Every AI Policy Ever · open in the interactive register

Published (non-binding, current)Non-binding · Guidelines / framework

AI Safety Governance Framework 3.0

人工智能安全治理框架3.0

Record CN-17

Issued by
National Technical Committee 260 on Cybersecurity of the Standardization Administration of China (TC260), under the guidance of the Cyberspace Administration of China
Jurisdiction
China
Level · region
National · East Asia
Published / adopted
2026-09
Language
Chinese, English

Summary

Version 3.0 of China's AI safety governance framework. It keeps the logic of risk classification, technical response and comprehensive governance, with inherent, application and derivative risks, up to AI escaping human control. It describes unintended autonomous model behaviour, such as refusing shutdown instructions or strategic underperformance in evaluations, and adds sandbox supervision. Annexes set five-level risk-grading principles whose top level has catastrophic and systemic features, a life-cycle risk management framework for AI agents, and basic principles for trustworthy AI such as ultimate human control. It calls for research on consensus guidelines for catastrophic AI risks.

Safety topics

risk-based classificationgeneral-purpose / frontier AIevaluation & testinghuman oversightcatastrophic risk

Status notes

TC260 released it on 14 Sept 2026, the day both its own release notice and the CAC's notice carry, at the opening ceremony of the 2026 National Cybersecurity Publicity Week (CAC notice); the framework itself is dated September 2026. TC260 prepared it under the guidance of the Cyberspace Administration of China, with the China Academy of Cyberspace Studies, the CAC Data and Technology Support Center and other specialist institutions, research institutes and companies. It builds on versions 1.0 (2024) and 2.0 (2025) and replaces version 2.0. Compared with version 2.0 it adds the annex on AI agents and the section on sandbox supervision, which includes exploring liability exemptions for faultless conduct in sandbox tests; the risk-grading and trustworthy-AI annexes carry over, the latter extended to respect for digital sovereignty and international mutual recognition of model evaluations.

Sources

Open the official source https://www.tc260.org.cn/tc260/xwdt1/202609/e879077a3caa4722b2206d1bcaed5a6c/files/%E3%80%8A%E4%BA%BA%E5%B7%A5%E6%99%BA%E8%83%BD%E5%AE%89%E5%85%A8%E6%B2%BB%E7%90%86%E6%A1%86%E6%9E%B63.0%E3%80%8B.pdf.pdf

Secondary source: https://www.cac.gov.cn/2026-09/14/c_1791137092283345.htm

Local copy

Archived. Last attempt 2026-10-18 06:47:57 UTC

Official source (third-party copy, not published) archive/CN-17/2026-10-18/official.pdf
Retrieved 2026-10-18 06:48:07 UTC
SHA-256 cff709d8b1b2a0dfd2ff24df4d6b942b160975331e44c918e14a47d5c86da43d
Secondary source (third-party copy, not published) archive/CN-17/2026-10-18/secondary.html
Retrieved 2026-10-18 06:48:14 UTC
SHA-256 72415a6f4f8cd2a7b3d2b8b8080247676393d12a7711f81e8907ef3e3c19f24a

Verification

A
The instrument's own official text, or an official register, was stored and confirms the title, date and status. checked 2026-10-18 · official-url-fetched
Refresh of 18 Oct 2026 under the rule that level A needs the instrument's own text. Stored in this run: the framework PDF attached to TC260's release notice (tc260.org.cn, 136 pages: the Chinese text, then TC260's English text), now the official_url; stored on 11 Oct 2026: TC260's release notice of 14 Sept 2026 (the previous official_url, an announcement in TC260's news section, with browser-rendered and printed copies) and the CAC release notice of the same day (the secondary source). The PDF confirms the title, the issuer and its English name, and gives only the month (2026年9月), so date_published is 2026-09; the release day, 14 Sept 2026, is in the notes from the two notices. The identical PDF linked from the CAC notice was stored on 14 Oct 2026. The summary and notes were rewritten from the Chinese text in October 2026. The comparison with version 2.0 in the notes rests on the version 2.0 PDF stored for CN-13. The notices do not say in words that version 3.0 replaces 2.0; this follows from the version sequence.
Second check: Independent check by Claude Code (claude-sonnet-5-5), 2026-10-18: 6 field(s) supported.

