Between Development and Oversight: China’s Approach to Addressing Artificial Intelligence Risks
Concerns about losing control of AI, but also about falling behind in technology: How does Beijing view the risks of artificial intelligence, and what is it doing to address them?
INSS Insight No. 2205, October 25, 2026
As artificial intelligence (AI) becomes more advanced, China is broadening its understanding of the risks it creates. Alongside spying, cyberattacks, and other familiar national security threats, Beijing is paying more attention to risks that come from advanced AI systems themselves, including their ability to act on their own and the possibility that humans could lose control of them. At the same time, China sees falling behind in technology and depending on foreign technologies as national security risks. Official publications from September 2026 show that different parts of the Chinese government approach these risks in different ways. However, they all support continuing to develop China's own AI capabilities while expanding safety measures, oversight, and control.
In mid-September 2026, Chinese officials released three major statements about AI risks. On September 13, Minister of State Security Chen Yixin published an article about what these risks mean for China's national security. The next day, officials released the Artificial Intelligence Safety Governance Framework 3.0, which describes the risks and ways to address them. China's Foreign Ministry also discussed AI risks and whether the development of advanced models should be slowed.
These statements show that different parts of China's government view AI risks in different ways. Chen's article looks at AI mainly through the lens of national security. Framework 3.0, developed by organizations responsible for cybersecurity and technical standards, pays more attention to risks created by AI systems as their abilities grow. The Foreign Ministry connects these two views, arguing that risks can be managed while AI development continues. However, the boundaries between these areas are not clear. The Chinese word anquan (安全) means both "safety" and "security." This allows China to discuss technology safety, cybersecurity, political stability, and national security within one broad framework.
Artificial Intelligence Through the Lens of National Security: The Minister of State Security's Article
Chen Yixin, Secretary of the Party Committee and Minister of State Security (MSS), published his article before National Cybersecurity Awareness Week. His article draws heavily on ideas and language used earlier by China's leaders. A comparison by Mark Parker Young, a former CIA analyst and senior official at the US National Intelligence Council, found that much of Chen's wording comes from earlier documents and statements by President Xi Jinping and other Chinese officials. However, much of the section about AI risks could not be traced to earlier texts. This suggests that the main new contribution is applying existing national security ideas to recent developments in AI.
Chen describes six types of risks from AI development. For this analysis, they can be grouped into three areas. The first is political and social risk, including threats to political and ideological security and challenges to government and social order. Chen warns that deepfakes, AI-generated content, and automated accounts could spread false information, increase conflict, and be used in cognitive warfare against China. He also points to unfair bias in algorithms, violations of privacy, and the difficulty of deciding who is responsible when automated systems make decisions.
The second area covers cybersecurity, spying, and information security. Chen says AI makes cyberattacks cheaper and easier for people with fewer technical skills. It can help attackers find weaknesses, automate attacks, and even create situations where AI systems attack other AI systems. He also warns that foreign intelligence agencies could use AI to collect and analyze sensitive information, and that data could leak to foreign AI products.
The third area concerns competition in technology and the military. Chen sees technological gaps and dependence on other countries as risks. He argues that countries with a technological advantage use restrictions on technology, technical standards, and closed systems to limit other countries' access to advanced tools. He also notes that AI is being used more often for intelligence gathering, decision-making, identifying targets, supporting military operations, and influencing people's thinking. In his view, AI is moving from a supporting role to a "pivotal role" on the battlefield.
It is also important to notice what Chen does not emphasize. Framework 3.0, discussed below, focuses on the danger that autonomous systems might go beyond their assigned tasks or escape human control. Chen instead focuses on how people, governments, and hostile actors use AI, as well as the risks of falling behind in technology. This reflects China's idea of "holistic national security," which treats technology as something that can make existing threats more powerful and as another area of competition between countries. Chen therefore describes innovation as the "primary driving force" and security as the "bottom-line requirement." He calls for stronger AI capabilities that China can develop and control itself, along with monitoring, early-warning systems, and oversight.
Risk Management: The Artificial Intelligence Safety Governance Framework 3.0
Framework 3.0 was developed under the guidance of the Cyberspace Administration of China (CAC) and organized by the National Cybersecurity Standardization Technical Committee (TC260), working with research institutes, professional organizations, and technology companies. Several organizations share responsibility for managing AI risks. The CAC leads regulation of AI services, content, algorithms, and data. TC260 develops technical standards and tools. The Ministry of State Security contributes a national security perspective. AI providers must put safety requirements into practice under the supervision of the relevant regulators.
This is the third version of the framework, which has been updated every year since September 2024. It is not a legally binding law or regulation. Instead, it is a guide built around three steps: identifying and classifying risks, using technology to reduce them, and creating systems for oversight and management. Its recommendations include assessing risks, monitoring systems and issuing early warnings, limiting what AI agents are allowed to do, requiring human involvement in high-risk tasks, checking tools and plug-ins, and providing ways to shut down systems that go beyond their assigned tasks. One of its main principles is to support AI development while keeping systems "safe and controllable" (安全可控).
