Crossposted from my Substack, sofiayab.substack.com. A bit about me: I studied law in Chinese at Fudan University and did an MSc in China in Comparative Perspective at LSE. I am Head of Legal at an AI company, and an incoming Winter Fellow at GovAI (2027). Views in the article are my own.
This is the first issue of my monthly series on China’s AI safety regulation. Each following month I will analyse China’s new rules, AI registries published regularly, the Supreme Court’s policy documents, and I will also study their implementation. My monitor will focus on whether these regulations move us towards a higher or lower probability of “AI going well”.
This monitor is for AI governance researchers who would like to understand Chinese AI regulation more deeply, as well as for anyone interested in Chinese AI regulation.
The findings in brief
I analysed all 31 published filing lists since 2023. On the lists, I found the first models of DeepSeek, Moonshot AI, Zhipu, MiniMax and StepFun in 2023–2024, as well as occasional later filings for new products, but there are no separate filings of their later general-purpose models. This limits the public’s ability to see how the state reviews new, more capable models. Nevertheless, this does not mean that Chinese regulators did not review the newer frontier models before they were released on the market. Section 1 goes deeper into the evidence and the limits of the findings.
What we see is that the new AI Safety Governance Framework 3.0 is inspired by Framework 2.0, but also improves it: Framework 3.0 adds misaligned behaviours seen in real-life cases (e.g. it mentions models that hide their real capabilities or break sandboxes to reach external systems) to the list of hypothetical scenarios that were mentioned in Framework 2.0. Nevertheless, the new Framework 3.0 does not present any specific mechanisms that providers would follow to comply with it, such as quantifiable metrics, fixed-cadence reporting duties etc. The framework is non-binding, while its status can change towards “bind-ish” in practice. We cannot predict whether that will happen, so it is important to observe.
The Qinglang enforcement campaign carried out in 2026 was mainly focused on content control. The highest numbers of cases are related to content-filtering and labelling AI-generated content. The public sources do not mention whether loss of control mitigations or other frontier AI safety questions were part of the assessment within the campaign. An interesting aspect is that several open-source datasets were “dealt with”, using the official language, despite the fact that open weights distributed for free are not subject to most of the Chinese AI regulations.
The Supreme People’s Court issued its first AI-focused opinion in which it provides guidance to lower courts on determining liability of AI users vs AI providers. When deliberating that, courts are asked to take into account whether the AI provider mitigated the risks and was transparent about them.
At the end of September, the US and Chinese leaders met in Washington DC, and agreed on an incident communication channel, as well as on the continuation of AI dialogue in November. The countries should now define an “incident” as well as the kinds of models that are covered (such as unreleased internal models).
Implementation is arguably the most important element of a proper regulatory framework assessment. At the end I introduce my implementation tracker that I will use to observe the issues I deem important, and will talk about them in future issues. The topics include labs’ disclosures, citations of Framework 3.0 and the Supreme Court’s opinion, etc.
1 It is difficult to observe frontier model upgrades through the public registry
The published lists contain no separate entries for successive general-purpose model generations at the five frontier AI labs examined here.
This finding is primarily about the lack of public visibility, but it cannot be inferred that the new models were not reviewed. It can be the case that the public has received no information about those reviews.
1.1 The evidence and scope
I analysed the whole of 31 public filing lists that were published since 2023, including 13 generative AI lists and 18 deep-synthesis lists, with 1,843 and 7,764 entries respectively. The 1,843 generative AI entries consist of 1,112 national filings and 731 local registrations, as of 31 August 2026.[1]
By frontier labs I mean the Chinese startups which have released leading LLMs, including DeepSeek, Moonshot AI (Kimi), Zhipu (GLM), MiniMax and StepFun. I have not covered big tech companies like Alibaba, ByteDance, Baidu and Tencent, since they have multiple products, making it harder to determine which filings correspond to which models.
They each appear once, at launch, or a few times for a new product or modality, but none of their later model generations, from DeepSeek V3, R1 and V4 to Kimi K3 or GLM-5.x, produced a new public entry. Zilan Qian (now at GovAI, formerly at the Oxford China Policy Lab) pointed this out in January 2026,[2] and my analysis below shows that the gap has existed since the registry began.
I noticed that throughout these years, each frontier lab filed only once, or a few times for new products. For example, DeepSeek has one generative AI filing (“DeepSeek Chat”, 2024), Moonshot also has one (2023), StepFun has two (2023, and a multimodal model in 2025), MiniMax has three (2023, a multimodal model in 2024 and a new company entity in 2025), and Zhipu has ChatGLM (2023) plus video and on-device models (2024). Only ModelBest made filings for each new model family (MiniCPM, MiniCPM-V and MiniCPM-O).
Qingying video model and on-device model (27 December 2024; Jan 2025 list); four local registrations of apps, including AutoGLM (6 June 2025; Jun 2025 list)
MiniCPM (10 April 2025; Jun 2025 list), MiniCPM-V (12 November 2025), MiniCPM-O (11 December 2025; both Dec 2025 list)
Files per model family
Table: frontier labs in the generative AI registry, 2023–2026. Source: CAC generative AI filing lists, my compilation; dates are approval dates. Model releases are from the labs’ public announcements.[14]
1.2 What public experts can observe from the registry
The capability changes associated with the later model generations are important to observe to be able to track the risks discussed in Framework 3.0. However, outsiders cannot trace the review of those upgrades through separate public registry entries.
Before most AI services can launch in China, they have to be filed with the Cyberspace Administration of China (CAC).[15] The duty covers services with “public-opinion attributes or social-mobilisation capacity”, and CAC regularly publishes lists of the approved filings. These lists are one of the few places where the public can regularly learn some things about the AI systems which the Chinese state has approved for market release. As is illustrated by Figure 1, the reports and assessments that companies have to file don’t get published. But what does get published can be analysed to observe interesting trends in the Chinese AI landscape. It is also notable that the approval rules apply only to “services” offered to the public, so releasing free open-weight models, as well as research and development (internal models), are exempt, while a public-facing chatbot built on open weights still needs a filing.[16]
The CAC is in charge of processing and publishing two registries: one is the deep-synthesis registry[17] (“deep synthesis” is the Chinese legal term for algorithms that generate or alter text, images, voice or video); the second is the generative AI registry.[18][19] The generative AI registry keeps track of services offered to the public, making sure that all AI services complete a security assessment against the national standard GB/T 45654 and a review by the CAC, which took a median of 53 days in 2026. On the other hand, apps that use another company’s filed AI model enjoy a much lighter registration with the provincial CAC office.[20] Most AI chatbots fall under both the genAI and deep synthesis filings.
As can be seen from Figure 1, the specific information about how a system operates, or whether it is safe and has been tested, is not disclosed to the public. Besides, the required security assessment does not focus on loss of control, but rather on content: “public opinion-influencing risks”, discrimination, personal rights, etc. As Yulu Pi, Wenlong Li and Jatinder Singh argue, the main role of China’s filing system is not to provide the public with AI safety or capabilities information, but rather to demonstrate pre-market release compliance and “trustworthiness” to the market and the regulators.[21]
Two possible explanations are: 1) the term “service” is interpreted by the Chinese state to encompass all model versions, since no criteria are specified for when a model’s change is substantial enough to trigger a new filing: this may have been a conscious decision in order not to slow down every release; 2) model upgrades may be communicated by the AI labs to the regulators, for example through direct contact with the Cyberspace Administration.
Both explanations are hypothetical. The published lists do not allow us to determine whether a major model update triggers a fresh review, what information is filed with the regulator, and what that review covers. I will continue to analyse new registry filings in future issues, including through this lens.
2 Framework 3.0 recognises frontier risks but remains non-binding
On 14 September TC260, the national technical committee that develops China’s cybersecurity and AI security standards, published version 3.0 of its AI Safety Governance Framework.[28] The framework is not a law and is not binding; rather, it is official guidance that demonstrates how the committee (and, arguably, the Chinese state overall) thinks about AI risks. While version 2.0 from a year earlier[29] described hypothetical future scenarios of risk, this year’s version 3.0 supplements its vision of risks with misaligned behaviours that models have already shown in testing. This is also a good example of how fast China's AI rules emerge and change, which is possible because some of the governance happens through soft law (such as standards and guidance) introduced by a multi-layered but centrally orchestrated apparatus.
2.1 Soft rules that can become “hard-ish”
Framework 3.0 is not binding, but soft law in China can have “hard law” effects in practice. A good example is the national standard GB/T 45654 on generative AI security: it is formally only “recommended” but according to filing guides, the Cyberspace Administration of China (CAC), the primary internet regulator in charge of AI, uses it when deciding whether to give AI services access to the market, and does not allow non-compliant products to be released.[30][31] The Supreme People’s Court’s new AI opinion (more in section 4) similarly tells judges to use national and industry standards when determining whether a physical AI product is defective.[32] So there are different paths for soft law towards “hardening”, and it remains to be seen whether and under what circumstances Framework 3.0 will become binding in practice.
Companies also tend to self-govern and raise the compliance bar higher than the binding law requires. In her 2024 book High Wire, Angela Huyue Zhang observes that “few Chinese businesses will dare to challenge a powerful agency in court”, and that they cooperate closely with regulators instead; for example, when Alibaba was fined USD 2.8 billion in 2021, it did not appeal but thanked the regulator and promised to improve compliance; after regulators summoned 34 tech firms in 2021, all 34 updated their privacy policies promptly.[33]
So tech firms may be willing to comply with soft law, but it is the task of the regulators to make that soft law easy to comply with by making it clear and specific, not confusing. In a 2025 article (written before the release of Framework 3.0), Zhang argues that China’s AI rules are strategically lenient and send pro-growth messages more than they protect the public.[34]
That description may apply to some parts of Framework 3.0: for example, its first principle promotes an “inclusive attitude towards AI research” and “room for trial and error”; its rules on the loss of control are quite clear about the risks, but lack specific implementation mechanisms such as quantifiable triggers or reporting duties. The framework recommends incident reporting and a new security assessment after important model updates, but neither is binding.[35] It remains to be seen whether frontier labs will end up complying with key provisions of Framework 3.0, especially given that most have no accompanying implementing rules yet.
Throughout this monthly series, I will track the specific ways Framework 3.0 will be implemented by AI labs, cited by courts or referenced in “implementation campaigns” (see section 6, “Implementation tracker”).
