A startup shipping a Chinese-language assistant wonders what "safe enough" means on paper. Its engineers can tune a model, but they cannot point to a single document that says which boxes to tick before launch. A draft standard is trying to fill that gap — and that is the point: it is a draft, not a rule.
Where the draft stands
The document is the national standard (标准) Cybersecurity Technology — Basic Security Requirements for Generative AI Services (《网络安全技术 生成式人工智能服务安全基本要求》). It was circulated as a draft for comment (征求意见稿) by the National Technical Committee 260 on Cybersecurity of Standardization (TC260) in May 2024, with public comments requested by 22 July 2024.
Crucially, this is a draft-for-comment (征求意见稿) stage. It is not a formally-passed mandatory rule and is not in effect as a binding standard as of this writing. Its value today is as a detailed signal of where expectations are heading, not as an obligation a regulator will enforce. For a team building a Chinese-language assistant, the draft's status is the first thing to internalize: because it is a draft for comment (征求意见稿), nothing in it can be enforced against you today, and calling it "the rule" would misstate where things stand. What it does offer is a preview — a near-complete picture of the checklist a future binding standard is likely to require, written by the same technical committee that shapes China's cybersecurity standards — so the prudent move is to read it as a signal of direction rather than as a current duty.
What the baseline covers
The draft spans the full lifecycle of a generative-AI service rather than a single launch check:
- Pre-launch model development: security of training-data sources, training-data content, data annotation, and the model itself.
- Post-launch service provision: the security measures a provider should take while operating.
- Assessment references: sample libraries for keywords, generated-content testing, and refusal testing, plus a classification model.
It is built to sit beneath the Interim Measures for Generative AI Services (生成式人工智能服务管理暂行办法) and to translate that measure's broad safety language into concrete checklist items. The lifecycle framing matters because it tells providers where to put effort: a launch-day check catches little if the training corpus was already poisoned, so the draft pushes controls earlier, to development, rather than waiting for the chat window. The assessment references — keyword libraries, generated-content and refusal tests, and a classification model — are the concrete tools a provider would use to prove the service behaves, turning vague "safe" language into items a tester can actually tick and an auditor can actually verify.
Training data comes first
A large share of the draft's detail targets training data — the raw material of any model. It asks providers to control where corpora come from, to screen content for illegal or harmful material, and to govern how human annotators label data. The logic is that many downstream risks (bias, illegal output, leakage of personal information) are easier to manage at the source than at the chat window. Controlling corpus sources, screening content for illegal or harmful material, and governing annotators are the three levers the draft names, and the logic is preventive: a biased or illegal training set will surface later as biased or illegal output no matter how good the guardrails at the chat layer are. Governing annotators specifically addresses the human step — the people who label examples can introduce their own skew, so the draft treats their work as something to document and oversee rather than as a background task that needs no record.
This emphasis connects to the broader data security (数据安全) and personal-information rules already on China's books. Under the Data Security Law, serious failures in data handling can draw fines from RMB 500,000 to RMB 2,000,000 (about US$70,000–280,000 / HK$545,000–2.18 million) — a reminder that the draft's "should" may later sit next to binding "must."
From draft to possible rule
A draft for comment is a way station, not a destination. After the comment window closes, a standard typically moves through revision, technical review, and approval before — if at all — it is published as a mandatory or recommended national standard (标准). The 2024 draft reflects input from dozens of research institutes and companies, which gives it practical weight even before any legal force.
Readers should not treat its checklists as current law. The right move is to watch TC260's site for the finalized version and for any accompanying implementing measures.
Why it matters
Why it matters is that a draft like this rarely stays a draft unchanged in spirit: the lifecycle and training-data expectations it lays out already echo the broad safety duties in the Interim Measures for Generative AI Services, so early movers who build to the draft are, in practice, building toward the likely rule. The penalty context — the Data Security Law range already on the books — shows that the "should" language sits beside real "must" obligations elsewhere, so treating the draft as irrelevant is a risk, not a saving. The smart read is to use it as a head start: the controls it describes are the ones most likely to survive into a finalized standard, and adopting them early costs less than retrofitting later. The draft's non-binding status protects you from enforcement today, but not from the direction it points.
Key takeaways
- The document is a draft for comment (征求意见稿), circulated by TC260 in May 2024; comment closed 22 July 2024.
- It is NOT in effect as a binding rule; do not call it "implemented."
- It covers the full generative-AI lifecycle: training data, model, service, and assessment.
- Its checklists preview likely future expectations under existing measures.
What readers can do now
- Engineering leads: adopt the draft's training-data and annotation controls as internal best practice, even pre-rule.
- Risk teams: build a gap analysis between your current controls and the draft's keyword/refusal test libraries.
- Strategy readers: track TC260 publications for the finalized standard before treating it as compliance.
- Data teams: stand up a corpus-source log and a content-screening pass now, so the training-data control is operational rather than aspirational when the rule lands.
- QA teams: pilot the draft's refusal-testing approach on your own model, recording how it performs, to surface weak spots before any external assessment.
- Compliance writers: draft internal policy language that mirrors the draft's lifecycle structure, so updating it later is a revision, not a rewrite.
Honest limitations
This article describes a draft-for-comment document, not a binding rule. Its provisions may change during review, and there is no guarantee it will become a mandatory standard or that its exact thresholds will survive. Status should be re-confirmed on the TC260 portal (tc260.org.cn) before any compliance decision. The Data Security Law fine range cited is statutory context, not a penalty attached to this draft.