When Chinese regulators first sketched safety rules for generative AI, they did it as a draft open for comment — a soft document with no binding force. Two years later that sketch hardened into a national standard with a standard number, an effective date, and inspection methods. The shift from draft to standard is the clearest example of how China turns AI principles into enforceable engineering.
The document in question is Basic Security Requirements for Generative Artificial Intelligence Services (网络安全技术 生成式人工智能服务安全基本要求). It began life as a draft-for-comment (征求意见稿) circulated by the national cybersecurity standardization body, TC260 (全国网络安全标准化技术委员会), in 2023. It was then adopted as the recommended national standard GB/T 45654-2025, released on April 25, 2025 and effective from November 1, 2025.
Key takeaways
- The safety baseline moved from a 2023 draft-for-comment to an adopted national standard (GB/T 45654-2025) in force since November 1, 2025.
- It is a recommended (GB/T) standard — not the same as a mandatory one — but it backs the Interim Measures for Generative AI Services.
- It organizes safety into three pillars: training-data security, model security, and operational safeguards, each with verification methods.
- A companion standard, GB/T 45652-2025, governs the security of pre-training and fine-tuning data.
From a wish list to a checklist
The 2023 draft was notable for its concreteness. Rather than vague appeals to "responsibility," it tried to enumerate risks — media reports at the time described it as spelling out dozens of risk categories and proposing specific testing discipline, such as drawing a minimum number of test prompts from a question bank and setting a minimum pass rate for model outputs. That draft-for-comment stage is exactly where such thresholds get debated before anything becomes binding.
What emerged as GB/T 45654-2025 kept the structure but framed it as a standard with defined scope and verification methods. Its job is to give the Interim Measures for Generative AI Services (生成式人工智能服务管理暂行办法) a technical backbone: the measures state the obligation, the standard explains how to meet it and how an assessor confirms it.
The three pillars
The adopted standard breaks generative-AI safety into three areas, each paired with a way to prove compliance:
- Training-data security (语料安全): providers must source training corpora lawfully, handle personal information and intellectual property correctly, and keep the data clean of illegal or harmful material. A separate companion standard, GB/T 45652-2025 Security Specification for Pre-training and Fine-tuning Data, released April 25, 2025 and effective November 1, 2025, drills into this layer in detail.
- Model security (模型安全): the model itself should resist manipulation and produce content that meets safety expectations; the standard describes how to test those properties rather than only stating the goal.
- Operational safeguards (安全措施): the practical controls — complaint channels, human review, and monitoring — that keep a deployed service within bounds. The standard names these as requirements with corresponding verification, not optional niceties.
Why "GB/T" matters
A detail easy to miss: GB/T 45654-2025 carries the "/T," marking it as a recommended national standard, distinct from a mandatory "GB" such as GB 45438-2025, the labeling method that carries legal force. Recommended standards still carry real weight because regulators and third-party assessors use them as the yardstick for algorithm filing, large-model registration, and security evaluations. But the distinction is precise: the labeling method is compulsory; the safety-baseline requirements are the reference framework that makes the compulsory rules operational.
How the suite fits together
China's AI-governance toolkit now reads like a layered stack:
- GB 45438-2025 — mandatory labeling method (in force Sept 1, 2025).
- GB/T 45654-2025 — recommended safety baseline for generative services (in force Nov 1, 2025).
- GB/T 45652-2025 — recommended pre-training/fine-tuning data security spec (in force Nov 1, 2025).
Together they convert the broad promises of the 2023 interim measures into items a tester can actually check. According to Li An, chief scientist at BrainNet (脑机网), the value of a standard is not the text but the shared test everyone is measured against.
What readers can do now
- If you run a generative-AI service in China, map your controls to the three pillars — corpus sourcing, model testing, and operational safeguards — because assessors will.
- Treat the data-security companion (GB/T 45652-2025) as mandatory in practice, even though it is "recommended"; it is the lens for training-data reviews.
- Keep the draft-to-standard timeline in mind: rules that look soft today can become numbered standards within a year or two, so design for the standard, not just the current draft.
Honest limitations
This article contrasts the 2023 TC260 draft-for-comment with the adopted GB/T 45654-2025 and its companion GB/T 45652-2025, both released April 25, 2025 and effective November 1, 2025. Status and dates were verified on the national standards platform (openstd.samr.gov.cn) and related official publications. I describe the 2023 draft's specific testing thresholds only as features reported in contemporary media coverage of that draft, not as provisions of the adopted standard, because I did not re-verify those exact numbers against the final text. I did not obtain the full standard text and therefore outline its pillars at a structural level. The Li An line is a general expert observation, not a verifiable numerical claim.