The framework works alongside China's legally binding rules, which have expanded in recent years. These include rules for generative AI services, registration and review processes for services and algorithms, and requirements to label content created by AI. By late August 2026, more than one thousand generative AI services had completed China's national registration process. Framework 3.0 provides a guide to risks and technical principles that can shape future standards and regulations. Legal duties, however, continue to come from the existing regulatory system.
According to an analysis by AI Safety in China, an independent research project that tracks AI policy and governance in China, the number of risks listed in the framework rose from 30 in Version 2.0 to 54 in Version 3.0. The new version pays particular attention to AI agents, which can plan and carry out tasks using external systems, and embodied AI, where a digital error could cause physical harm. It also covers systems that gain permission or access to resources without authorization, trick people evaluating their safety, move away from their intended goals, or act on their own in cyberspace. In comments published after the framework was introduced, this change was described as a shift in large AI models from "answering questions" to "executing tasks."
The framework also discusses open-weight models. These are AI models whose learned parameters are publicly available, so other people can run and modify them independently. The framework warns that after a model's weights have been shared, people can run the model on their own, change it, or even remove its safety protections. This makes it difficult to limit copies that have already been released. The warning is especially important because open-weight models play a major role in China's AI industry. For example, DeepSeek released the weights for its V4 models and presented this openness as part of its development strategy. This creates a conflict between the benefits of open weights, which can support innovation, wider use, and China's influence in technology, and the difficulty of controlling how models are used after their weights have been distributed.
A comparison of the framework's three versions shows how China's understanding of AI risks has expanded as the technology has advanced. Version 1.0, published in 2024, mainly focused on risks directly caused by AI technology and its use. Version 2.0 expanded the discussion to include social risks, such as effects on employment and ethical concerns. Version 3.0 goes further by addressing risks created by the growing abilities of advanced systems, including independent action and AI agents.
The differences between Chen's article and Framework 3.0 show that China considers AI risks in several different ways. Outside China, Beijing worries about losing ground in technological competition, relying on foreign technologies, and other countries or hostile groups using AI for cyberattacks, spying, and influence operations. Within China, officials also worry about threats to political security and social order. Framework 3.0 adds another concern: the risks created by the behavior of advanced AI systems themselves. China therefore sees AI as both a source of national power and a possible threat.
Development Alongside Security: The Chinese Foreign Ministry's Position
On September 14, Chinese Foreign Ministry spokesperson Guo Jiakun was asked about calls from senior figures in the US AI industry to slow the development of advanced AI systems. The question focused especially on comments by Anthropic CEO Dario Amodei, who connected the risks of advanced AI models with technological competition against China. Guo replied that China supports AI development that is "open and inclusive". He also warned against exaggerating threats, confrontation, and "malicious competition."
The next day, Guo explained that China also recognizes the risks of AI itself. He said regulations must be updated and safeguards strengthened to stop the technology from spiraling out of control. He stressed that China places "equal emphasis on development and security," takes both the direct risks of AI and the risks that arise from its wider effects seriously, and works to keep the technology "safe, reliable, and controllable." Guo specifically referred to Framework 3.0, which had been published the day before.
The disagreement is clear. China's Foreign Ministry opposes using arguments about AI safety to justify confrontation and technological rivalry. Chen, by contrast, treats falling behind in technology, dependence on foreign suppliers, and restrictions on access to technology as parts of the national security threat.
The issue also reached the highest level of government. During their meeting in Washington on September 24, Presidents Xi Jinping and Donald Trump discussed AI. Xi called for the two countries to continue discussing the technology's risks and benefits, prevent its misuse, and ensure that it remains under human control. After the meeting, both sides agreed to promote dedicated talks on AI and establish a communication channel for dealing with AI-related incidents. However, only days later, Trump made clear that he also sees AI as a direct area of strategic competition with China. He expressed doubts about cooperation that could give Beijing access to American technology and expertise. These developments show the continuing tension between managing shared AI risks and competing for technological advantage between the two powers.
Between Development and Control: Implications for the Future
Chen Yixin's article, Framework 3.0, and the Chinese Foreign Ministry's statements show how different parts of China's system approach AI risks according to their roles and responsibilities. The security agencies focus on threats to the state and ruling system, as well as China's ability to compete with other countries. Cybersecurity and standardization organizations are increasingly concerned about how advanced AI systems behave and whether humans could lose control of them. The Foreign Ministry acknowledges these risks but opposes using safety discussions to justify restrictions on China's technological development. The Chinese concept of anquan (安全) brings these concerns together in one broad framework that includes technology safety, cyber and information security, political stability, and national security.
These developments also matter for international efforts to govern AI. The agreements reached at the Xi–Trump meeting suggest that China and the United States have some basis for discussing loss of control, harmful uses of AI, cyber risks, and autonomous systems. However, continuing technological competition makes it hard to separate AI safety from national security. US officials see limits on China's access to advanced chips and capabilities as a way to reduce risks. Beijing, on the other hand, considers falling behind technologically and depending on foreign organizations to be major risks in themselves. Talks between the two countries will therefore need to address both how they define AI risks and their disagreements about which methods of managing those risks are acceptable. Even so, the fact that both countries recognize some of the same dangers, including loss of control and the misuse of advanced systems, could provide a starting point for focused cooperation.