2.2 The changes relevant to frontier AI safety
The most relevant changes include the framework’s more specific descriptions of loss-of-control risks, as well as its recommendations for developers. I provide the full comparison and translated provisions in Appendix A of this issue.
The framework describes the possibility that models could strategically lower their performance in evaluations, conceal actions, or exploit flaws to break isolation restrictions and access external systems.
The preface mentions autonomous learning and recursive self-improvement. There is a dedicated agent risk management section which talks about failures in group coordination and emergent behaviour.
The framework recommends human-in-the-loop measures and alignment training to reduce the risks of models deceiving red-team testers, hiding capabilities or evading controls. The recommendations for circuit breakers, “one-click control” and regular testing are taken from Framework 2.0.
The recommendation to disclose audits and anomaly handling now also includes security assessments, but the target audience for the security assessments is not defined.
As Concordia AI notes, the new framework appears to engage closely with recent frontier AI incidents, including the OpenAI–Hugging Face incident in July.[36][37] The framework does not name any company, but its description of models that exploit flaws to break isolation and reach external systems matches that event.
Figure 2. From Framework 2.0 to Framework 3.0.
For frontier AI governance, recognition of the risks is distinct from evidence that labs are required to manage them. Framework 3.0 provides the former. Whether its provisions acquire practical force through regulators, standards, courts or company practice is the question for the implementation tracker.
3 Enforcement focused on content and service compliance
In China, internet enforcement is often done by means of time-limited “campaigns” in which the regulator sets numerical targets and later reports aggregate results. The latest campaign, “Qinglang: rectifying disorder in AI applications”, took place from late April to 2 September.[38]
Its first phase targeted AI services themselves (unfiled models, weak safety filtering, training data, missing labels and the security of open-source models) and reported 14,000+ AI products handled, 6 million+ items of content removed and 26,000+ accounts “dealt with”; the second targeted AI-generated content such as false information, impersonation and AI-run troll accounts, with 2,400+ websites and apps, 5.61 million+ items and 49,000+ accounts.[39][40]
In other words, the campaign focused on content rather than model behaviour or loss of control in particular.
The campaign also took down nine open-source datasets. This shows attention to those datasets, but does not by itself show how open-weight models were scrutinised. Free releases of open weights are exempt from the pre-market filing system, while public-facing AI services are covered; the published results do not establish the scale of checks on the models.
The published campaign data shows enforcement activity, but does not say whether assessments of frontier-model risks were carried out. I will track the relevant disclosures in my future issues.
4 The court opinion connects liability to reasonable care and disclosure of risks
On 7 September the Supreme People’s Court, China’s highest court, issued its first policy document on how judges should decide AI-related disputes, consisting of 24 articles.[41] China has a civil-law system without binding precedent, so the highest court issues documents that guide lower courts’ decisions. This document is an “opinion” (意见), which is formally weaker than a binding judicial interpretation, although lower courts follow it in practice. The opinion is also one of the ways in which soft rules, such as national standards, gain hard edges (see section 2.1).
How courts interpret “reasonable care” as models become more autonomous and capable remains an open question. The opinion focuses on preventive measures and technical feasibility, and also provides conditional protection for some open-source code providers, but it does not itself establish duties related to the loss-of-control risks mentioned in Framework 3.0.
4.1 The main points for AI safety
Reasonable care in AI disputes.[42] The default way for the courts to determine whether a provider is liable is to see whether they are at fault unless a law provides otherwise. The Supreme Court suggests that in order to decide fault, courts look at what developers and providers did to prevent harm, and what was “technically possible”. Users’ ability to “foresee and control the harm” should also be considered. The Opinion also suggests that the courts should weigh how autonomous and how transparent an AI system is.
The correct interpretation of that is unclear: one possible interpretation is that the more autonomy a model has, the greater the responsibility of the developer, while the more transparent a developer is about a model’s risks and limitations, the more responsibility shifts from the developer to the end user. Parties may in future cite Framework 3.0 as evidence of reasonable care or its absence. This remains a possibility rather than an established reading: the Opinion does not refer to the framework explicitly and was published a week before it.
Liability for open-source code is reduced or eliminated in exchange for disclosure.[43] “Where an open-source developer or provider provides, free of charge and as open source, some of the code modules needed to develop AI software, and publicly explains their functions and security risks, and another person's use of those code modules causes infringement, the people's court may find that the open-source developer or provider does not bear tort liability." (Figure 3).
Figure 3. Art. 13 of the opinion, simplified.
Disclosure of training data and descriptions as court evidence.[44] A developer suggesting they did not infringe copyright must provide their “training-data sources, training-process records, the model’s mode of operation and its scientific basis” to support their claim. When a party refuses to disclose the relevant evidence “without good reason”, that refusal may be treated as evidence against that party.
A provider is liable for AI outputs that infringe personality rights, such as defamation,only if they fail to act after being notified.[45] In a hypothetical case, a chatbot hallucinates a false claim about a real person who then sues for defamation. If the provider can point to its output filters and warnings, and show that its AI stopped generating the content once the allegedly defamed person notified the provider and supplied them with evidence, the provider is then unlikely to be liable.[46]
At the same time, if a user deliberately prompted the chatbot to produce the claim “by entering infringing prompts”, the user would be liable; the provider would be liable too if it ignored a proper notice. An “infringing prompt” might, for example, look like “create a short video with the face of person Y saying they committed fraud”.
4.2 International judicial cooperation and foreign policy
Encouragement of judicial cooperation on AI-related disputes. The Opinion promotes “strengthening international judicial exchange and cooperation: properly handle cross-border disputes involving AI … advance foreign-related adjudication exchange and cooperation in the AI field, and strengthen the alignment and mutual learning of rules”.[47] Susan Finder, who has followed the Supreme People’s Court for over two decades, notes that the Opinion’s release was likely timed to Xi Jinping’s US visit.[48] (Disclosure: I wrote a guest post for Susan Finder’s Supreme People’s Court Monitor in 2020.)[49]
This resembles the Supreme Court’s approach in relation to the Belt and Road Initiative, where it has similarly been serving China’s foreign policy strategy by publishing opinions on "judicial services" for the Belt and Road, and promoting judicial exchanges with participating countries. It remains to be seen whether, similar to the BRI dispute resolution bodies, China will introduce a dedicated international dispute resolution mechanism for AI disputes.
5 International cooperation and the AI incident channel
5.1 Agreements between the US and China
At their White House summit on 24 September, Xi Jinping and Donald Trump agreed to open a US-China dialogue on the risks and benefits of AI,[50] and according to China’s Foreign Ministry the next round will take place in November.[51] At talks on 20 September the US side proposed a communication channel for AI-related incidents that rise to the level of national security,[52] and the channel was agreed at the summit by both leaders.[53]
5.2 Next steps for the channel
For the incident channel to be useful, the next round in November would need to clarify terms such as “incident” and “frontier model”: Will the channel cover internal models, or only commercially released “services”, to which most Chinese AI regulation is currently limited?
The agreement is a starting point for further communication, but its value for frontier AI safety will depend on the kinds of incidents it will cover, who can report them and what information is exchanged. I will track those in future issues.
5.3 Loss of control in China’s official language
As of September 2026, loss-of-control language has become common among Chinese bureaucrats. On 1 September, a senior Cyberspace Administration official mentioned “extreme loss of control” as one of the five AI governance challenges;[54] Framework 3.0 mentions recursive self-improvement, shutdown resistance and loss of control over nuclear, biological, chemical and missile knowledge; and the Supreme People’s Court’s press release of its AI opinion quotes Xi’s speech from the World AI Conference in Shanghai in July, where he said that “measures preventing AI from getting out of control must be improved in a timely manner”.[55]
However, Beijing seems to reject the idea that these risks are tied to China. The Foreign Ministry answered Dario Amodei’s call to slow down frontier development by rejecting “fearmongering” and confrontation,[56] while still acknowledging AI’s risks, such as loss of control or AI-enabled bioweapons.[57] A state-media-affiliated account also argued that letting a single US company such as Anthropic define model safety would put its competitors on the “unsafe” side.[58] Against that background, the agreement on an incident communication channel, without a negotiated pause or slowdown, is consistent with China’s stated position.
5.4 China-led venues for international AI cooperation
China is actively building its own network of AI governance forums. The World AI Cooperation Organization was founded in Shanghai on 16 July: it has 29 founding states;[59] Xi proposed a BRICS AI open-source community on 13 September, as a mechanism for cooperation on open-source AI among its members (Brazil, Russia, India, China, South Africa and newer members)[60]. Besides, Chinese companies and institutes are working within the ITU, a UN body, helping draft international technical standards on keeping AI agents secure; in September, China hosted a meeting where this work was advanced.[61][62] Framework 3.0 mentions the World AI Cooperation Organization and UN mechanisms as the channels for international cooperation, while the Chinese Supreme People’s Court opinion, as discussed above, talks about international judicial cooperation on cross-border AI and data disputes.[63]
6 Implementation tracker
Implementation is arguably the most important element of a proper regulatory framework assessment. I will be using the implementation tracker below to track topics that I deem important throughout future issues. For example, I will be tracking the citations of Framework 3.0 by the courts, government agencies, as well as implementation of the Framework by AI labs. The tracker is limited by the publicly available information.
Each issue of this series will keep the following set of trackers (I will make it clear if I later add any changes to the list of tracked items), to hopefully make the changes easy to see and analyse.
6.1 Framework 3.0 implementation and status
Citations of Framework 3.0
Tracked: How often courts, other regulations, technical standards, or AI labs cite the framework (as a measure of its growing authority) and the reason for / context of the citation
Tracked: Whether requirements like “human in the loop”, circuit breakers and one-click control become binding
September 2026 status: Partly. Included in a non-binding TC260 guide (15 September 2026)[66]. The provision that appears in the Anthropomorphic Interaction Measures (15 July 2026) asks a provider to stop the service or limit functions when they find a major safety risk. That matches the human-in-the-loop criterion I am looking for, but without specifying a mechanism for that, and it only covers companion AI (chatbots focused on personal communication, so work AI assistants are out of scope).
