There is a moment in every infrastructure audit when the thing you are measuring stops being the thing that matters. You have the hash, the parameters, the license file, the deployment manifest. You have what looks like the whole stack. And then you realize the stack was never the object. The object is the contract — and the contract follows the model into every environment it touches.
I spent two weeks this spring pulling apart the public artifacts around three regulatory regimes that have, within roughly eighteen months, stopped trying to govern model weights and started trying to govern the entire deployment surface. The first regime is procurement-based exclusion. The second is export control on technical know-how. The third is a private contract layer written by labs themselves. None of them are new in kind. All of them are new in reach. And the reach is the story.
The trigger for this piece was a document I could not fully verify. A Federal Register citation surfaced in a report I was cross-checking, numbered in a way that implied a publication date inconsistent with the report's own timeline. I marked it, moved on, and then went back to it three days later because the mechanism it described — procurement exclusion under the Federal Acquisition Supply Chain Security Act — is entirely real, and has been used. The Defense Department, NASA, and a cluster of state governments have already carved specific model families out of their acquisition pipelines. The mechanism does not require a ban. It requires only a rule that says: this class of software is presumptively excluded unless a waiver is granted. The waiver process is slow, undocumented in practice, and career-limiting to request. That is the point.
Procurement exclusion is the quietest form of technical regulation ever invented, because it never has to name a capability — only a vendor.
The historical context matters here, and it is usually skipped. For most of the last decade, the assumption inside policy circles was that AI governance would look like data governance: you classify the training corpus, you audit the outputs, you certify the model card. That assumption died for a simple reason. Model behavior is not stable across deployment contexts. A model that refuses a request in a chat window will comply when the same request arrives through a tool-calling interface with a system prompt that reframes the task. Every safety evaluation that treats the model as a fixed object is measuring a snapshot of a moving system. Regulators noticed. The sophisticated ones stopped asking what the model does and started asking who is allowed to host it.
That shift — from capability to custody — is the unifying thread across all three regimes, and it is the thing most coverage misses. The export control regime is the most visible and the least understood. In late 2025, China's ministries of commerce and science published a revised catalogue of technologies subject to export restriction, and the revision reportedly expanded the AI-relevant entries substantially. I cannot independently confirm the exact item counts circulating in secondary reporting, and I would caution anyone who cites them as settled fact. What I can confirm is the structural logic: the catalogue governs the transfer of technical knowledge, not the transfer of weights. Model files leak. Training methodology, toolchain configuration, and the tacit knowledge of how to reproduce a result at scale do not leak in the same way. The export control regime is not trying to stop the model from moving; it is trying to stop the ability to make the next one from moving.
This is a fundamentally different regulatory object than the one Western analysts typically model. When commentators describe export controls on AI as an attempt to prevent capability diffusion, they are describing the intent. The mechanism is narrower and more interesting: it targets the reproducibility chain. A released checkpoint is a finished artifact. A documented training pipeline is a capability. The catalogue, whatever its final item count, is aimed at the second thing.
And then there is the third regime, which almost no one is analyzing as regulation at all: the private license. I encountered this while examining what appeared to be a set of custom model licenses attached to specific vendor releases. Some of the terms I found referenced were unverifiable against my own knowledge — one in particular, attributed to a major platform company, did not match any public license text I could locate, and I am treating it as unconfirmed. But the pattern across the ones I could verify is consistent and, frankly, more aggressive than any government instrument on the table.
These licenses do not restrict what you do with outputs. They restrict what you do with the model as a component. Rolling twelve-month revenue thresholds trigger commercial terms. Downstream fine-tunes inherit restrictions. Deployment in a competing model's evaluation harness is prohibited. Redistribution of derivative weights requires approval. A private license can regulate behavior that no statute reaches, because it operates on the entity rather than the artifact — and it enforces itself through the ordinary machinery of contract law, which is faster than any regulator.
The three regimes are not coordinated. That is what makes them worth studying together. Procurement exclusion operates on the buyer. Export control operates on the transferor. Private license operates on the deployer. Between them, they cover the entire lifecycle of a model after it leaves the training run, and they do it without a single shared definition of what a model is.
Here is where the forensic work gets interesting, and where I want to push against the prevailing narrative. The consensus reading of this convergence is that it represents a coordinated hardening of the AI stack — a kind of regulatory perimeter closing around the technology. I think that reading is comfortable and wrong.
What is actually happening is that three actors with incompatible objectives have each independently discovered that the weights are the least governable part of the system. The procurement regime wants supply chain visibility. The export regime wants to preserve domestic capability advantage. The private license wants to capture commercial value from downstream deployment. These goals are not aligned. In several cases they directly conflict. A procurement exclusion implemented by one government can be neutralized by a license term that permits hosting in a jurisdiction the exclusion does not reach. An export control on methodology can be circumvented by a sufficiently well-documented open release. A private license can be voided by a jurisdiction that does not recognize its terms.
The perimeter is not closing. It is fragmenting into three overlapping and mutually inconsistent regimes, and the practical effect for anyone actually building on these systems is not clarity but a kind of jurisdictional arbitrage that rewards exactly the actors least concerned with compliance.
I keep returning to a conversation I had years ago with an early protocol researcher, back when the dominant belief was that code would settle these questions. His position was that code settles nothing — it only relocates the dispute to a different forum. He was right, and this is the clearest case of it I have seen. The weights were supposed to be the locus of control. Every one of these regimes has concluded, independently, that the weights are the wrong place to stand.
What replaces them is not a better technical mechanism. It is a set of contractual and administrative instruments that are slower, less legible, and far more effective at controlling deployment than any model-level intervention ever was. If you want to understand where AI governance is actually heading, stop reading model cards. Start reading procurement notices, technology export catalogues, and the fine print in custom licenses. That is where the stack is being governed now.
The uncomfortable implication, and the one I have not seen anyone state plainly, is that this fragmentation is stable. It does not resolve. It produces a permanent state of overlapping obligations where the correct compliance posture depends on which regime is asking, and the only actors who can afford to answer all three are the ones large enough to have a legal department dedicated to it. The regulatory perimeter is not a wall around the technology. It is a filter on who can afford to deploy it.
Which raises the question I cannot answer and do not think anyone can yet: if three regimes now reach past the weights to the whole stack, and none of them agree on what the stack contains — what exactly is being governed?