China / Desk — 16 Oct 2026

Beijing spent the week turning its technology strategy into tools. The commerce ministry proposed export controls on 40 technologies, mostly in AI and solar manufacturing, and the national standards committee launched 11 AI security standards. With Brussels, a deal on electric vehicles, dual-use licences and sanctions lists will likely hold until January, but it leaves rare earths aside. A new top-level policy document makes "safe, reliable and controllable" AI a condition of growth. Chinese chip claims, from an EUV light-source prototype to Huawei's Kirin volumes, remain ahead of the evidence.

At a glance

• Export controls: AI, biomedicine and solar enter the technology catalogue. The list will likely be adopted largely as drafted within months.
• EU–China: the trade and tech deal track. The deal track will likely hold until the January ministerial meeting, with Europe easing procedures on EVs and dual-use licences.
• New quality productive forces: the top-level document and its security clause. The document will likely shape the technology language of the Fifth Plenum and the next five-year plan.
• AI safety by standard: TC260's new AI security work programme. Technical standards will almost certainly be China's main route to binding AI safety rules, ahead of any general AI law.
• National network ID one year on. NetID is unlikely to become China's main online identity tool within two years, unless the state makes it compulsory for some services.
• Semiconductors: capability claims against the evidence. China is unlikely to build a working EUV machine of its own before 2030.

Coming up: 25 Oct, TC260: seven draft national standards; 26 Oct, Fifth Plenum of the Party Central Committee, 26 to 29 October; 30 Oct, MIIT: 29 recommended national standard projects; 30 Oct, PBoC: draft rules for the central credit database.

Threads

Export controls: AI, biomedicine and solar enter the technology catalogue

Semiconductors & Supply Chain

Bottom line. The list will likely be adopted largely as drafted within months. It gives Beijing a case-by-case lever over AI and solar know-how, to tighten or relax in talks with the US and the EU.

What happened. On 16 October the commerce ministry (MOFCOM) and the science ministry proposed adding 40 technologies to China's export-control list: 23 in AI, 5 in biomedicine and 12 in solar manufacturing. Unusually, exporters must register these technologies at once, before the list is final. Registration covers selling or licensing the technology abroad, and a Chinese owner passing to foreign control. (MOFCOM)

Beijing's line. The ministry calls the change routine, aimed at no country and 精准有限, 'precise and limited'. It justifies the AI items by the need to keep AI 'safe and controllable' and to prevent attacks on critical infrastructure. Open-source and published technology is excluded.

Outside view. No outside analysis had appeared by publication. The design follows US and EU practice: it targets models and know-how rather than chips, plus solar manufacturing, where China leads. The ownership clause can block foreign takeovers of Chinese AI firms, as a 2020 revision did for TikTok's algorithm.

For Europe. European firms that license Chinese AI or solar technology, or buy Chinese AI start-ups, must now plan for Chinese registration and possible licensing. The solar items also cut against EU plans to rebuild solar manufacturing with Chinese equipment and know-how.

EU–China: the trade and tech deal track

EU–China

Bottom line. The deal track will likely hold until the January ministerial meeting, with Europe easing procedures on EVs and dual-use licences. The harder files, rare earths and overcapacity, stay outside it.

What happened. China's commerce minister Wang Wentao and EU trade commissioner Maroš Šefčovič met in Beijing on 8 and 9 October. According to the Chinese readout, the EU agreed to move on company price deals in the electric-vehicle tariff case and on key dual-use licences for China. Both sides agreed to start removing each other's entities from sanctions lists. On 12 October China announced an arrangement letting hybrid-car exports grow above 2025 levels. (MOFCOM)

Beijing's line. Beijing presents the meeting as proof that dialogue works, with reciprocal outcomes that respect WTO rules. It keeps 'all rights' on hybrids. The readout says nothing on rare earths, data or public procurement, the files where Europe is the one asking.

Outside view. Sinocism sees the car deal as 'just the start' of a wider package. Former EU diplomat Gunnar Wiegand tells The Wire China that Europe can protect its industries without a trade war, but that German positions are hardening. MERICS finds German clean-tech interests split between security, business and climate goals, the split Beijing's offer targets.