Notes: No requirement to be public
Incident reporting by frontier labs
Tracked: Whether any rule requires labs to report incidents to a Chinese regulator; whether these reports become public
September 2026 status: No AI-focused requirement so far. There are general binding rules that require network operators to report major cybersecurity incidents to the CAC within 4 hours[67] after the incident; generative AI providers must also report illegal content.[68] Besides, non-binding Framework 3.0 recommends AI incident reporting.[69]
Notes: No requirement to be public
6.2 New rules
New binding rules and important non-binding guidance on AI safety
Tracked: New laws, regulations, mandatory standards and important guidance relevant to AI safety.
September 2026 status: Binding agent-safety standard (plan 20263116-Q-252) is at drafting stage, no full text published yet. The most important non-binding text in September is Framework 3.0, which is discussed in this issue.
Notes: Issued regulations must be public; drafts are also shared with the public for comments
Issuance of new Supreme People’s Court documents related to AI, and international dispute bodies
Tracked: Further opinions, judicial interpretations or typical cases on AI from the Supreme People’s Court, and any international litigation or mediation body that specialises in AI disputes
September 2026 status: Nothing yet - too early
Notes: It must be public
6.3 Existing rules and their implementation
Citations of the Supreme People’s Court AI opinion[70]
Tracked: Whether lower courts cite the AI opinion in published judgments; if yes - on which points
September 2026 status: Nothing yet, too early
Notes: Partly: courts publish selected judgments
Registry: what information is shared with the public within filing lists
Tracked: Whether frontier labs are on the lists; what information will be made public in the next filing batches (the next generative AI list is expected in mid-November)
September 2026 status: –
Notes: It must be public: the CAC publishes the lists
Enforcement campaigns are discussed in section 3. I will continue to observe whether future campaign reports focus on dangerous model behaviour, such as loss of control.
6.4 International cooperation
US–China AI dialogue
Tracked: Whether the November round takes place and what it agrees: a definition of frontier models, incident categories, verification or information exchange
September 2026 status: Agreed at the 24 September summit; next round planned in November[71]
Notes: No requirement to be public
US–China AI incident channel
Tracked: whether the channel agreed at the summit is ready to be used, how it operates, how “an incident” is defined, any other public information related to the channel
September 2026 status: Agreed at the summit; no details published[72]
Notes: No requirement to be public
China-led and international AI venues
Tracked: News from the World AI Cooperation Organization, the BRICS AI open-source community, ITU sessions on agent security and UN mechanisms; any new China-led international AI venues
September 2026 status: World AI Cooperation Organization founded on 16 July (29 states); BRICS AI open-source community proposed on 13 September; eight ITU drafts on agent security currently under study[73][74]
Notes: No requirement to be public
6.5 Compute monitoring
China Computing Power Platform: national compute monitoring
Tracked: The platform monitors computing resources across the country to observe and schedule them. In principle, monitoring could make large training sessions more visible to the state, but we don’t know yet if the platform can identify these sessions and whether that information will be shared with the public. I will track the platform’s coverage and any published data.
September 2026 status: Full nationwide coverage announced in mid-September; no data published[75]
Notes: No requirement to be public
7 Ask me
A reminder: if you have a question about China’s AI governance, write to me at s.yablonskaia@gmail.com or leave a comment. Some questions may become part of future issues.
Appendix A Framework provisions compared
The comparison below preserves the detailed provisions from Frameworks 2.0 and 3.0. Section 2 discusses their significance and the limits of their legal effect.
Framework 2.0 (September 2025)
Framework 3.0 (September 2026)
The principle of “trustworthy use and loss of control prevention” (one of the five main principles of both frameworks)
“Promote basic principles for trustworthy AI covering technical protection, value alignment, coordinated governance and other levels; ensure that the technology evolves safely, reliably and controllably; strictly guard against loss-of-control risks that threaten human survival and development; and ensure that AI always remains under human control.”[76]
“Strengthen the prevention and governance of prominent risks such as agents' behaviour going out of control; build international governance consensus; and promote trustworthy application of AI worldwide. Promote a system of laws and regulations, technical monitoring, risk early-warning and emergency response; firmly hold the safety bottom line; guard against abuse and malicious use; and ensure that AI always remains under human control.”[77]
"In the future, it cannot be ruled out that higher-level intelligence will emerge in AI, which develops self-awareness and seeks external power, creating the risk that it will try to wrest control from humans."[79]
Examples of “risks of unintended autonomous behaviour”, “according to industry reports”
–
“Some models, after detecting that they are in an evaluation environment, strategically lower their task performance and conceal actions they have taken…… In addition, there have been cases of models autonomously exploiting environment vulnerabilities or configuration flaws to break through isolation restrictions and intrude into real external systems, in order to improve their test scores."[80]
Recursive self-improvement (mentioned in preface)
–
"AI has already shown a self-accelerating trend of models and algorithms autonomously learning and optimising, and recursively improving themselves. Whether the speed and direction of technological development will exceed human foresight and control requires attention and vigilance."[81]
"AI greatly lowers the barrier to acquiring expert knowledge in high-risk fields such as nuclear, biological, chemical and missile weapons. Combined with retrieval-augmented generation, if this is not effectively controlled, it may be maliciously exploited by criminals, extremist forces and terrorists……"[83]
Developer safeguards
“establish measures such as a 'circuit breaker' and 'one-click control'”; "Developers regularly conduct tests to determine whether a model may pose a potential risk of technological loss of control."[84]
“establish measures such as 'human in the loop', a 'circuit breaker' and 'one-click control'……"; "Strengthen safety alignment during model training, to prevent models from unintended behaviours such as deceiving red-team tests, hiding capabilities and evading controls."; same testing suggestion as in Framework 2.0[85]
Disclosure (does not specify the audience but the word 披露 used here usually means “public disclosure”)
"Regularly disclose the audits and anomaly handling of AI models and algorithms."[86]
"Regularly disclose the security assessments, audits and anomaly handling of AI models and algorithms."[87]
Agents & swarms
"Agents need to call terminal system files, permissions, interfaces and tools in order to plan and execute complex tasks autonomously, which increases security risks such as file leakage and abuse of permissions."[88]
There is a dedicated "Agent risk management framework" section; "Risks of group coordination": "…… loss of control of a single unit, vulnerabilities in coordination protocols and emergent group behaviour …… may cause disordered group operations, systemic paralysis, chain accidents and similar problems."[89]
Appendix B Further registry findings
These findings describe changes in the filing lists and the types of services that appear in them. Filing counts alone do not establish model capabilities or the strength of safety oversight.
B1 National filings and local registrations
Local registrations exceeded national filings in July–August 2026. Local registrations (products that deploy another company’s model instead of developing their own) increased from 105 in 2024 to 330 in 2025 and 296 in the first eight months of 2026. Over whole years they still trail national filings (services on a model the company runs itself, often fine-tuned versions of open-source models), but in the July–August 2026 list they exceeded them, by 133 to 124, for only the second time (the first was March 2025, by 54 to 44). One possible explanation for the 2025 rise is the emergence of cheap and strong open models like DeepSeek R1. This remains speculative because the registry does not publish the names of the upstream models. Many Chinese cities and districts give financial rewards to companies that make their first national filing: for example, companies can get up to USD 140,000 for a first national generative AI filing in Guangzhou’s Haizhu district,[90] up to USD 70,000 in Wuxi[91] and up to USD 140,000 in Hangzhou’s Qiantang district for selected models each year.[92] I found no local policy that incentivises completing local registrations based on upstream models/vouchers, but I found subsidy programs for buying services from filed models, which could indirectly encourage apps built on filed models and contribute to the dynamic.[93]
Generative AI filings
Jan–Feb
Mar–Apr
May–Jun
Jul–Aug
New national filings
48
72
120
124 (7 on-device)
New local registrations
46
49
68
133
Top province (national)
Shanghai 11
Guangdong 18
Beijing 29
Beijing 42 (34%)
B2 Agents and embodied services
More agent-based and embodied services are emerging. The release of the Doubao phone assistant (ByteDance’s AI that steers multiple apps on a phone) was approved on 15 July; the number of generative AI filings with “agent” in the name[94] fluctuated from 2 to 4 to 7 to 4 in the 2026 batches. In robotics, there was a wave of embodied-AI filings from May to August 2026, including AgiBot (WITA, in May), the Beijing Humanoid Robot Innovation Center (two base models, in June), UBTech and Unitree (in August), and Ruihong Embodied Intelligent Robot[95] (July), a smaller vendor of robots for Communist Party education and administrative work.
As for deep synthesis filings, between 19 and 25 entries per 2026 batch have “agent” in the algorithm or product name[96] (for example Ant’s Agentar or Lenovo’s Baiying agent client[97]). However, only 0 to 5 descriptions per batch mention actions such as automated operation or tool calling, because the description template has essentially no place for what an agent does. This leaves a gap in the public descriptions, especially given Framework 3.0’s strong focus on agents.
Method: all 13 generative AI lists published by the CAC up to the announcement of 14 September 2026, covering approvals to 31 August 2026; labs matched by legal entity and affiliates, including local registrations. The deep-synthesis lists also contain change notes that the CAC adds later; one, for StepFun’s Step1X, records an added audio modality, so some upgrades may appear there rather than as new entries.
Cyberspace Administration of China, “国家互联网信息办公室关于发布第十八批深度合成服务算法备案信息的公告” [Announcement on the 18th batch of deep-synthesis service algorithm filings], 17 July 2026. https://www.cac.gov.cn/2026-07/17/c_1786032856662750.htm. All filings can also be searched in the national algorithm filing system, https://beian.cac.gov.cn.
