On September 14, at the opening of China's 2026 National Cybersecurity Week, the National Technical Committee for Standardization of Cybersecurity released AI Safety Governance Framework 3.0. It follows Framework 1.0 (2024) and 2.0 (2025) and was drafted under the guidance of the Cyberspace Administration of China by the China Cyberspace Research Institute, the CAC's data and technology security center, and other research bodies and companies. The framework keeps its earlier logic of classifying risks, pairing them with technical responses, and applying comprehensive governance, while updating the risk taxonomy and adjusting the mitigation and governance measures.
Our takeThe headline is the version number, not the novelty: China is iterating its AI safety playbook on a yearly cycle, faster than most jurisdictions pass a single AI law. Framework 3.0 keeps the same three-part structure as 1.0 and 2.0 and only tweaks the risk list, which points to a consolidation phase rather than a policy reset. For anyone shipping models into China, the binding text is less the framework itself than the filing and labeling rules sitting underneath it.