practice under the EU AI Act
- update the compliance assessment whenever the product iterates or a new market is entered
The object of this step is to make compliance part of continuous operations rather than something remembered after an incident.
Geason’s view
The introduction of the outbound investment Regulation marks, in substance, a move from fragmented administration to systematic governance of Chinese outbound investment. For an AI company the question it raises is not whether expansion is possible, but how the compliance cost and route of expansion should be planned.
The commencement of the Regulation on the same day as the EU AI Act marks the entry of AI companies into a dual-review era: domestic review of the compliance of going abroad, and overseas review of the lawfulness of operating there. The two lines run in parallel, and difficulty on either may affect the whole.
AI companies with an overseas plan or an existing offshore presence are advised to begin a compliance review early: the sooner the position is established, the lower the subsequent compliance cost.