Yulu Pi, Wenlong Li and Jatinder Singh, “Understanding the Role of Algorithm Registers in AI Governance Through Comparative Analysis of China and the UK”, FAccT 2026, arXiv:2606.00035, 25 April 2026. https://arxiv.org/abs/2606.00035
Cyberspace Administration of China et al., “互联网信息服务深度合成管理规定” [Provisions on the Management of Deep Synthesis of Internet Information Services], 25 November 2022, Art. 19. https://www.cac.gov.cn/2022-12/11/c_1672221949354811.htm
SAMR and SAC, GB/T 45654-2025, “网络安全技术 生成式人工智能服务安全基本要求” [Basic security requirements for generative AI services], published 25 April 2025. TC260 summary: https://www.secrss.com/articles/78325
Cyberspace Administration of China et al., “互联网信息服务算法推荐管理规定” [Provisions on the Management of Algorithmic Recommendation of Internet Information Services], 31 December 2021, Arts. 24–25. https://www.cac.gov.cn/2022-01/04/c_1642894606364259.htm
SAMR and SAC, GB/T 45652-2025, “生成式人工智能预训练和优化训练数据安全规范” [Security specification for pre-training and fine-tuning data], and GB/T 45674-2025, “生成式人工智能数据标注安全规范” [Security specification for data annotation], published 25 April 2025, in force 1 November 2025; National Standards Announcement 2025 No. 10. TC260 summary: https://www.secrss.com/articles/78325
SAMR and SAC, GB/T 45654-2025, “网络安全技术 生成式人工智能服务安全基本要求” [Basic security requirements for generative AI services], published 25 April 2025, in force 1 November 2025; SAMR and SAC National Standards Announcement 2025 No. 10 (2025年第10号《中华人民共和国国家标准公告》). TC260 summary: https://www.secrss.com/articles/78325
Angela Huyue Zhang, High Wire: How China Regulates Big Tech and Governs Its Economy, Oxford University Press, 2024, pp. 8, 12, 113, 139. https://www.angelazhang.net/high-wire
Supreme People’s Court, “最高人民法院关于依法审理涉人工智能纠纷案件的意见” [Opinions on adjudicating AI-related disputes in accordance with the law], 法发〔2026〕10号, 7 September 2026. https://www.court.gov.cn/zixun/xiangqing/511101.html
Ministry of Foreign Affairs of the PRC, “成立世界人工智能合作组织协定签署仪式在上海举行” [Signing ceremony of the agreement establishing the World AI Cooperation Organization held in Shanghai], 16 July 2026. https://www.mfa.gov.cn/wjbzhd/202607/t20260716_11984399.shtml
Cyberspace Administration of China, “国家网络安全事件报告管理办法” [Measures for Reporting National Cybersecurity Incidents], 15 September 2025, in force 1 November 2025, Arts. 2 and 4. https://www.cac.gov.cn/2025-09/15/c_1759583017717009.htm
Supreme People’s Court, “最高人民法院关于依法审理涉人工智能纠纷案件的意见” [Opinions on adjudicating AI-related disputes in accordance with the law], 法发〔2026〕10号, 7 September 2026. https://www.court.gov.cn/zixun/xiangqing/511101.html
Ministry of Foreign Affairs of the PRC, “成立世界人工智能合作组织协定签署仪式在上海举行” [Signing ceremony of the agreement establishing the World AI Cooperation Organization held in Shanghai], 16 July 2026. https://www.mfa.gov.cn/wjbzhd/202607/t20260716_11984399.shtml
Hangzhou Qiantang District Government, “关于支持人工智能产业高质量发展若干政策（2025年版）” [Policies supporting high-quality development of the AI industry, 2025 edition], via Keceyun, accessed 29 September 2026. https://www.keceyun.com/policy/newsdetail/468280.html
Crossposted from my Substack, sofiayab.substack.com. A bit about me: I studied law in Chinese at Fudan University and did an MSc in China in Comparative Perspective at LSE. I am Head of Legal at an AI company, and an incoming Winter Fellow at GovAI (2027). Views in the article are my own.
This is the first issue of my monthly series on China’s AI safety regulation. Each following month I will analyse China’s new rules, AI registries published regularly, the Supreme Court’s policy documents, and I will also study their implementation. My monitor will focus on whether these regulations move us towards a higher or lower probability of “AI going well”.
This monitor is for AI governance researchers who would like to understand Chinese AI regulation more deeply, as well as for anyone interested in Chinese AI regulation.
The findings in brief
I analysed all 31 published filing lists since 2023. On the lists, I found the first models of DeepSeek, Moonshot AI, Zhipu, MiniMax and StepFun in 2023–2024, as well as occasional later filings for new products, but there are no separate filings of their later general-purpose models. This limits the public’s ability to see how the state reviews new, more capable models. Nevertheless, this does not mean that Chinese regulators did not review the newer frontier models before they were released on the market. Section 1 goes deeper into the evidence and the limits of the findings.
What we see is that the new AI Safety Governance Framework 3.0 is inspired by Framework 2.0, but also improves it: Framework 3.0 adds misaligned behaviours seen in real-life cases (e.g. it mentions models that hide their real capabilities or break sandboxes to reach external systems) to the list of hypothetical scenarios that were mentioned in Framework 2.0. Nevertheless, the new Framework 3.0 does not present any specific mechanisms that providers would follow to comply with it, such as quantifiable metrics, fixed-cadence reporting duties etc. The framework is non-binding, while its status can change towards “bind-ish” in practice. We cannot predict whether that will happen, so it is important to observe.
The Qinglang enforcement campaign carried out in 2026 was mainly focused on content control. The highest numbers of cases are related to content-filtering and labelling AI-generated content. The public sources do not mention whether loss of control mitigations or other frontier AI safety questions were part of the assessment within the campaign. An interesting aspect is that several open-source datasets were “dealt with”, using the official language, despite the fact that open weights distributed for free are not subject to most of the Chinese AI regulations.
The Supreme People’s Court issued its first AI-focused opinion in which it provides guidance to lower courts on determining liability of AI users vs AI providers. When deliberating that, courts are asked to take into account whether the AI provider mitigated the risks and was transparent about them.
At the end of September, the US and Chinese leaders met in Washington DC, and agreed on an incident communication channel, as well as on the continuation of AI dialogue in November. The countries should now define an “incident” as well as the kinds of models that are covered (such as unreleased internal models).
Implementation is arguably the most important element of a proper regulatory framework assessment. At the end I introduce my implementation tracker that I will use to observe the issues I deem important, and will talk about them in future issues. The topics include labs’ disclosures, citations of Framework 3.0 and the Supreme Court’s opinion, etc.
1 It is difficult to observe frontier model upgrades through the public registry
The published lists contain no separate entries for successive general-purpose model generations at the five frontier AI labs examined here.
This finding is primarily about the lack of public visibility, but it cannot be inferred that the new models were not reviewed. It can be the case that the public has received no information about those reviews.
1.1 The evidence and scope
I analysed the whole of 31 public filing lists that were published since 2023, including 13 generative AI lists and 18 deep-synthesis lists, with 1,843 and 7,764 entries respectively. The 1,843 generative AI entries consist of 1,112 national filings and 731 local registrations, as of 31 August 2026.[1]
By frontier labs I mean the Chinese startups which have released leading LLMs, including DeepSeek, Moonshot AI (Kimi), Zhipu (GLM), MiniMax and StepFun. I have not covered big tech companies like Alibaba, ByteDance, Baidu and Tencent, since they have multiple products, making it harder to determine which filings correspond to which models.
They each appear once, at launch, or a few times for a new product or modality, but none of their later model generations, from DeepSeek V3, R1 and V4 to Kimi K3 or GLM-5.x, produced a new public entry. Zilan Qian (now at GovAI, formerly at the Oxford China Policy Lab) pointed this out in January 2026,[2] and my analysis below shows that the gap has existed since the registry began.
I noticed that throughout these years, each frontier lab filed only once, or a few times for new products. For example, DeepSeek has one generative AI filing (“DeepSeek Chat”, 2024), Moonshot also has one (2023), StepFun has two (2023, and a multimodal model in 2025), MiniMax has three (2023, a multimodal model in 2024 and a new company entity in 2025), and Zhipu has ChatGLM (2023) plus video and on-device models (2024). Only ModelBest made filings for each new model family (MiniCPM, MiniCPM-V and MiniCPM-O).
Lab
First filing (approved)
Later filings
Major model releases since
DeepSeek[3]
DeepSeek Chat (13 May 2024; Aug 2024 list)
None
V3 (2024); R1, V3.1, V3.2 (2025); V4 (2026)[4]
Moonshot AI (Kimi)[5]
Moonshot (3 November 2023; Apr 2024 list)
None
Kimi k1.5, K2 (2025); K3 (2026)[6]
Zhipu[7]
ChatGLM (31 August 2023; Apr 2024 list)
Qingying video model and on-device model (27 December 2024; Jan 2025 list); four local registrations of apps, including AutoGLM (6 June 2025; Jun 2025 list)
GLM-4 (2024); GLM-4.5 (2025); GLM-5.x (2026)[8]
MiniMax[9]
abab (31 August 2023; Apr 2024 list)
abab multimodal (12 June 2024; Aug 2024 list); MiniMax, new entity (9 June 2025; Jun 2025 list)
abab 6.5 (2024); MiniMax-01, M1, M2 (2025)[10]
StepFun[11]
Step (24 November 2023; Apr 2024 list)
Step multimodal (9 June 2025; Jun 2025 list)
Step-2 (2024); Step-3 (2025)[12]
ModelBest (for comparison)[13]
LUCA (3 November 2023; Apr 2024 list)
MiniCPM (10 April 2025; Jun 2025 list), MiniCPM-V (12 November 2025), MiniCPM-O (11 December 2025; both Dec 2025 list)
Files per model family
Table: frontier labs in the generative AI registry, 2023–2026. Source: CAC generative AI filing lists, my compilation; dates are approval dates. Model releases are from the labs’ public announcements.[14]
1.2 What public experts can observe from the registry
The capability changes associated with the later model generations are important to observe to be able to track the risks discussed in Framework 3.0. However, outsiders cannot trace the review of those upgrades through separate public registry entries.
Before most AI services can launch in China, they have to be filed with the Cyberspace Administration of China (CAC).[15] The duty covers services with “public-opinion attributes or social-mobilisation capacity”, and CAC regularly publishes lists of the approved filings. These lists are one of the few places where the public can regularly learn some things about the AI systems which the Chinese state has approved for market release. As is illustrated by Figure 1, the reports and assessments that companies have to file don’t get published. But what does get published can be analysed to observe interesting trends in the Chinese AI landscape. It is also notable that the approval rules apply only to “services” offered to the public, so releasing free open-weight models, as well as research and development (internal models), are exempt, while a public-facing chatbot built on open weights still needs a filing.[16]
The CAC is in charge of processing and publishing two registries: one is the deep-synthesis registry[17] (“deep synthesis” is the Chinese legal term for algorithms that generate or alter text, images, voice or video); the second is the generative AI registry.[18][19] The generative AI registry keeps track of services offered to the public, making sure that all AI services complete a security assessment against the national standard GB/T 45654 and a review by the CAC, which took a median of 53 days in 2026. On the other hand, apps that use another company’s filed AI model enjoy a much lighter registration with the provincial CAC office.[20] Most AI chatbots fall under both the genAI and deep synthesis filings.
