China drafts a yardstick for how secure your AI really is
Two moves out of Beijing today show the governance machine shifting from slogans to instruments: draft national standards for measuring AI security are open for public comment, and the industry ministry put a number on how much standard-setting has already been done.
China's national cybersecurity standards committee has opened seven draft national standards for public comment — among them an assessment method for grading how mature an AI system's security capabilities actually are. The notice (reference Wang An Mi Zi [2026] No. 106) was issued August 26 by TC260, the committee that writes China's cybersecurity standards under SAMR, with feedback due by October 25. The AI entry, "Cybersecurity technology — Assessment method for artificial intelligence security capability maturity," would give Chinese regulators and enterprises a common yardstick for scoring AI systems' security readiness — think of it as a maturity-model audit for models and the products built on them, closer to NIST's CSF tiering than to the EU AI Act's risk classes.
The timing is not subtle: this lands two days after TC260 published a practice guide on how individual users can use AI services safely, and in the same week the industry ministry told reporters that ethics-review pilots now run across multiple cities. Standards like these tend to become de facto requirements once procurement and certification start referencing them, so vendors selling AI into China's government and enterprise market have two months to shape the draft — or live with it.
Beijing also put a number on its AI standards build-out: nearly 200 key AI standards have been completed to date, per vice minister Xin Guobin at the same State Council Information Office briefing our morning brief covered. The ministry said China's intelligent computing power reached 2,185 EFLOPS by end of June, strung together by more than 70 computing corridors around national hub nodes, and framed open-weight Chinese models as increasingly the default choice for global users on price-performance. Nearly 200 standards is no longer a paper exercise — it is a full rulebook covering models, data, application and safety layers, and it signals that China intends to compete on whose rules the rest of the world's supply chains adopt, not just whose chips are fastest.
What to watch: whether the maturity-assessment draft draws meaningful comment from cloud providers and model labs before October 25 — and whether certification bodies start piloting it before it is even finalized, which is usually the tell for how fast a Chinese standard becomes a market gate.
If a security-maturity score started appearing on every AI product you buy, would you trust it — or game it? Tell us in the comments.
