The compliance officer prints the document and sets it on the desk beside a highlighter. Nine pages, much of it a checklist for a systems administrator.
By page three she has found the sentence that decides the product: the human must keep the leadership over the application.
Her company sells a customer-service agent. To her, that sentence is not a principle. It is a design requirement with a test attached.
Key takeaways
- TC260 released the Ethics-Safety Guidelines for Artificial Intelligence Applications 1.0 on 19 May 2026, drafted by Tsinghua, CESI, Alibaba, Huawei and DeepSeek (China Daily, 19 May 2026).
- One of its nine principles is that "the leadership over AI applications belongs to humans" — a rule about control, not about model capability (China Daily).
- A mandatory national standard for AI agents was listed on 27 June 2026, with an 18-month drafting cycle covering identity, permissions, tool use, logs and shutdown (CGTN, 28 July 2026).
- GB/Z 177-2026, published 8 May 2026 by MIIT, SAMR and MOFCOM, grades terminal intelligence — the definition that lets subsidies attach to devices (MIIT).
- A comprehensive AI law is still only a preparatory item in the 2026 NPC legislative plan, with no draft tabled — but the standards already do the work a law would do.
The rulebook is written in standards
China's AI governance does not wait for a statute. It arrives as technical documents, written by committees that include the companies being regulated, and it binds through registration, procurement and app distribution rather than through courtrooms.
The pattern shows in three documents issued within two months.
On 19 May 2026, the National Technical Committee 260 on Cybersecurity (TC260) released technical file TC260-005, the Ethics-Safety Guidelines for Artificial Intelligence Applications 1.0, drafted by Tsinghua, CESI, Alibaba, Huawei and DeepSeek, among others. One of its nine principles is a sentence a lawyer can use: "the leadership over AI applications belongs to humans" (China Daily, 19 May 2026).
On 27 June 2026, a mandatory national standard for agents — "General Security Requirements for Artificial Intelligence Agent Application", 20263116-Q-252 — was listed with an 18-month drafting cycle. Its scope reads like a product spec: identity, permissions, tool use, human intervention, logs, emergency shutdown (CGTN, 28 July 2026).
On 8 May 2026, MIIT, SAMR and MOFCOM published GB/Z 177-2026, a national standard series that grades terminal intelligence (MIIT, 8 May 2026). That is the document that lets a subsidy attach to a handset and lets a procurement officer defend the purchase.
Why this moves faster than a law
A statute needs definitions, penalties, courts and a legislative calendar. A standard needs a committee, a test procedure and a publication number. That asymmetry explains the sequence.
- Revision speed. A committee can amend a technical requirement in months; a law takes years and reopens every contested definition each time.
- Market access. A standard can be attached to product registration, public procurement or app distribution, which makes it enforceable without litigation.
- Drafter proximity. Because vendors sit in the drafting room, the text tends to describe things that can actually be built — and tends to describe them in the vendors' vocabulary.
- Translation into contracts. A standard becomes a clause in supply agreements long before it becomes a cause of action.
The result is a rulebook that behaves like law for a company trying to sell something, and like guidance for a company trying to argue about it later.
What a foreign vendor actually meets
A vendor selling into China meets the standards at four points, in roughly this order:
- Registration. Conformity evidence is requested before a product is listed, and the reviewer works from the standard rather than from the press release.
- Agent design. Permissions, logs and an emergency shutdown become product features, not policy statements.
- Hardware grading. A terminal needs a grade if it is to be sold as intelligent, and the grade determines which scheme it qualifies for.
- Content labelling. Sector rules add their own layer — the National Radio and Television Administration's Micro-drama Development Measures (《微短剧发展管理办法》), effective 1 September 2026, require a prominent AI notice on every episode, alongside a three-tier classification (CCTV, 1 September 2026).
None of this requires a foreign firm to agree with the policy. It requires the firm to produce evidence, and evidence production is a fixed cost that does not scale down with revenue.
For a foreign vendor, the practical compliance surface is the standard rather than the statute, because the standard is what a registration reviewer opens. That is a useful correction to the habit of watching for legislation.
The gap is enforcement evidence
The weak point is not the writing. It is the record.
There is no public running count of enforcement actions against AI providers that outside researchers can consult, and the standards themselves are a mixture: some are mandatory, some grade products, some set out principles without a test. The agent standard's 18-month drafting cycle means the obligations it describes are not yet enforceable in the form a buyer would recognise.
So the compliance industry is ahead of the enforcement data. Law firms publish client notes on documents that have no public case history. Vendors build features against requirements that may be revised before they take effect. The rulebook is real, but its edges are soft, and nobody outside the drafting committees can say precisely where they are.
Honest limitations
The guideline text is known through China Daily's account rather than a full official translation, and the quoted principle is a summary of a longer document. Enforcement data is thin by design: no public register of penalties is available to outside researchers, so claims that standards are "strictly enforced" cannot be checked. The 18-month drafting cycle means the agent standard's final scope may differ from the listing. And the claim that standards travel better than statutes is an argument about incentives, not a measured outcome.
What readers can do now
- Operators: track standards by number and drafting stage, and treat logging and shutdown as architecture decisions made at design time; retrofitting them after a review is expensive.
- Investors: underwrite regulatory capacity as an asset, because a product that has cleared registration once carries an advantage that never appears in the accounts.
- Researchers: compare the published standard with the product that claims compliance. The distance between them is the most under-reported number in Chinese AI governance.