As can be seen from Figure 1, the specific information about how a system operates, or whether it is safe and has been tested, is not disclosed to the public. Besides, the required security assessment does not focus on loss of control, but rather on content: “public opinion-influencing risks”, discrimination, personal rights, etc. As Yulu Pi, Wenlong Li and Jatinder Singh argue, the main role of China’s filing system is not to provide the public with AI safety or capabilities information, but rather to demonstrate pre-market release compliance and “trustworthiness” to the market and the regulators.[21]
Figure 1. How China’s two AI registries work.[22][23][24][25][26][27]
1.3 Possible explanations
Two possible explanations are: 1) the term “service” is interpreted by the Chinese state to encompass all model versions, since no criteria are specified for when a model’s change is substantial enough to trigger a new filing: this may have been a conscious decision in order not to slow down every release; 2) model upgrades may be communicated by the AI labs to the regulators, for example through direct contact with the Cyberspace Administration.
Both explanations are hypothetical. The published lists do not allow us to determine whether a major model update triggers a fresh review, what information is filed with the regulator, and what that review covers. I will continue to analyse new registry filings in future issues, including through this lens.
2 Framework 3.0 recognises frontier risks but remains non-binding
On 14 September TC260, the national technical committee that develops China’s cybersecurity and AI security standards, published version 3.0 of its AI Safety Governance Framework.[28] The framework is not a law and is not binding; rather, it is official guidance that demonstrates how the committee (and, arguably, the Chinese state overall) thinks about AI risks. While version 2.0 from a year earlier[29] described hypothetical future scenarios of risk, this year’s version 3.0 supplements its vision of risks with misaligned behaviours that models have already shown in testing. This is also a good example of how fast China's AI rules emerge and change, which is possible because some of the governance happens through soft law (such as standards and guidance) introduced by a multi-layered but centrally orchestrated apparatus.
2.1 Soft rules that can become “hard-ish”
Framework 3.0 is not binding, but soft law in China can have “hard law” effects in practice. A good example is the national standard GB/T 45654 on generative AI security: it is formally only “recommended” but according to filing guides, the Cyberspace Administration of China (CAC), the primary internet regulator in charge of AI, uses it when deciding whether to give AI services access to the market, and does not allow non-compliant products to be released.[30][31] The Supreme People’s Court’s new AI opinion (more in section 4) similarly tells judges to use national and industry standards when determining whether a physical AI product is defective.[32] So there are different paths for soft law towards “hardening”, and it remains to be seen whether and under what circumstances Framework 3.0 will become binding in practice.
Companies also tend to self-govern and raise the compliance bar higher than the binding law requires. In her 2024 book High Wire, Angela Huyue Zhang observes that “few Chinese businesses will dare to challenge a powerful agency in court”, and that they cooperate closely with regulators instead; for example, when Alibaba was fined USD 2.8 billion in 2021, it did not appeal but thanked the regulator and promised to improve compliance; after regulators summoned 34 tech firms in 2021, all 34 updated their privacy policies promptly.[33]
So tech firms may be willing to comply with soft law, but it is the task of the regulators to make that soft law easy to comply with by making it clear and specific, not confusing. In a 2025 article (written before the release of Framework 3.0), Zhang argues that China’s AI rules are strategically lenient and send pro-growth messages more than they protect the public.[34]
That description may apply to some parts of Framework 3.0: for example, its first principle promotes an “inclusive attitude towards AI research” and “room for trial and error”; its rules on the loss of control are quite clear about the risks, but lack specific implementation mechanisms such as quantifiable triggers or reporting duties. The framework recommends incident reporting and a new security assessment after important model updates, but neither is binding.[35] It remains to be seen whether frontier labs will end up complying with key provisions of Framework 3.0, especially given that most have no accompanying implementing rules yet.
Throughout this monthly series, I will track the specific ways Framework 3.0 will be implemented by AI labs, cited by courts or referenced in “implementation campaigns” (see section 6, “Implementation tracker”).
2.2 The changes relevant to frontier AI safety
The most relevant changes include the framework’s more specific descriptions of loss-of-control risks, as well as its recommendations for developers. I provide the full comparison and translated provisions in Appendix A of this issue.
The framework describes the possibility that models could strategically lower their performance in evaluations, conceal actions, or exploit flaws to break isolation restrictions and access external systems.
The preface mentions autonomous learning and recursive self-improvement. There is a dedicated agent risk management section which talks about failures in group coordination and emergent behaviour.
The framework recommends human-in-the-loop measures and alignment training to reduce the risks of models deceiving red-team testers, hiding capabilities or evading controls. The recommendations for circuit breakers, “one-click control” and regular testing are taken from Framework 2.0.
The recommendation to disclose audits and anomaly handling now also includes security assessments, but the target audience for the security assessments is not defined.
As Concordia AI notes, the new framework appears to engage closely with recent frontier AI incidents, including the OpenAI–Hugging Face incident in July.[36][37] The framework does not name any company, but its description of models that exploit flaws to break isolation and reach external systems matches that event.
Figure 2. From Framework 2.0 to Framework 3.0.
For frontier AI governance, recognition of the risks is distinct from evidence that labs are required to manage them. Framework 3.0 provides the former. Whether its provisions acquire practical force through regulators, standards, courts or company practice is the question for the implementation tracker.
3 Enforcement focused on content and service compliance
In China, internet enforcement is often done by means of time-limited “campaigns” in which the regulator sets numerical targets and later reports aggregate results. The latest campaign, “Qinglang: rectifying disorder in AI applications”, took place from late April to 2 September.[38]
Its first phase targeted AI services themselves (unfiled models, weak safety filtering, training data, missing labels and the security of open-source models) and reported 14,000+ AI products handled, 6 million+ items of content removed and 26,000+ accounts “dealt with”; the second targeted AI-generated content such as false information, impersonation and AI-run troll accounts, with 2,400+ websites and apps, 5.61 million+ items and 49,000+ accounts.[39][40]
In other words, the campaign focused on content rather than model behaviour or loss of control in particular.
The campaign also took down nine open-source datasets. This shows attention to those datasets, but does not by itself show how open-weight models were scrutinised. Free releases of open weights are exempt from the pre-market filing system, while public-facing AI services are covered; the published results do not establish the scale of checks on the models.
The published campaign data shows enforcement activity, but does not say whether assessments of frontier-model risks were carried out. I will track the relevant disclosures in my future issues.
4 The court opinion connects liability to reasonable care and disclosure of risks
On 7 September the Supreme People’s Court, China’s highest court, issued its first policy document on how judges should decide AI-related disputes, consisting of 24 articles.[41] China has a civil-law system without binding precedent, so the highest court issues documents that guide lower courts’ decisions. This document is an “opinion” (意见), which is formally weaker than a binding judicial interpretation, although lower courts follow it in practice. The opinion is also one of the ways in which soft rules, such as national standards, gain hard edges (see section 2.1).
How courts interpret “reasonable care” as models become more autonomous and capable remains an open question. The opinion focuses on preventive measures and technical feasibility, and also provides conditional protection for some open-source code providers, but it does not itself establish duties related to the loss-of-control risks mentioned in Framework 3.0.
4.1 The main points for AI safety
Reasonable care in AI disputes.[42] The default way for the courts to determine whether a provider is liable is to see whether they are at fault unless a law provides otherwise. The Supreme Court suggests that in order to decide fault, courts look at what developers and providers did to prevent harm, and what was “technically possible”. Users’ ability to “foresee and control the harm” should also be considered. The Opinion also suggests that the courts should weigh how autonomous and how transparent an AI system is.
The correct interpretation of that is unclear: one possible interpretation is that the more autonomy a model has, the greater the responsibility of the developer, while the more transparent a developer is about a model’s risks and limitations, the more responsibility shifts from the developer to the end user. Parties may in future cite Framework 3.0 as evidence of reasonable care or its absence. This remains a possibility rather than an established reading: the Opinion does not refer to the framework explicitly and was published a week before it.
Liability for open-source code is reduced or eliminated in exchange for disclosure.[43] “Where an open-source developer or provider provides, free of charge and as open source, some of the code modules needed to develop AI software, and publicly explains their functions and security risks, and another person's use of those code modules causes infringement, the people's court may find that the open-source developer or provider does not bear tort liability." (Figure 3).
Figure 3. Art. 13 of the opinion, simplified.
Disclosure of training data and descriptions as court evidence.[44] A developer suggesting they did not infringe copyright must provide their “training-data sources, training-process records, the model’s mode of operation and its scientific basis” to support their claim. When a party refuses to disclose the relevant evidence “without good reason”, that refusal may be treated as evidence against that party.
A provider is liable for AI outputs that infringe personality rights, such as defamation, only if they fail to act after being notified.[45] In a hypothetical case, a chatbot hallucinates a false claim about a real person who then sues for defamation. If the provider can point to its output filters and warnings, and show that its AI stopped generating the content once the allegedly defamed person notified the provider and supplied them with evidence, the provider is then unlikely to be liable.[46]
At the same time, if a user deliberately prompted the chatbot to produce the claim “by entering infringing prompts”, the user would be liable; the provider would be liable too if it ignored a proper notice. An “infringing prompt” might, for example, look like “create a short video with the face of person Y saying they committed fraud”.
4.2 International judicial cooperation and foreign policy
Encouragement of judicial cooperation on AI-related disputes. The Opinion promotes “strengthening international judicial exchange and cooperation: properly handle cross-border disputes involving AI … advance foreign-related adjudication exchange and cooperation in the AI field, and strengthen the alignment and mutual learning of rules”.[47] Susan Finder, who has followed the Supreme People’s Court for over two decades, notes that the Opinion’s release was likely timed to Xi Jinping’s US visit.[48] (Disclosure: I wrote a guest post for Susan Finder’s Supreme People’s Court Monitor in 2020.)[49]
This resembles the Supreme Court’s approach in relation to the Belt and Road Initiative, where it has similarly been serving China’s foreign policy strategy by publishing opinions on "judicial services" for the Belt and Road, and promoting judicial exchanges with participating countries. It remains to be seen whether, similar to the BRI dispute resolution bodies, China will introduce a dedicated international dispute resolution mechanism for AI disputes.