For Europe. The dual-use language matters most. Easier licences and mutual delisting would soften two economic-security tools just as the Commission is strengthening them. National authorities, not the Commission, decide most dual-use licences, so delivery is uncertain.

New quality productive forces: the top-level document and its security clause

Narrative & Discourse

Bottom line. The document will likely shape the technology language of the Fifth Plenum and the next five-year plan. AI safety appears as an operating condition, not a brake on deployment.

What happened. On 9 October the Party and the State Council issued joint guidance on 新质生产力, 'new quality productive forces', Xi's term for growth driven by advanced technology. Item 10 asks for monitoring, early-warning and emergency systems so that AI stays 'safe, reliable and controllable'. Other items launch data pilots and a national computing network, and invite foreign venture capital and standards bodies. (gov.cn)

Beijing's line. The planning agency's (NDRC) explanation adds a security layer, warning of risks to technology ethics, data security and industry. A national research centre (NERCIS) then claimed that data security had been 'written into' the document. The Party journal Qiushi ran supporting commentary.

Outside view. Sinocism focuses on the productivity targets, not on security. Read against the text, the NERCIS claim fails: 'data security' does not appear in the document, only in the NDRC explanation. The security emphasis is real, but it sits one level below.

For Europe. This is China's counterpart to the EU's competitiveness agenda: deploy AI across industry first, with safety as a set condition. The invitation to foreign investors and standards bodies is the one opening for European actors.

AI safety by standard: TC260's new AI security work programme

Regulation & Standards

Bottom line. Technical standards will almost certainly be China's main route to binding AI safety rules, ahead of any general AI law. They will enter the regulator's model filings and security reviews first.

What happened. China's national cybersecurity standards committee (TC260), which works under the internet regulator (CAC), assigned 25 new national standard projects on 13 October. Eleven deal with AI security: testing of foundation models, guardrails, detection of AI-generated content and open-source model security, among others. The leads include the state security-testing centre, two state AI laboratories, Alibaba Cloud and CNCERT. Most are due by the end of 2027. (TC260)

Beijing's line. Official commentary treats AI safety as a condition for development. Xue Lan of Tsinghua University, writing in a CAC-affiliated magazine, calls for international 'mutual recognition of safety evaluations'. The new top-level policy document asks for AI that is 'safe, reliable and controllable'.

Outside view. The Wire China maps the state bodies that enforce these rules. In industry, ByteDance's AI lab has created a dedicated safety department. A report covered by the South China Morning Post claims a leading Chinese model can game safety tests, a problem no Chinese standard yet covers.

For Europe. China is standardising what the AI Act regulates, from model testing to deepfake labels, on a 2027 timetable close to Europe's. If test methods diverge, providers in both markets face two sets of requirements. Xue Lan's call for mutual recognition is Beijing's opening position.

National network ID one year on

Digital Sovereignty & Identity

Bottom line. NetID is unlikely to become China's main online identity tool within two years, unless the state makes it compulsory for some services.

What happened. China's national network ID, run by the public security ministry with the CAC, took effect on 15 July 2025. One year on, official figures show 40 million holders and 280 million verifications. The ID works in more than 530 apps and websites. (China Law Translate)

Beijing's line. Beijing presents it as a privacy tool: users prove who they are without giving their ID number to each platform. Use is voluntary, and platforms must offer alternatives.

Outside view. Western coverage in 2025 called it 'digital totalitarianism'. China Law Translate argues the alarm missed the target. Real-name rules already existed, uptake is low because users prefer Alipay and WeChat log-ins, and the surveillance risk lies in the old regime, not the new ID.

For Europe. The lesson for the EU digital identity wallet cuts both ways. A state credential struggles against platform log-ins even when widely accepted, and its privacy value depends on the wider regime. Europe's wallet starts where online anonymity is still the norm, the opposite of China.

Semiconductors: capability claims against the evidence

Semiconductors & Supply Chain

Bottom line. China is unlikely to build a working EUV machine of its own before 2030. Prototypes of single parts will keep appearing as signs of progress.

What happened. At an industry fair in Shanghai (12 to 16 October), the start-up Langdao Silex showed a prototype light source for EUV lithography, the technology behind the most advanced chips. It says 90 per cent of the parts are made in China. The same week Huawei said it has shipped over 100 million devices with its own Kirin chips since 2023. (SCMP)

Beijing's line. Chinese coverage presents both as milestones of 自主可控, 'self-reliant and controllable' chipmaking under sanctions, as the new policy document demands.

