China’s TC260 AI Safety Governance Framework

China’s National Information Security Standardization Technical Committee, commonly called TC260, publishes technical guidance and standards work for cybersecurity and data security. Its AI Safety Governance Framework is a risk-management reference for organizations developing, providing, or using AI. Version 1.0 appeared in 2024; version 2.0 was released on 15 September 2025 under the guidance of the national cyberspace authority. TC260 says the update follows changes in AI technology and applications, refines risk categories, explores risk grading, and dynamically adjusts prevention and governance measures. The framework treats AI safety as broader than model behavior alone. Risks can arise inside the technology, including data, model, algorithm, and system security, and through use across network, physical, cognitive, and ethical domains. The first version’s development and service guidance addressed data provenance and protection, bias checks, alignment, security testing, version management, ability limits, and user information. Version 2.0 builds on this approach, while the detailed framework should be consulted directly for its latest categories and controls. A framework is not the same as a statute, mandatory national standard, or regulator approval. Its role is to organize risk identification and possible measures, and to support shared practices. Separate laws and binding rules can impose duties on particular services, such as China’s generative-AI or deep-synthesis measures. A company cannot treat conformance with the framework as a substitute for those laws or claim a government safety certification solely because it follows the guide. Teams can use the framework to build a lifecycle review: define the system and context, identify technical and application risks, assign controls and owners, test them, monitor changes, and record residual risk. Use version 2.0 for current framing, compare it with applicable mandatory requirements, and record which measures are guidance versus legal obligations.