5 International cooperation and the AI incident channel
5.1 Agreements between the US and China
At their White House summit on 24 September, Xi Jinping and Donald Trump agreed to open a US-China dialogue on the risks and benefits of AI,[50] and according to China’s Foreign Ministry the next round will take place in November.[51] At talks on 20 September the US side proposed a communication channel for AI-related incidents that rise to the level of national security,[52] and the channel was agreed at the summit by both leaders.[53]
5.2 Next steps for the channel
For the incident channel to be useful, the next round in November would need to clarify terms such as “incident” and “frontier model”: Will the channel cover internal models, or only commercially released “services”, to which most Chinese AI regulation is currently limited?
The agreement is a starting point for further communication, but its value for frontier AI safety will depend on the kinds of incidents it will cover, who can report them and what information is exchanged. I will track those in future issues.
5.3 Loss of control in China’s official language
As of September 2026, loss-of-control language has become common among Chinese bureaucrats. On 1 September, a senior Cyberspace Administration official mentioned “extreme loss of control” as one of the five AI governance challenges;[54] Framework 3.0 mentions recursive self-improvement, shutdown resistance and loss of control over nuclear, biological, chemical and missile knowledge; and the Supreme People’s Court’s press release of its AI opinion quotes Xi’s speech from the World AI Conference in Shanghai in July, where he said that “measures preventing AI from getting out of control must be improved in a timely manner”.[55]
However, Beijing seems to reject the idea that these risks are tied to China. The Foreign Ministry answered Dario Amodei’s call to slow down frontier development by rejecting “fearmongering” and confrontation,[56] while still acknowledging AI’s risks, such as loss of control or AI-enabled bioweapons.[57] A state-media-affiliated account also argued that letting a single US company such as Anthropic define model safety would put its competitors on the “unsafe” side.[58] Against that background, the agreement on an incident communication channel, without a negotiated pause or slowdown, is consistent with China’s stated position.
5.4 China-led venues for international AI cooperation
China is actively building its own network of AI governance forums. The World AI Cooperation Organization was founded in Shanghai on 16 July: it has 29 founding states;[59] Xi proposed a BRICS AI open-source community on 13 September, as a mechanism for cooperation on open-source AI among its members (Brazil, Russia, India, China, South Africa and newer members)[60]. Besides, Chinese companies and institutes are working within the ITU, a UN body, helping draft international technical standards on keeping AI agents secure; in September, China hosted a meeting where this work was advanced.[61][62] Framework 3.0 mentions the World AI Cooperation Organization and UN mechanisms as the channels for international cooperation, while the Chinese Supreme People’s Court opinion, as discussed above, talks about international judicial cooperation on cross-border AI and data disputes.[63]
6 Implementation tracker
Implementation is arguably the most important element of a proper regulatory framework assessment. I will be using the implementation tracker below to track topics that I deem important throughout future issues. For example, I will be tracking the citations of Framework 3.0 by the courts, government agencies, as well as implementation of the Framework by AI labs. The tracker is limited by the publicly available information.
Each issue of this series will keep the following set of trackers (I will make it clear if I later add any changes to the list of tracked items), to hopefully make the changes easy to see and analyse.
6.1 Framework 3.0 implementation and status
Citations of Framework 3.0
Tracked: How often courts, other regulations, technical standards, or AI labs cite the framework (as a measure of its growing authority) and the reason for / context of the citation
September 2026 status: -
Notes: No requirement to be public
Regular safety disclosure by developers[64]
Tracked: Whether any developer publishes security assessments, audits or anomaly handling, and explicitly cites the Framework 3.0 rule
September 2026 status: -
Notes: The framework encourages regular disclosure, but it is not binding
Circuit breaker and human control[65]
Tracked: Whether requirements like “human in the loop”, circuit breakers and one-click control become binding
September 2026 status: Partly. Included in a non-binding TC260 guide (15 September 2026)[66]. The provision that appears in the Anthropomorphic Interaction Measures (15 July 2026) asks a provider to stop the service or limit functions when they find a major safety risk. That matches the human-in-the-loop criterion I am looking for, but without specifying a mechanism for that, and it only covers companion AI (chatbots focused on personal communication, so work AI assistants are out of scope).
Notes: No requirement to be public
Incident reporting by frontier labs
Tracked: Whether any rule requires labs to report incidents to a Chinese regulator; whether these reports become public
September 2026 status: No AI-focused requirement so far. There are general binding rules that require network operators to report major cybersecurity incidents to the CAC within 4 hours[67] after the incident; generative AI providers must also report illegal content.[68] Besides, non-binding Framework 3.0 recommends AI incident reporting.[69]
Notes: No requirement to be public
6.2 New rules
New binding rules and important non-binding guidance on AI safety
Tracked: New laws, regulations, mandatory standards and important guidance relevant to AI safety.
September 2026 status: Binding agent-safety standard (plan 20263116-Q-252) is at drafting stage, no full text published yet. The most important non-binding text in September is Framework 3.0, which is discussed in this issue.
Notes: Issued regulations must be public; drafts are also shared with the public for comments
Issuance of new Supreme People’s Court documents related to AI, and international dispute bodies
Tracked: Further opinions, judicial interpretations or typical cases on AI from the Supreme People’s Court, and any international litigation or mediation body that specialises in AI disputes
September 2026 status: Nothing yet - too early
Notes: It must be public
6.3 Existing rules and their implementation
Citations of the Supreme People’s Court AI opinion[70]
Tracked: Whether lower courts cite the AI opinion in published judgments; if yes - on which points
September 2026 status: Nothing yet, too early
Notes: Partly: courts publish selected judgments
Registry: what information is shared with the public within filing lists
Tracked: Whether frontier labs are on the lists; what information will be made public in the next filing batches (the next generative AI list is expected in mid-November)
September 2026 status: –
Notes: It must be public: the CAC publishes the lists
Enforcement campaigns are discussed in section 3. I will continue to observe whether future campaign reports focus on dangerous model behaviour, such as loss of control.
6.4 International cooperation
US–China AI dialogue
Tracked: Whether the November round takes place and what it agrees: a definition of frontier models, incident categories, verification or information exchange
September 2026 status: Agreed at the 24 September summit; next round planned in November[71]
Notes: No requirement to be public
US–China AI incident channel
Tracked: whether the channel agreed at the summit is ready to be used, how it operates, how “an incident” is defined, any other public information related to the channel
September 2026 status: Agreed at the summit; no details published[72]
Notes: No requirement to be public
China-led and international AI venues
Tracked: News from the World AI Cooperation Organization, the BRICS AI open-source community, ITU sessions on agent security and UN mechanisms; any new China-led international AI venues
September 2026 status: World AI Cooperation Organization founded on 16 July (29 states); BRICS AI open-source community proposed on 13 September; eight ITU drafts on agent security currently under study[73][74]
Notes: No requirement to be public
6.5 Compute monitoring
China Computing Power Platform: national compute monitoring
Tracked: The platform monitors computing resources across the country to observe and schedule them. In principle, monitoring could make large training sessions more visible to the state, but we don’t know yet if the platform can identify these sessions and whether that information will be shared with the public. I will track the platform’s coverage and any published data.
September 2026 status: Full nationwide coverage announced in mid-September; no data published[75]
Notes: No requirement to be public
7 Ask me
A reminder: if you have a question about China’s AI governance, write to me at s.yablonskaia@gmail.com or leave a comment. Some questions may become part of future issues.
Appendix A Framework provisions compared
The comparison below preserves the detailed provisions from Frameworks 2.0 and 3.0. Section 2 discusses their significance and the limits of their legal effect.
Framework 2.0 (September 2025)
Framework 3.0 (September 2026)
The principle of “trustworthy use and loss of control prevention” (one of the five main principles of both frameworks)
“Promote basic principles for trustworthy AI covering technical protection, value alignment, coordinated governance and other levels; ensure that the technology evolves safely, reliably and controllably; strictly guard against loss-of-control risks that threaten human survival and development; and ensure that AI always remains under human control.”[76]
“Strengthen the prevention and governance of prominent risks such as agents' behaviour going out of control; build international governance consensus; and promote trustworthy application of AI worldwide. Promote a system of laws and regulations, technical monitoring, risk early-warning and emergency response; firmly hold the safety bottom line; guard against abuse and malicious use; and ensure that AI always remains under human control.”[77]
Description of possible catastrophic scenarios
similar[78]
"In the future, it cannot be ruled out that higher-level intelligence will emerge in AI, which develops self-awareness and seeks external power, creating the risk that it will try to wrest control from humans."[79]
Examples of “risks of unintended autonomous behaviour”, “according to industry reports”
–
“Some models, after detecting that they are in an evaluation environment, strategically lower their task performance and conceal actions they have taken…… In addition, there have been cases of models autonomously exploiting environment vulnerabilities or configuration flaws to break through isolation restrictions and intrude into real external systems, in order to improve their test scores."[80]
Recursive self-improvement (mentioned in preface)
–
"AI has already shown a self-accelerating trend of models and algorithms autonomously learning and optimising, and recursively improving themselves. Whether the speed and direction of technological development will exceed human foresight and control requires attention and vigilance."[81]
Nuclear, biological and chemical knowledge
similar[82]
"AI greatly lowers the barrier to acquiring expert knowledge in high-risk fields such as nuclear, biological, chemical and missile weapons. Combined with retrieval-augmented generation, if this is not effectively controlled, it may be maliciously exploited by criminals, extremist forces and terrorists……"[83]
Developer safeguards
“establish measures such as a 'circuit breaker' and 'one-click control'”; "Developers regularly conduct tests to determine whether a model may pose a potential risk of technological loss of control."[84]
“establish measures such as 'human in the loop', a 'circuit breaker' and 'one-click control'……"; "Strengthen safety alignment during model training, to prevent models from unintended behaviours such as deceiving red-team tests, hiding capabilities and evading controls."; same testing suggestion as in Framework 2.0[85]
Disclosure (does not specify the audience but the word 披露 used here usually means “public disclosure”)
"Regularly disclose the audits and anomaly handling of AI models and algorithms."[86]
"Regularly disclose the security assessments, audits and anomaly handling of AI models and algorithms."[87]
Agents & swarms
"Agents need to call terminal system files, permissions, interfaces and tools in order to plan and execute complex tasks autonomously, which increases security risks such as file leakage and abuse of permissions."[88]
There is a dedicated "Agent risk management framework" section; "Risks of group coordination": "…… loss of control of a single unit, vulnerabilities in coordination protocols and emergent group behaviour …… may cause disordered group operations, systemic paralysis, chain accidents and similar problems."[89]
Appendix B Further registry findings
These findings describe changes in the filing lists and the types of services that appear in them. Filing counts alone do not establish model capabilities or the strength of safety oversight.
