China’s state economic planner, the National Development and Reform Commission (NDRC), said on 3 November that it will speed up a basic, comprehensive AI law and set safety standards and ethical guidelines covering the full life cycle of AI, Bloomberg reported first. The NDRC’s official transcript of the Beijing briefing shows Wang Ruomeng, a deputy director-general, also saying China will push AI developers and operators to disclose safety risks and report safety incidents and vulnerabilities.
Bloomberg says the rules would reach developers from DeepSeek to Moonshot and Alibaba. The plan follows a fast run of technical guidance: the national cybersecurity standards committee, TC260, released the third version of its AI Safety Governance Framework on 14 September 2026, 24 months after the first, by our arithmetic.
Business Pill · Sovereign AI
A short Business Engineer explainer on who controls the model and the data. It teaches the general idea only and does not discuss the NDRC briefing.
The key insight: As we read it, the new element is the duty side: alongside a faster law and life-cycle standards, the NDRC’s transcript has China pushing developers and operators to disclose safety risks and report incidents and vulnerabilities, paired with transition periods and sandboxes.
Wang, deputy director-general of the NDRC’s Department of Innovation and High-Tech Development, spoke at the first briefing in the NDRC’s series on the 15th Five-Year Plan. Answering a question from The Paper on AI risks, he set out four areas of work, according to the NDRC’s transcript.
The first is rules. The NDRC, Wang said, will “ๅ ๅฟซๆจ่ฟไบบๅทฅๆบ่ฝๅบ็กๆง็ปผๅๆง็ซๆณ”, which we translate as speed up basic, comprehensive AI legislation. Wang said the NDRC will also legislate on data, computing power and algorithms and on key application scenarios, and “ๅปบ็ซ่ฆ็ไบบๅทฅๆบ่ฝๅ จ็ๅฝๅจๆ็ๅฎๅ จๆ ๅๅไผฆ็ๅๅ”, in our translation establish safety standards and ethical guidelines covering the full AI life cycle. He said rules will be reviewed periodically and provisions that no longer fit will be adjusted.
The second is supervision. Wang said regulators will set reasonable transition periods, offer compliance guidance by sector and build evaluation, consulting and certification services to cut firms’ compliance costs. He said China will support AI regulatory sandboxes for different sectors, with rules for applying, testing, using and exiting them.
The third is who carries the duty. For companies, the transcript says China will push developers and operators to strengthen risk management, “ๅๆถๆซ้ฒๅฎๅ จ้ฃ้ฉ๏ผไธปๅจไธๆฅๅฎๅ จไบไปถๅๆผๆดไฟกๆฏ”, in our translation disclose safety risks promptly and proactively report safety incidents and vulnerability information. The fourth covers jobs, rights and mental health, including monitoring of job displacement risk and adding model trainers and data annotators to the national occupational classification.
China’s AI rules and frameworks from August 2023 to the NDRC’s 3 November 2026 briefing, by date of entry into force or release, from CAC, gov.cn, People’s Daily and the NDRC transcript. The 24-month interval between Framework 1.0 and 3.0 is our arithmetic.
The Security Lapses Behind It
Bloomberg ties the plan to global concerns since warnings from Silicon Valley leaders about existential risk and “a spate of recent hacks in which AI went rogue or radically enhanced cyber-breach attempts.” The NDRC transcript does not name those cases.
In a later answer, on international cooperation, Wang said: “ไปๅนดไปฅๆฅ๏ผๅ จ็่ๅดๅ ๅ็ไบๅค่ตทไบบๅทฅๆบ่ฝๅฎๅ จไบไปถ”, in our translation since the start of this year several AI security incidents have occurred worldwide. He added that a large model developed in China recently took part in responding to an international emergency security incident, without naming the model or the incident.
Wang called for joint work on safety governance standards, vulnerability notification, risk warning and response. He said that at the September meeting of the Chinese and US heads of state the two sides agreed to set up a China-US AI dialogue and a communicationchannel for AI incidents. On 3 November the UK’s NCSC published its own warning on AI-powered ransomware, and on 31 October we reported that Cambricon’s co-founder wants one AI ethics test for US and Chinese models.
Three Frameworks in 24 Months
China’s AI rules so far have come as departmental measures and technical guidance. The Interim Measures for generative AI services, issued by the Cyberspace Administration of China with the NDRC and five other bodies, took effect on 15 August 2023. Measures on labelling AI-generated content took effect on 1 September 2025.
