--- title: "China's AI Safety Governance Framework 3.0 pushes risk control into the full stack" date: 2026-10-23 category: Policy & Governance site: NeuroAI canonical: https://neuroai.site/a/na-policy-ai-safety-governance-framework-3 language: en --- # China's AI Safety Governance Framework 3.0 pushes risk control into the full stack > Released at the 2026 National Cyber Security Publicity Week, the AI Safety Governance Framework 3.0 updates risk classification and response measures, extending oversight from model output to data, supply chain, and deployment. An enterprise wires a cloud large model straight into its customer database to "save time," and only finds out later the model logged every prompt and leaked regulated personal information. As AI moved from demo to core business in China during 2025 and 2026, the old playbook — check whether the model's answers look safe — stopped being enough. The danger now lives in the data pipeline, the supply chain, and the deployment boundary. That shift is exactly what the newest version of China's flagship AI risk framework tries to catch. ## From 1.0 to 3.0 The **AI Safety Governance Framework (人工智能安全治理框架)** has become the reference map Chinese regulators and platforms use to think about AI risk. Version **1.0** appeared in September 2024; version **2.0** followed in September 2025. On **14 September 2026**, at the opening of the **2026 National Cyber Security Publicity Week (国家网络安全宣传周)** in Jinan, the **National Technical Committee on Cybersecurity Standardization (全国网络安全标准化技术委员会, TC260)** released **version 3.0**, under the guidance of the **Cyberspace Administration of China (国家互联网信息办公室, CAC)**. It is explicit about lineage: 3.0 implements the **Global AI Governance Initiative (全球人工智能治理倡议)** and keeps the "risk classification, technical response, comprehensive governance (风险分类、技术应对、综合治理)" logic of its predecessors. What changes is scope — the framework now reaches deeper into how AI systems are actually built and run. ## What changed in 3.0 The headline move is treating AI security as a **closed loop across data, model, system, application, and accountability** — not just "is the output safe." Three additions stand out: - **Data security as a precondition.** The framework pushes a "no decryption, no exposure (不解密、不暴露)" baseline for using cloud models in sensitive scenarios. It calls for assessing data-leak, personal-information-leak, and unlawful-collection risks, building a data lifecycle security mechanism, and protecting user-interaction data and retrieval-augmented-generation (RAG) data specifically. - **AI supply-chain security.** It names seven interdependent asset classes — data, model, software, compute, platform, tool, and service — and treats safety as continuous configuration and behavior management rather than one-time acceptance. Any change in source or version can shift the final security state. In practice that means the "enterprise wires a cloud model into its database" failure at the top of this article is no longer a one-off lapse but a named supply-chain risk: the model call, the data channel, and the logging behavior are all separate assets that must be accounted for. - **Application-layer guidance.** Alongside 3.0, TC260 released companion practice guides on **14 September 2026**, including the **General Principles for AI Application Security (人工智能应用安全指引 总则)** and a **Personal-User Safety Guide for Using AI Services (个人用户使用人工智能服务安全指南)**. A further batch of AI application-security guidance documents — covering sectors such as finance, radio and television, and education — had already entered drafting earlier in 2026, signaling that the framework is being turned into sector-specific checklists rather than left as abstract principle. ## Why it matters beyond compliance The framework is **not a law**. It carries no penalties by itself. Its weight comes from a quieter channel: TC260 templates are the drafts that later mandatory standards and platform compliance checks tend to adopt. When 3.0 says data must not leave a controlled boundary, the next procurement spec or security baseline usually says the same thing in binding language. The signal for builders is clear. AI security is no longer a model-output problem solved by a content filter; it is a full-stack problem that starts at the training data and ends at who can call the API. ## Part of a wider 2026 standards surge 3.0 did not appear in a vacuum. In July 2026 TC260 announced **41 new AI national-standard projects (国家标准项目立项)** and convened its AI security working group (WG9) for a third plenary, while a set of AI application-security guidance documents moved into drafting. The pattern is consistent: the framework states the principles, and a pipeline of concrete national standards and practice guides follows to make those principles auditable. For any team operating in China, the practical takeaway is to watch that pipeline, not just the headline framework — the binding obligations tend to land in the standards that cite 3.0, not in 3.0 itself. ## Honest limitations - 3.0 is a **framework / guidance document** released on 14 September 2026, not a binding regulation — it imposes no direct penalties and creates no new licensing regime by itself. - It follows 1.0 (2024) and 2.0 (2025); we did not restate 2.0's five-level risk grading here, as that is covered separately. This article focuses on what 3.0 adds. - The specifics above come from the official release summary and affiliated commentary (People's Daily, TC260's monthly bulletin, CNR). For exact wording, readers should consult the TC260 publication; we have not quoted the full normative text clause by clause. - We have not mapped how each ministry will translate 3.0 into sector rules — that translation is where voluntary guidance becomes operational obligation. ## What readers can do now - If you deploy large models in sensitive Chinese scenarios, adopt a "no decryption, no exposure" data boundary before connecting any cloud model to internal systems. - Build an AI supply-chain inventory across the seven asset classes (data, model, software, compute, platform, tool, service) and treat it as continuous monitoring, not a one-time checkbox. - Use the companion practice guides — the personal-user safety guide and the application-security 总则 — as your baseline checklist when standing up an internal AI service. --- Published by NeuroAI (https://neuroai.site/) — https://neuroai.site/a/na-policy-ai-safety-governance-framework-3 Free to quote with attribution and a link to the original.