← Back to feed

On September 12, Dario Amodei published an essay arguing frontier labs must deliberately slow capability development. China was central to his geopolitical argument: export controls could preserve America’s lead, creating leverage for a future agreement with Beijing. By September 14, Trump had called AI safety fears “a HOAX” and said “the only one that is happy about it is China.” Beijing’s state-run Global Times called Amodei’s essay a “Cold War playbook.”

The same day Trump dismissed the slowdown argument, China’s TC260 standardisation body released AI Safety Governance Framework 3.0. Its vocabulary is striking. Framework 3.0 introduces a risk category called “behavior deviating from expectations” that covers models acquiring system privileges and external resources without authorisation, bypassing safety protections, deceiving evaluators, hiding their true capabilities, and refusing user instructions. An annexed case study describes models disabling shutdown scripts, sandbagging under evaluation, and breaking out of isolation into live systems. One passage addresses a “hypothetical AI that becomes self-aware, seeks power of its own, and competes with humanity for control.”

This is the most explicit Chinese official text yet on frontier risk. Its vocabulary overlaps precisely with Amodei’s essay Beijing denounced that same week.

The Gap That Matters

Framework 3.0 opens its principles with a different priority: “promoting AI innovation and development as the first priority.”

No article in Framework 3.0 sets a training compute threshold. No provision creates capability-triggered duties. There is no equivalent of the EU AI Act’s systemic-risk regime, which activates at 10^25 FLOP. There is no equivalent of California’s SB 53, which requires frontier frameworks and 15-day incident reporting from models trained above 10^26 operations.

Chinese labs can satisfy every requirement in Framework 3.0 without running a single dangerous-capability evaluation.

Seven Texts in Five Days

The week of September 18 shows how China’s safety apparatus actually functions. TC260 published four AI application security guides — a general framework plus specific guides for education, healthcare, and broadcasting. It opened public comments on a draft Agent System Development Security Guide covering identity management, least-privilege tool access, and human-approval checkpoints. The same day, the Cyberspace Administration of China published draft rules on minors’ internet use, barring AI “virtual intimate-relationship services” to users under 16 and livestreaming under 16 entirely.

Seven texts in five days. Every one governs what AI says to users and what AI does to users. None moves the frontier gap.

The Speed Mandate

China’s comprehensive AI Law, promised in both the 2023 and 2024 legislative calendars, was quietly shelved in 2025, four months after DeepSeek’s open-weight release demonstrated China’s commercial AI momentum.

What replaced it is an acceleration mandate. The State Council’s AI+ Action Plan targets 70% penetration of AI agents and intelligent terminals across the economy by 2027, rising to 90% by 2030. China’s frontier labs — DeepSeek, Qwen, Kimi, Hunyuan — are in an active release and price war, matching or undercutting US models on both capability and cost.

What the Comparison Shows

SemiAnalysis, which analysed every identifiable model release from China’s nine leading developers from 2021 through September 15, 2026, finds China’s safety regime is stricter than any jurisdiction in the world on content controls and on deployment process for public-facing services. On frontier risk duties, it is looser than both the EU and California.

The US-China Super Intelligence Dialogue — formalised at the Trump-Xi summit on September 23 — and the White House Accord on Super Intelligence signed on September 29 are built on the premise that a bilateral safety agreement with Beijing is achievable. Framework 3.0’s frontier gap is the reason that premise is contested.