TC260 released AI Safety Governance Framework 1.0 on 9 September 2024. People’s Daily reported that version 2.0, a TC260 technical document led by the national internet emergency response centre, was released on 15 September 2025, and that version 3.0 followed on 14 September 2026 under the guidance of the Cyberspace Administration.
That is three versions in 24 months, by our arithmetic from the release dates. The NDRC’s 3 November answer describes a basic, comprehensive law as something to speed up, alongside the standards.
What It Means for Model Makers
For developers such as DeepSeek, Moonshot and Alibaba, which Bloomberg names, the business lever is compliance cost against room to ship. The NDRC transcript lists transition periods, sector guidance and sandboxes, while asking developers and operators to disclose risks and report incidents and vulnerabilities.
The NDRC also says China will keep its AI open, per the transcript. In the cooperation answer Wang said China will “ๅๆๅผๆบๅผๆพใๆฎๆ ๅๅฑ”, in our translation adhere to open source and openness and inclusive development, and said 38 countries have joined the World AI Cooperation Organization as founding members. Bloomberg reports the government continues to encourage open AI development during the 15th five-year plan ending 2030.
As we read it, the briefing moves the subject from technical guidance to law: TC260’s three frameworks in 24 months are technical documents, while the NDRC speaks of a basic, comprehensive AI law to speed up.
As we read it, the incident line links domestic and foreign policy: the same official who asks firms to report incidents also points to the China-US channel for AI incidents agreed in September.
As we read the transcript, the openness line is unchanged: Wang pairs the safety agenda with a commitment to open source, which Bloomberg describes as the playbook behind the global spread of Chinese models.
Wang Ruomeng, NDRC, at the 3 November 2026 briefing, as quoted by Bloomberg
“AI safety is not a problem one company, industry or country can tackle alone โ it is a global challenge requiring international cooperation,”
Three Implications
FOR CHINESE MODEL MAKERS The transcript pairs a push to disclose safety risks and report incidents and vulnerabilities with transition periods, sector guidance and sandboxes; Bloomberg names DeepSeek, Moonshot and Alibaba among the developers covered.
FOR REGULATORS ABROAD Wang called for coordination on vulnerability notification, risk warning and response, and cited the China-US AI dialogue and AI-incident channel agreed in September.
FOR WORKERS The NDRC says it will monitor AI’s effect on the employment structure, strengthen early warning on job displacement and link social insurance to changes in how people work.
The framework puts the pattern this way: “Close the SCARCE layer (keep proprietary) + Open the ABUNDANT layer (commoditize)”.
As we read it, the NDRC transcript keeps the model layer open, with Wang pledging to adhere to open source, while the new legislation it describes targets data, computing power, algorithms and key application scenarios. The framework does not discuss China’s AI rules or the NDRC.
What Is Not Established
The transcript gives no draft text, timetable or lead drafting body for the law or the life-cycle standards, and does not say how long the transition periods will be or whether disclosure and incident reporting will be mandatory. Wang did not name DeepSeek, Moonshot, Alibaba or any other company; those names are Bloomberg’s.
It is not established which global incidents the NDRC had in mind, or which Chinese model took part in the international response he described. We read the NDRC’s official transcript and Bloomberg’s report as syndicated by The Star, and we did not contact the NDRC.
This Week In The AI Supercycle
Anthropic’s Reality Check, The Capital Squeeze, & The New World Order
This week’s issue: for two years the AI build-out was priced as a growthstory. This week it started being priced as a credit story.
The NDRC says China will speed up a basic, comprehensive AI law, set safety standards and ethical guidelines for the full AI life cycle and push developers and operators to disclose safety risks and report incidents and vulnerabilities, with transition periods and sandboxes. It comes after three versions of TC260’s AI safety framework in 24 months, by our arithmetic. No draft or timetable was given.
A note on sourcing. This piece is based on the NDRC’s official Chinese transcript of its 3 November 2026 briefing, Bloomberg’s report of the same day as syndicated by The Star, and official pages from the Cyberspace Administration of China, gov.cn and People’s Daily for the timeline. Translations from Chinese are ours. The 24-month interval is our arithmetic. We did not contact the NDRC.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