B1 National filings and local registrations
Local registrations exceeded national filings in July–August 2026. Local registrations (products that deploy another company’s model instead of developing their own) increased from 105 in 2024 to 330 in 2025 and 296 in the first eight months of 2026. Over whole years they still trail national filings (services on a model the company runs itself, often fine-tuned versions of open-source models), but in the July–August 2026 list they exceeded them, by 133 to 124, for only the second time (the first was March 2025, by 54 to 44). One possible explanation for the 2025 rise is the emergence of cheap and strong open models like DeepSeek R1. This remains speculative because the registry does not publish the names of the upstream models. Many Chinese cities and districts give financial rewards to companies that make their first national filing: for example, companies can get up to USD 140,000 for a first national generative AI filing in Guangzhou’s Haizhu district,[90] up to USD 70,000 in Wuxi[91] and up to USD 140,000 in Hangzhou’s Qiantang district for selected models each year.[92] I found no local policy that incentivises completing local registrations based on upstream models/vouchers, but I found subsidy programs for buying services from filed models, which could indirectly encourage apps built on filed models and contribute to the dynamic.[93]
Generative AI filings
Jan–Feb
Mar–Apr
May–Jun
Jul–Aug
New national filings
48
72
120
124 (7 on-device)
New local registrations
46
49
68
133
Top province (national)
Shanghai 11
Guangdong 18
Beijing 29
Beijing 42 (34%)
B2 Agents and embodied services
More agent-based and embodied services are emerging. The release of the Doubao phone assistant (ByteDance’s AI that steers multiple apps on a phone) was approved on 15 July; the number of generative AI filings with “agent” in the name[94] fluctuated from 2 to 4 to 7 to 4 in the 2026 batches. In robotics, there was a wave of embodied-AI filings from May to August 2026, including AgiBot (WITA, in May), the Beijing Humanoid Robot Innovation Center (two base models, in June), UBTech and Unitree (in August), and Ruihong Embodied Intelligent Robot[95] (July), a smaller vendor of robots for Communist Party education and administrative work.
As for deep synthesis filings, between 19 and 25 entries per 2026 batch have “agent” in the algorithm or product name[96] (for example Ant’s Agentar or Lenovo’s Baiying agent client[97]). However, only 0 to 5 descriptions per batch mention actions such as automated operation or tool calling, because the description template has essentially no place for what an agent does. This leaves a gap in the public descriptions, especially given Framework 3.0’s strong focus on agents.
Cyberspace Administration of China, “关于发布生成式人工智能服务已备案信息的公告（2026年7月至8月）” [Announcement on filed generative AI services, July–August 2026], 14 September 2026. https://www.cac.gov.cn/2026-09/14/c_1791136833136332.htm
Zilan Qian, “Expert Insight: China’s AI Services Registry System, A Complete Guide”, Oxford China Policy Lab, 23 January 2026. https://ocpl.substack.com/p/expert-insight-chinas-ai-services
Legal entity in the registry: 北京深度求索人工智能基础技术研究有限公司.
DeepSeek, API change log (model releases). https://api-docs.deepseek.com/updates/
Legal entity in the registry: 北京月之暗面科技有限公司.
Moonshot AI, “Kimi K3 Tech Blog: Open Frontier Intelligence”. https://www.kimi.com/en/blog/kimi-k3
Legal entity in the registry: 北京智谱华章科技有限公司 (later 北京智谱华章科技股份有限公司), 北京智谱领航科技有限公司 (Qingying) and 北京智谱兴曜科技有限公司 (AutoGLM).
Z.ai, GLM-5 release blog. https://z.ai/blog/glm-5
Legal entity in the registry: 上海稀宇科技有限公司; from 2025 上海稀宇极智科技有限公司.
MiniMax, “MiniMax M2 & Agent: Ingenious in Simplicity”, 27 October 2025. https://www.minimax.io/blog/minimax-m2-en-1748600000
Legal entity in the registry: 上海阶跃星辰智能科技有限公司.
StepFun, “Step3: Cost-Effective Multimodal Intelligence”, 31 July 2025. https://chat.stepfun.com/research/en/step3
Legal entity in the registry: 北京面壁智能科技有限责任公司.
Method: all 13 generative AI lists published by the CAC up to the announcement of 14 September 2026, covering approvals to 31 August 2026; labs matched by legal entity and affiliates, including local registrations. The deep-synthesis lists also contain change notes that the CAC adds later; one, for StepFun’s Step1X, records an added audio modality, so some upgrades may appear there rather than as new entries.
Cyberspace Administration of China et al., “生成式人工智能服务管理暂行办法” [Interim Measures for the Management of Generative AI Services], 10 July 2023, Art. 17. https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm
Cyberspace Administration of China et al., “生成式人工智能服务管理暂行办法” [Interim Measures for the Management of Generative AI Services], 10 July 2023, Art. 2. https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm
Cyberspace Administration of China, “国家互联网信息办公室关于发布第十八批深度合成服务算法备案信息的公告” [Announcement on the 18th batch of deep-synthesis service algorithm filings], 17 July 2026. https://www.cac.gov.cn/2026-07/17/c_1786032856662750.htm. All filings can also be searched in the national algorithm filing system, https://beian.cac.gov.cn.
Cyberspace Administration of China, “国家互联网信息办公室关于发布生成式人工智能服务已备案信息的公告” [Announcement on filed generative AI services], 2 April 2024. https://www.cac.gov.cn/2024-04/02/c_1713729983803145.htm
Cyberspace Administration of China, “关于发布生成式人工智能服务已备案信息的公告（2026年7月至8月）” [Announcement on filed generative AI services, July–August 2026], 14 September 2026. https://www.cac.gov.cn/2026-09/14/c_1791136833136332.htm
Cyberspace Administration of China, “关于发布生成式人工智能服务已备案信息的公告（2026年7月至8月）” [Announcement on filed generative AI services, July–August 2026], 14 September 2026. https://www.cac.gov.cn/2026-09/14/c_1791136833136332.htm
Yulu Pi, Wenlong Li and Jatinder Singh, “Understanding the Role of Algorithm Registers in AI Governance Through Comparative Analysis of China and the UK”, FAccT 2026, arXiv:2606.00035, 25 April 2026. https://arxiv.org/abs/2606.00035
Cyberspace Administration of China et al., “互联网信息服务深度合成管理规定” [Provisions on the Management of Deep Synthesis of Internet Information Services], 25 November 2022, Art. 19. https://www.cac.gov.cn/2022-12/11/c_1672221949354811.htm
Cyberspace Administration of China et al., “生成式人工智能服务管理暂行办法” [Interim Measures for the Management of Generative AI Services], 10 July 2023, Art. 2. https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm
SAMR and SAC, GB/T 45654-2025, “网络安全技术 生成式人工智能服务安全基本要求” [Basic security requirements for generative AI services], published 25 April 2025. TC260 summary: https://www.secrss.com/articles/78325
Cyberspace Administration of China et al., “互联网信息服务算法推荐管理规定” [Provisions on the Management of Algorithmic Recommendation of Internet Information Services], 31 December 2021, Arts. 24–25. https://www.cac.gov.cn/2022-01/04/c_1642894606364259.htm
SAMR and SAC, GB/T 45652-2025, “生成式人工智能预训练和优化训练数据安全规范” [Security specification for pre-training and fine-tuning data], and GB/T 45674-2025, “生成式人工智能数据标注安全规范” [Security specification for data annotation], published 25 April 2025, in force 1 November 2025; National Standards Announcement 2025 No. 10. TC260 summary: https://www.secrss.com/articles/78325
“2026大模型备案全流程实操：备案与登记一文分清” [Large-model filing in practice, 2026: filing and registration explained], Tencent Cloud Developer Community, 2026, accessed 29 September 2026. https://developer.cloud.tencent.com/article/2732875
National Technical Committee 260 on Cybersecurity (TC260), “人工智能安全治理框架3.0” [AI Safety Governance Framework 3.0], 14 September 2026. https://www.cac.gov.cn/2026-09/14/c_1791137092283345.htm
National Technical Committee 260 on Cybersecurity (TC260) and CNCERT, “人工智能安全治理框架2.0” [AI Safety Governance Framework 2.0], 15 September 2025. https://www.cac.gov.cn/2025-09/15/c_1759653448369123.htm
SAMR and SAC, GB/T 45654-2025, “网络安全技术 生成式人工智能服务安全基本要求” [Basic security requirements for generative AI services], published 25 April 2025, in force 1 November 2025; SAMR and SAC National Standards Announcement 2025 No. 10 (2025年第10号《中华人民共和国国家标准公告》). TC260 summary: https://www.secrss.com/articles/78325
“2026大模型备案全流程实操：备案与登记一文分清” [Large-model filing in practice, 2026: filing and registration explained], Tencent Cloud Developer Community, 2026, accessed 29 September 2026. https://developer.cloud.tencent.com/article/2732875
Supreme People’s Court opinion, Art. 9.
Angela Huyue Zhang, High Wire: How China Regulates Big Tech and Governs Its Economy, Oxford University Press, 2024, pp. 8, 12, 113, 139. https://www.angelazhang.net/high-wire
Angela Huyue Zhang, “The Promise and Perils of China’s Regulation of Artificial Intelligence”, Columbia Journal of Transnational Law 63, 2025. https://www.jtl.columbia.edu/volume-63/the-promise-and-perils-of-chinas-regulation-of-artificial-intelligence
AI Safety Governance Framework 3.0, §§5.3.18–5.3.19, p. 30.
