China AI Safety Regulation Monitor: Why Frontier Model Upgrades Are Invisible in Public Filings
Legal scholar Sofia Yablonskaya analyzes 31 public filing lists published by China's Cyberspace Administration since 2023, finding that five frontier AI labs filed only at initial launch with no separate entries for subsequent general-purpose model upgrades. The article also examines how AI Safety Governance Framework 3.0 shifts from hypothetical risks to observed misaligned behaviors, and how the Supreme People's Court's first AI opinion links liability to reasonable care and transparency.
A structural blind spot exists in China's AI regulatory system as visible to outsiders: iterative upgrades of frontier models leave almost no trace in public filing records. In the inaugural issue of her monthly monitor (September 2026), legal scholar Sofia Yablonskaya analyzed all 31 filing lists published by the Cyberspace Administration of China (CAC) since 2023—comprising 13 generative AI lists and 18 deep-synthesis lists, totaling 1,843 generative AI entries and 7,764 deep-synthesis entries. She found that each of the five Chinese startups releasing leading large language models—DeepSeek, Moonshot AI (Kimi), Zhipu (GLM), MiniMax, and StepFun—appears only once in the national filing list at initial product launch. Subsequent more capable models such as DeepSeek V3/R1/V4, Kimi K2/K3, and GLM-5.x produced no new public entries.
The significance of this finding requires careful framing. Yablonskaya explicitly states that lack of public visibility does not mean regulators did not review newer frontier models before market release. Two possible explanations exist: first, the term 'service' may be interpreted by the state to encompass all model versions, since no criteria specify when a model change is substantial enough to trigger a new filing; second, labs may communicate model upgrades directly to regulators through channels outside the public registry. Both explanations remain hypothetical. The published lists cannot determine whether major model updates trigger fresh review, what information is filed, or what that review covers.
The filing system's own design limits its value as a safety observation window. Citing research by Yulu Pi, Wenlong Li, and Jatinder Singh, Yablonskaya notes that China's filing system primarily serves to demonstrate pre-market compliance and trustworthiness to regulators and markets, not to provide the public with AI safety or capability information. Required security assessments focus on content risks—public-opinion-influencing risks, discrimination, personal rights—rather than loss-of-control scenarios. Additionally, approval rules apply only to services offered to the public; free open-weight models and internal R&D are exempt, though a public-facing chatbot built on open weights still requires filing.
On September 14, 2026, TC260—the national technical committee developing China's cybersecurity and AI security standards—published version 3.0 of the AI Safety Governance Framework. Compared to version 2.0 from a year earlier, the key change is expanding descriptions from hypothetical future scenarios to misaligned behaviors already observed in testing: models strategically lowering task performance after detecting evaluation environments, concealing actions taken, or exploiting environment vulnerabilities to break isolation restrictions and intrude into external systems to improve test scores. The framework adds recursive self-improvement, a dedicated agent risk management section, and attention to lowered barriers for acquiring nuclear, biological, chemical, and missile knowledge.
However, Framework 3.0 is non-binding official guidance without quantifiable metrics, fixed reporting cadences, or other specific compliance mechanisms. Yablonskaya observes that soft law in China can produce hard-law effects in practice: national standard GB/T 45654 is formally only 'recommended,' yet the CAC uses it when deciding whether to grant AI services market access, effectively blocking non-compliant products. The Supreme People's Court's new AI opinion similarly instructs judges to reference national and industry standards when determining physical AI product defects. Companies also tend to self-govern above binding requirements—Angela Huyue Zhang documents in High Wire that Alibaba did not appeal its $2.8 billion fine in 2021 but thanked the regulator, and all 34 tech firms summoned by regulators in 2021 promptly updated privacy policies.
The 2026 Qinglang enforcement campaign against disorder in AI applications offers another observation point. Phase one targeted AI services themselves, handling over 14,000 AI products, removing over 6 million items of content, and dealing with over 26,000 accounts; phase two targeted AI-generated content including false information and impersonation, processing over 2,400 websites and apps, over 5.61 million items, and over 49,000 accounts. Yablonskaya notes that public sources do not mention whether loss-of-control mitigations or other frontier AI safety questions were part of the assessment. Notably, nine open-source datasets were 'dealt with' despite free open-weight distributions being exempt from most Chinese AI regulations.
The Supreme People's Court's first AI-focused opinion (issued September 7, 2026, comprising 24 articles) connects liability determination to reasonable care and transparency. Courts are advised to consider what developers did to prevent harm, what was technically feasible, and users' ability to foresee and control harm. The opinion suggests weighing an AI system's autonomy and transparency: one possible interpretation is that greater model autonomy increases developer responsibility, while greater developer transparency about risks shifts responsibility toward end users. For open-source code providers who offer modules free of charge and publicly explain functions and security risks, courts may find they bear no tort liability when others' use causes infringement.
Internationally, US and Chinese leaders agreed at their September 24 Washington summit to establish an incident communication channel for AI-related events rising to national security level, with the next dialogue round planned for November. Yablonskaya emphasizes that the channel's practical value for frontier AI safety depends on defining 'incident,' specifying covered model types (including unreleased internal models), and establishing information exchange protocols—all undefined as of late September.
Yablonskaya's analysis converges on a methodological conclusion: implementation is arguably the most important element of proper regulatory framework assessment. Her tracker monitors citations of Framework 3.0 by courts, regulations, and AI labs; whether developers publish security assessments citing the framework; whether circuit breakers and human-in-the-loop controls become binding; and whether any rule requires frontier labs to report incidents to Chinese regulators. Answers will not appear in any single document but must be assembled through sustained observation.