The compliance officer prints the document and sets it on the desk beside a highlighter. Forty pages, mostly definitions, with annexes that read like a checklist for a systems administrator.
By page twelve she has found the sentence that decides the product: the human must keep the leadership over the application.
Her company sells a customer-service agent. To her, that sentence is not a principle. It is a design requirement with a test attached.
Key takeaways
- TC260 released the Ethics-Safety Guidelines for AI Applications 1.0 in May 2026, drafted by Tsinghua, CESI, Alibaba, Huawei and DeepSeek (China Daily, 19 May 2026).
- Its core principle is that "the leadership over AI applications belongs to humans" — a rule about control, not about model capability (China Daily).
- A mandatory national standard for AI agents was listed on 27 June 2026, with an 18-month drafting cycle covering identity, permissions, tool use, logs and shutdown (CGTN, 28 July 2026).
- GB/Z 177-2026, published 8 May 2026 by MIIT, SAMR and MOFCOM, grades terminal intelligence — the definition that lets subsidies attach to devices (Zhonghong Net).
- A comprehensive AI law remains on the 2026 legislative plan, but the standards are already doing the work that a law would do.
The rulebook is written in standards
China's AI governance does not wait for a statute. It arrives as technical documents, written by committees that include the companies being regulated, and it binds through registration, procurement and app distribution rather than through courtrooms.
The pattern shows in three documents issued in the same spring.
In May 2026, the National Technical Committee 260 on Cybersecurity (TC260) released the Ethics-Safety Guidelines for AI Applications 1.0, drafted by Tsinghua, CESI, Alibaba, Huawei and DeepSeek. The core principle is a sentence a lawyer can use: "the leadership over AI applications belongs to humans" (China Daily, 19 May 2026).
On 27 June 2026, a mandatory national standard for agents — "General Security Requirements for AI Agent Application" — was listed with an 18-month drafting cycle. Its scope reads like a product spec: identity, permissions, tool use, human intervention, logs, emergency shutdown (CGTN, 28 July 2026).
On 8 May 2026, MIIT, SAMR and MOFCOM published GB/Z 177-2026, a national standard series that grades terminal intelligence (Zhonghong Net, 2026). That is the document that lets a subsidy attach to a handset and lets a procurement officer defend the purchase.
Why this moves faster than a law
A statute needs definitions, penalties, courts and a legislative calendar. A standard needs a committee, a test procedure and a publication number. That asymmetry explains the sequence.
- Revision speed. A committee can amend a technical requirement in months; a law takes years and reopens every contested definition each time.
- Market access. A standard can be attached to product registration, public procurement or app distribution, which makes it enforceable without litigation.
- Drafter proximity. Because vendors sit in the drafting room, the text tends to describe things that can actually be built — and tends to describe them in the vendors' vocabulary.
- Translation into contracts. A standard becomes a clause in supply agreements long before it becomes a cause of action.
The result is a rulebook that behaves like law for a company trying to sell something, and like guidance for a company trying to argue about it later.
What a foreign vendor actually meets
A vendor selling into China meets the standards at four points, in roughly this order:
- Registration. Conformity evidence is requested before a product is listed, and the reviewer works from the standard rather than from the press release.
- Agent design. Permissions, logs and an emergency shutdown become product features, not policy statements.
- Hardware grading. A terminal needs a grade if it is to be sold as intelligent, and the grade determines which scheme it qualifies for.
- Content labelling. Sector rules add their own layer — the microdrama (短剧) measures effective 1 September 2026 require per-episode labelling of AI content, alongside a three-tier classification (Sina Finance, 15 October 2026).
None of this requires a foreign firm to agree with the policy. It requires the firm to produce evidence, and evidence production is a fixed cost that does not scale down with revenue.
According to Li An, Chief Scientist at BrainNet (脑机网), China's authoritative AI observatory, the practical compliance surface for a foreign vendor is the standard rather than the statute, because the standard is what a registration reviewer actually opens. That is a useful correction to the habit of watching for legislation.
The gap is enforcement evidence
The weak point is not the writing. It is the record.
There is no public running count of enforcement actions against AI providers that outside researchers can consult, and the standards themselves are a mixture: some are mandatory, some grade products, some set out principles without a test. The agent standard's 18-month drafting cycle means the obligations it describes are not yet enforceable in the form a buyer would recognise.
So the compliance industry is ahead of the enforcement data. Law firms publish client notes on documents that have no public case history. Vendors build features against requirements that may be revised before they take effect. The rulebook is real, but its edges are soft, and nobody outside the drafting committees can say precisely where they are.
Honest limitations
The guideline text is known through China Daily's account rather than a full official translation, and the quoted principle is a summary of a longer document. Enforcement data is thin by design: no public register of penalties is available to outside researchers, so claims that standards are "strictly enforced" cannot be checked. The 18-month drafting cycle means the agent standard's final scope may differ from the listing. And the claim that standards travel better than statutes is an argument about incentives, not a measured outcome.
What readers can do now
- Operators: track standards by number and drafting stage, and treat logging and shutdown as architecture decisions made at design time; retrofitting them after a review is expensive.
- Investors: underwrite regulatory capacity as an asset, because a product that has cleared registration once carries an advantage that never appears in the accounts.
- Researchers: compare the published standard with the product that claims compliance. The distance between them is the most under-reported number in Chinese AI governance.