Summary of Key Points
Starting from November 1, 2026, China will implement an industry standard for AI security governance (YD/T 7173-2026), developed jointly by the China Academy of Information and Communications Technology (CAICT) and 22 other organizations. This standard aims to address new risks associated with the rapid development of AI, such as model hallucinations, algorithmic biases, and privacy breaches, and to guide companies to shift from a post-event remedial approach to proactive prevention and control. The standard covers the entire lifecycle of AI systems, specifying risk classification, identification lists, and eight essential protective measures. It is planned to be piloted in key industries such as finance and healthcare to promote the healthy development of the AI industry.
Detailed Explanation
Why Do We Need This Standard? Uncontrollable AI Risks
AI technology has become ubiquitous across various sectors, but it has also brought along new problems: for example, AI systems may generate nonsensical outputs (model hallucinations), recruitment algorithms might discriminate against women (algorithmic biases), user privacy could be inadvertently compromised, or intelligent systems may become uncontrollable. Traditional security measures (such as firewalls) are ineffective against these new risks, and companies often do not know how to systematically manage them—either they are unaware of the issues or they take untargeted actions. This standard serves as a guide, providing companies with a scientific approach to managing AI-related risks.
What Requirements Does the Standard Impose on AI Systems?
- Full Lifecycle Coverage: Risks must be considered at every stage of the AI system's development, from design and testing to deployment.
- Clear Risk Classification: Risks are categorized into four levels: severe, high, medium, and low (for instance, a business disruption or critical data breach is considered a severe risk, while minor damage to reputation is a low-risk issue). Unacceptable risks are also identified as "hidden dangers" and classified as major, moderate, or minor.
- Eight Essential Protective Measures:
- Reliability: AI-generated content must be ethical (e.g., it should not contain harmful information).
- Transparency: Generated content should be marked with indicators showing that it was created by AI (e.g., a label on images or text).
- Accountability: There must be an audit mechanism to determine who is responsible for any issues that arise.
- Other measures include controllability, security, fairness, explainability, and privacy protection to address potential vulnerabilities comprehensively.
How Can Companies Use This Standard?
The standard provides companies with a practical toolkit to help them proactively manage risks:
- Risk Assessment Templates: Step-by-step guides for assessing potential risks.
- Risk Identification Lists: Common risks are outlined, such as AI systems not disclosing their capabilities, generating false information, or secretly processing personal data.
- Assessment/Response Report Formats: Standardized templates for documenting risks and proposed solutions.
These tools enable companies to shift from a reactive approach (fixing problems after they occur) to a proactive one (identifying and resolving risks in advance).
Global Efforts in Managing AI Risks
Many countries are focusing on AI risk management: the European Union has the Artificial Intelligence Act, the United States has the NIST framework, and Singapore has released its 2026 consensus. China also has relevant regulations. By aligning with these global trends, this standard helps companies meet international requirements and avoid compliance issues when operating internationally.
How Will the Standard Be Implemented?
The CAICT will first pilot the standard in key industries such as finance (e.g., using AI for stock trading and intelligent customer service) and healthcare (e.g., for medical diagnoses and drug research and development). These sectors are chosen because they involve significant risks—missteps in AI applications in healthcare could harm patients, while financial errors could result in financial losses. After gaining experience from the pilots, the standard will be rolled out to other industries to ensure its widespread adoption.
This standard is not intended to create barriers but to help companies avoid common pitfalls and enable more stable and secure development of AI technologies. As a result, ordinary users can use AI products with greater confidence in the future!