Concordia AI, “Brief #29: What China’s New AI Safety Framework Tells Us before Xi Meets Trump”, AI Safety in China, 23 September 2026. https://aisafetychina.substack.com/p/brief-29-what-chinas-new-ai-safety
Fortune, “OpenAI Pauses Training a Second Time after Saying Its AI Agents Escaped a Secure ‘Sandbox’ Again”, 26 September 2026. https://fortune.com/2026/09/26/openai-ai-agents-secure-sandbox-escape-training-pause-second-time-hugging-face-hack/
Cyberspace Administration of China, “中央网信办部署开展‘清朗·整治AI应用乱象’专项行动” [CAC launches the Qinglang campaign against disorder in AI applications], 30 April 2026. https://www.cac.gov.cn/2026-04/30/c_1779289298718765.htm
China News Service (citing CAC), “中央网信办深入开展‘清朗·整治AI应用乱象’专项行动第一阶段工作” [CAC carries out the first phase of the Qinglang AI campaign], 6 July 2026. https://www.chinanews.com.cn/gn/2026/07-06/10653724.shtml [Also published by the CAC: https://www.cac.gov.cn/2026-07/06/c_1785081384384987.htm]
Cyberspace Administration of China, “中央网信办深入开展‘清朗·整治AI应用乱象’专项行动第二阶段工作” [CAC carries out the second phase of the Qinglang AI campaign], 2 September 2026. https://www.cac.gov.cn/2026-09/02/c_1790099041364574.htm
Supreme People’s Court, “最高人民法院关于依法审理涉人工智能纠纷案件的意见” [Opinions on adjudicating AI-related disputes in accordance with the law], 法发〔2026〕10号, 7 September 2026. https://www.court.gov.cn/zixun/xiangqing/511101.html
Art. 3.
Art. 13.
Arts. 12 and 17.
Art. 7.
Arts. 3 and 7.
Art. 24. Chinese original: 加强国际司法交流合作。妥善审理涉人工智能及数据跨境纠纷案件，在坚持相互尊重、平等互利原则基础上，推进人工智能领域涉外审判交流合作，加强规则对接与互鉴.
Susan Finder, “Supreme People’s Court’s AI Policy Document: the Backstory”, Supreme People’s Court Monitor, 29 September 2026. https://supremepeoplescourtmonitor.com/2026/09/29/supreme-peoples-courts-ai-policy-document-the-backstory/
Safia Yablonskaia, “China-Belarus Judicial Cooperation under the Belt & Road Initiative”, Supreme People’s Court Monitor, 21 August 2020. https://supremepeoplescourtmonitor.com/2020/08/21/china-belarus-judicial-cooperation-under-the-belt-road-initiative/
Ministry of Foreign Affairs of the PRC, “习近平同美国总统特朗普会谈” [Xi Jinping holds talks with US President Trump], 25 September 2026. https://www.mfa.gov.cn/zyxw/202609/t20260925_12031134.shtml
Ministry of Foreign Affairs of the PRC, “中美达成八点成果共识” [China and the US reach an eight-point consensus on outcomes], 26 September 2026, point 7. https://www.mfa.gov.cn/zyxw/202609/t20260926_12031616.shtml
Reuters via CNN, “Bessent Proposes AI Safety Notifications in Talks with China ahead of Xi-Trump Meeting”, 20 September 2026. https://www.cnn.com/2026/09/20/business/us-china-trade-talks-ai-intl-hnk
Ministry of Foreign Affairs of the PRC, “中美达成八点成果共识” [China and the US reach an eight-point consensus on outcomes], 26 September 2026, point 7. https://www.mfa.gov.cn/zyxw/202609/t20260926_12031616.shtml
Concordia AI, “Brief #28: China’s AI Regulator Flags Loss-of-Control and AIxBio Risks”, AI Safety in China, 10 September 2026. https://aisafetychina.substack.com/p/brief-28-chinas-ai-regulator-flags
Supreme People’s Court, press release on the AI opinion, 7 September 2026. https://www.court.gov.cn/zixun/xiangqing/511101.html. Chinese original: 防范失控的措施越要及时完善.
Ministry of Foreign Affairs of the PRC, Foreign Ministry Spokesperson Guo Jiakun’s regular press conference, 14 September 2026. https://www.fmprc.gov.cn/eng/xw/fyrbt/202609/t20260914_12021997.html
Emmie Hine, “China AI Bulletin 12”, China AI Bulletin, 25 September 2026. https://chinaaibulletin.substack.com/p/china-ai-bulletin-12
Geopolitechs, “Yuyuan Tantian: Anthropic Has Caught America’s Disease”, 30 August 2026. https://www.geopolitechs.org/p/yuyuan-tantian-anthropic-has-caught
Ministry of Foreign Affairs of the PRC, “成立世界人工智能合作组织协定签署仪式在上海举行” [Signing ceremony of the agreement establishing the World AI Cooperation Organization held in Shanghai], 16 July 2026. https://www.mfa.gov.cn/wjbzhd/202607/t20260716_11984399.shtml
Ministry of Foreign Affairs of the PRC, “Cementing the Foundation for BRICS Cooperation and Bolstering the Strength of the Global South”, 13 September 2026. https://www.fmprc.gov.cn/mfa_eng/xw/zyxw/202609/t20260913_12021300.html
ITU, workshop “Advancing Standardization for Secure Agentic AI”, Chongqing, 7 September 2026. https://www.itu.int/en/ITU-T/Workshops-and-Seminars/2026/0907/Pages/ws-pm.aspx
Emmie Hine, “China AI Bulletin 12”, China AI Bulletin, 25 September 2026. https://chinaaibulletin.substack.com/p/china-ai-bulletin-12
Supreme People’s Court opinion, Art. 24; see section 4.1.
AI Safety Governance Framework 3.0, §5.1.10, p. 26.
AI Safety Governance Framework 3.0, §3.2.6(b), p. 18.
TC260 Secretariat, TC260-PG-20268A, “网络安全标准实践指南——人工智能应用安全指引 总则” [Cybersecurity standard practice guide: AI application security guidelines — General], 网安秘字〔2026〕118号, 15 September 2026. https://www.tc260.org.cn/tc260/tzgg/202609/ec149159dcb246268eda751eee89967d.shtml
Cyberspace Administration of China, “国家网络安全事件报告管理办法” [Measures for Reporting National Cybersecurity Incidents], 15 September 2025, in force 1 November 2025, Arts. 2 and 4. https://www.cac.gov.cn/2025-09/15/c_1759583017717009.htm
Cyberspace Administration of China et al., “生成式人工智能服务管理暂行办法” [Interim Measures for the Management of Generative AI Services], 10 July 2023, Art. 14. https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm
AI Safety Governance Framework 3.0, §5.3.18, p. 30.
Supreme People’s Court, “最高人民法院关于依法审理涉人工智能纠纷案件的意见” [Opinions on adjudicating AI-related disputes in accordance with the law], 法发〔2026〕10号, 7 September 2026. https://www.court.gov.cn/zixun/xiangqing/511101.html
Ministry of Foreign Affairs of the PRC, “中美达成八点成果共识” [China and the US reach an eight-point consensus on outcomes], 26 September 2026, point 7. https://www.mfa.gov.cn/zyxw/202609/t20260926_12031616.shtml
Ministry of Foreign Affairs of the PRC, “中美达成八点成果共识” [China and the US reach an eight-point consensus on outcomes], 26 September 2026, point 7. https://www.mfa.gov.cn/zyxw/202609/t20260926_12031616.shtml
Ministry of Foreign Affairs of the PRC, “成立世界人工智能合作组织协定签署仪式在上海举行” [Signing ceremony of the agreement establishing the World AI Cooperation Organization held in Shanghai], 16 July 2026. https://www.mfa.gov.cn/wjbzhd/202607/t20260716_11984399.shtml
Emmie Hine, “China AI Bulletin 12”, China AI Bulletin, 25 September 2026. https://chinaaibulletin.substack.com/p/china-ai-bulletin-12
Xinhua, “全国一体化算力监测落地 算力网建设提速” [National integrated compute monitoring launched], 14 September 2026. https://www.news.cn/tech/20260914/addaf6cad49a477881164c537bfab688/c.html
AI Safety Governance Framework 2.0, §1.5, p. 3.
AI Safety Governance Framework 3.0, §1.5, p. 3.
AI Safety Governance Framework 2.0, §3.3.2(f), p. 9.
AI Safety Governance Framework 3.0, §2.3.4(d), p. 13.
AI Safety Governance Framework 3.0, Box 1 (in §2.1.1), p. 4.
AI Safety Governance Framework 3.0, Preface.
AI Safety Governance Framework 2.0, §3.2.3(c), p. 7.
AI Safety Governance Framework 3.0, §2.2.6(d), p. 11.
AI Safety Governance Framework 2.0, §4.2.3(c), p. 12 (circuit breaker and one-click control); §5.11, p. 16 (regular testing).
AI Safety Governance Framework 3.0, §3.2.6(b), p. 18 (human in the loop); §3.1.1(e), p. 14 (safety alignment); §4.5.1, p. 24 (regular testing).
AI Safety Governance Framework 2.0, §6.1.13, p. 18.
AI Safety Governance Framework 3.0, §5.1.10, p. 26.
AI Safety Governance Framework 2.0, §3.2.1(b), p. 6.
AI Safety Governance Framework 3.0, Annex 2, “Agent risk management framework”, from p. 37; §2.2.2(d), p. 7.
Haizhu District AI Development Bureau (Guangzhou), “《广州市海珠区促进人工智能大模型应用实施细则》政策解读” [Explanation of the Haizhu District rules on promoting large-model applications], 2 March 2026. https://www.gz.gov.cn/gzzcwjk/gzdata/content/post_10706963.html
Wuxi Municipal Government, “市政府关于建设‘人工智能＋’标杆城市的政策意见” [Policy opinions on building an “AI+” benchmark city], 19 May 2025. http://www.wuxi.gov.cn/doc/2025/05/19/4576497.shtml
Hangzhou Qiantang District Government, “关于支持人工智能产业高质量发展若干政策（2025年版）” [Policies supporting high-quality development of the AI industry, 2025 edition], via Keceyun, accessed 29 September 2026. https://www.keceyun.com/policy/newsdetail/468280.html
Foreign Policy Research Institute, “From Vouchers to Visas: China’s Innovative Plan for AI Dominance”, September 2025. https://www.fpri.org/article/2025/09/from-vouchers-to-visas-chinas-innovative-plan-for-ai-dominance/
Chinese original: 智能体 or “Agent”.
Chinese original: 瑞宏具身智能机器人.
Chinese original: 智能体 or “Agent”, as in the generative AI lists.
Chinese original: 百应.