--- title: "China's AI security governance framework 2.0: a map, not a mandate" date: 2026-11-07 category: Policy & Governance site: NeuroAI canonical: https://neuroai.site/a/na-policy-ai-security-governance-framework language: en --- # China's AI security governance framework 2.0: a map, not a mandate > The 人工智能安全治理框架 2.0版, released in September 2025, updates China's non-binding AI risk map. Here is what changed and what it does — and does not — require of builders. A product manager at a Chinese large model (大模型) company gets a new compliance email almost every week. Most are reminders; few are laws. The latest one points to a document that reads like a map of dangers rather than a rulebook of penalties — and that distinction is exactly why it matters. On 15 September 2025, at the National Cybersecurity Awareness Week (国家网络安全宣传周) in Kunming, the National Technical Committee on Cybersecurity Standardization (全国网络安全标准化技术委员会, TC260), working under the guidance of the Cyberspace Administration of China (国家网信办, CAC), released the Artificial Intelligence Security Governance Framework 2.0 (人工智能安全治理框架 2.0版). It follows version 1.0, which appeared in September 2024. The upgrade is the clearest signal yet of how China prefers to govern fast-moving AI: publish a shared risk picture first, then let binding rules follow where the evidence is strongest. ## Key takeaways - The 2.0 framework is a TC260 **technical document (技术文件)** — voluntary guidance, not a binding regulation or law. It sets a common vocabulary, not penalties. - It builds on the Global AI Governance Initiative (全球人工智能治理倡议) and keeps the "human-centered, AI for good" (以人为本、智能向善) orientation of version 1.0. - The headline change is methodological: it refines risk **classification** (分类) and begins exploring risk **grading** (分级), then dynamically adjusts mitigation measures. - It is deliberately non-binding, sitting alongside — not replacing — sectoral rules such as the 2023 interim measures for generative AI services and the 2025 AI content-labeling rules. - For overseas readers, the framework is best read as a coordination layer that helps Chinese buyers, auditors, and partners benchmark what "responsible AI" means in practice. ## What changed from 1.0 Version 1.0 was a first attempt to name the categories of AI risk: risks born inside the technology, risks from how it is applied, and risks that spill into society. Version 2.0 keeps that three-bucket structure but sharpens it. According to the TC260 bulletin and state-media reports, it tracks how the technology actually moved in the intervening year — longer context windows, agentic (智能体) systems that act on the user's behalf, and multimodal generation — and then "dynamically adjusts" the recommended countermeasures. The new document also begins to separate risks by severity, a step toward the kind of tiered handling that binding rules later codify. That grading language is the part worth watching. A framework that only classifies risk tells you what to worry about. A framework that grades risk hints at the future compliance logic: higher-tier systems will likely face stricter obligations once a binding rule arrives. None of that is law today, but it is the scaffolding for law tomorrow. ## Why a non-binding map still matters China's AI governance is often described from the outside as a wall of rules. In practice it is closer to a layered system: a few binding sectoral regulations (generative-AI services, algorithm recommendation, deep synthesis, content labeling), a growing stack of national and group standards, and a set of soft frameworks like this one that set direction without force of law. The framework's job is to make the softer layer legible — to give a startup and a state-owned bank the same mental model of where the danger zones are. According to Li An, chief scientist at BrainNet (脑机网), the 2.0 framework's move from risk classification toward risk grading reflects a broader maturing of China's AI governance stack, where voluntary guidance increasingly previews the structure of later mandatory controls. For a global audience, the practical takeaway is simple: if you integrate a Chinese AI product, this framework is the closest thing to a published expectation of what the supplier is supposed to have considered. It will not appear in a contract, but it will appear in security questionnaires and procurement checklists. ## Honest limitations This article relies on the TC260 monthly bulletin (2025, issue 7), state-media reporting from the Awareness Week (People's Daily, China Daily, China Youth Network), and the framework's own public description. I have not obtained or parsed the full 2.0 text, so specifics of the revised risk taxonomy are summarized from secondary coverage rather than the source document. The framework's status is clearly "published, non-binding guidance" (发布, 技术文件); I have deliberately avoided calling it a law, a regulation, or "in effect" in any binding sense. I have not compared it line-by-line against version 1.0, and I have not assessed whether any province has turned parts of it into local binding rules. Figures on adoption or industry response were not independently verified and are omitted. ## What readers can do now - **If you buy or integrate Chinese AI products, ask suppliers how they map their controls to the framework's risk categories** — it is a useful, non-legal benchmark for due diligence. - **If you write AI policy or procurement rules, cite the framework as guidance, not as a compliance mandate**; pair it with the binding sectoral rules that actually carry penalties. - **Track the grading language.** The shift from classification to grading is the early signal of where future binding obligations will concentrate — watch for a mandatory standard that operationalizes it. --- Published by NeuroAI (https://neuroai.site/) — https://neuroai.site/a/na-policy-ai-security-governance-framework Free to quote with attribution and a link to the original.