History

  1. 2026-10-18notes: Released on 14 Sept 2026 at the opening ceremony of the 2026 National Cybersecur → TC260 released it on 14 Sept 2026, the day both its own release notice and the C — first sentence now gives the release day with its sources and says the framework is dated September 20262026-10-18-refresh-level-rule-1 · Claude Code (claude-opus-5-5)
  2. 2026-10-18official_url: https://www.tc260.org.cn/tc260/xwdt1/202609/e879077a3caa4722b2206d1bcaed5a6c.sht → https://www.tc260.org.cn/tc260/xwdt1/202609/e879077a3caa4722b2206d1bcaed5a6c/fil — the record pointed at TC260's release notice, an announcement that attaches the framework; the framework PDF itself is now stored and becomes official_url (rule 7c)2026-10-18-refresh-level-rule-1 · Claude Code (claude-opus-5-5)
  3. 2026-10-18date_published: 2026-09-14 → 2026-09 — the framework's own text gives only 2026年9月 on its cover; the day (14 Sept 2026) comes from the release notices, which are announcements, so it moves to the notes (rule 7b)2026-10-18-refresh-level-rule-1 · Claude Code (claude-opus-5-5)
  4. 2026-10-18issuing_body: National Cybersecurity Standardization Technical Committee (TC260), under the gu → National Technical Committee 260 on Cybersecurity of the Standardization Adminis — the issuer's own English name as the framework's English text gives it ('National Technical Committee 260 on Cybersecurity of the Standardization Administration of China'), with the CAC's guiding role kept2026-10-18-refresh-level-rule-1 · Claude Code (claude-opus-5-5)
  5. 2026-10-14english_version: {"kind": "none found"} → {"kind": "authentic", "url": "https://www.tc260.org.cn/tc260/xwdt1/202609/e87907 — Authentic English text in TC260's own PDF, a stored source.2026-10-14-refresh-translation-fixes · Claude Code (claude-opus-5-5)
  6. 2026-10-14notes: Released 14 Sept 2026 at the opening ceremony of the 2026 National Cybersecurity → Released on 14 Sept 2026 at the opening ceremony of the 2026 National Cybersecur — Removed the sentence on other TC260 documents of the same week and the remark that they are not recorded (one is under leads). Added what changed from version 2.0.2026-10-14-refresh-translation-fixes · Claude Code (claude-opus-5-5)
  7. 2026-10-14summary: Third version of China's national AI safety governance framework. It keeps the s → Version 3.0 of China's AI safety governance framework. It keeps the logic of ris — Rewritten from the Chinese framework text. The risk-grading and trustworthy-AI annexes are not new in 3.0 (both are in 2.0), so the summary no longer calls them new; the shutdown example comes from Panel 1, and 'commits to building consensus guidelines' is now 'calls for research on consensus guidelines' (积极研究应对人工智能灾难性风险的共识性准则).2026-10-14-refresh-translation-fixes · Claude Code (claude-opus-5-5)
  8. 2026-10-14language: Chinese → Chinese, English — The framework PDF carries TC260's English text after the Chinese.2026-10-14-refresh-translation-fixes · Claude Code (claude-opus-5-5)
  9. 2026-10-14english_version: – → {"kind": "none found"} — No English version in the stored copies, and none found in a targeted search on 14 Oct 2026.manual-2026-10-14 · Claude Code (claude-opus-5-5)

Related records

AI Safety Governance Framework 2.0 China · Superseded

AI Safety Governance Framework 1.0 China · Superseded

Citation

National Technical Committee 260 on Cybersecurity of the Standardization Administration of China (TC260), under the guidance of the Cyberspace Administration of China. AI Safety Governance Framework 3.0. 2026-09. https://www.tc260.org.cn/tc260/xwdt1/202609/e879077a3caa4722b2206d1bcaed5a6c/files/%E3%80%8A%E4%BA%BA%E5%B7%A5%E6%99%BA%E8%83%BD%E5%AE%89%E5%85%A8%E6%B2%BB%E7%90%86%E6%A1%86%E6%9E%B63.0%E3%80%8B.pdf.pdf. Status: Published (non-binding, current); verified 2026-10-18 (level A). Local copy archive/CN-17/2026-10-18/official.pdf retrieved 2026-10-18 06:48:07 UTC, SHA-256 cff709d8b1b2a0dfd2ff24df4d6b942b160975331e44c918e14a47d5c86da43d. Every AI Policy Ever, version 1.18 (snapshot 2026-10-18), record CN-17.

Improve this record

Know of an amendment, a status change or an error? Report news or an error on GitHub; the form opens with this record filled in.