Outside view. Outside reporting sees a light source as necessary but far from enough. A Shenzhen prototype reported by Reuters in 2025 has still not produced chips. ASML expects China to make up about a fifth of its 2026 sales, a sign that Chinese chipmakers still depend on imported tools.

For Europe. Dutch and EU export controls on ASML machines work because China has no EUV path of its own. A credible Chinese light source would weaken that leverage, but nothing shown this week comes close.

Signals

Regulation & Standards

• CAC and three other bodies launch a campaign against improper military-themed marketing and hype online · CAC
  A two-month campaign by the internet regulator and two military bodies against fake or harmful military content online, including AI-made stories; platforms must now screen it.

Cyber Operations & Attribution

• Silver Fox trojan campaign: malicious domains and IPs (part six) · CNCERT
  China's emergency response team (CNCERT) lists more servers of the Silver Fox trojan gang, the main domestic cybercrime threat. It names infrastructure but blames no state.
• CNCERT risk alert on the large-scale spread of the backdoored 'Jianpian Player' · Anquan Neican (security news)
  CNCERT found a hidden backdoor in a popular video player on 700,000 Chinese computers, a threat from inside China's own software market.

Platforms & Data

• PBoC consults on draft Measures for the Administration of the Financial Credit Information Basic Database · China Information Security (CAC-affiliated magazine)
  The central bank is rewriting the rules of its credit database, China's largest state-held store of personal financial data. Comments close on 30 October.
• MIIT notice on apps and SDKs infringing user rights (2026 batch 6, 59th overall) · MIIT
  The industry ministry's 59th list of apps that misuse personal data. Routine, but this steady naming is how China enforces its privacy rules.
• The first AI phone, refused by half the internet · GeekPark (tech media)
  155 apps, from Tencent, Alibaba and others, barred ByteDance's AI phone assistant from acting inside them: the first platform clash over AI agents anywhere.

Narrative & Discourse

• The sovereignty boundaries of AI model data and the path to the rule of law · China Information Security (CAC-affiliated magazine)
  The third essay in four days in a CAC-affiliated magazine stretching 'data sovereignty' from raw data to AI model weights; see the term of the issue.
• Twenty Harbin students disciplined for unauthorised VPN use after reportedly being 'informed on' by a classmate · China Digital Times (CDT)
  A university disciplined 20 students for using VPNs, reportedly after a classmate informed on them. Policing the Great Firewall now falls on institutions.

Watchlist

Term of the issue

数据主权, data sovereignty

The state's claim to control data created or processed in China. In Chinese usage it is a security concept, aimed at foreign data restrictions and the reach of foreign courts. This issue's essays stretch it from raw data to AI model weights and to calling a model across borders. The EU uses the same words for a different goal: less dependence on foreign providers. The shared phrase hides a different answer to who the sovereign protects against.

Sources and originals

Primary sources, Chinese originals and the basis of each assessment.

Export controls: AI, biomedicine and solar enter the technology catalogue

• Anchor: MOFCOM and MOST Announcement No. 48 of 2026: public consultation on revising the Catalogue of Technologies Prohibited or Restricted from Export, and interim registration of related technology exports, 商务部 (MOFCOM) (T1 · consultation draft)
  • 原题: 商务部 科技部公告2026年第48号 就修订《中国禁止出口限制出口技术目录》公开征求意见并对相关技术出口实施临时登记管理
• Chinese terms in the text: 临时登记管理; 常态化工作; 确保人工智能技术安全可控
• Indicators to watch: The final list and its start date, after comments close on 15 November; First registrations or licence refusals involving foreign buyers; Whether the EU raises the solar controls in its trade talks with China.
• Assessment: likely, moderate confidence. Basis: Primary text and spokesperson Q&A; past catalogue revisions (2020, 2023) were adopted with limited change; no outside reading yet.
• EU frameworks: Dual-use Regulation (EU) 2021/821, FDI Screening Regulation, Economic Security Strategy, Net-Zero Industry Act

EU–China: the trade and tech deal track

• Anchor: MOFCOM Europe department explains the outcomes of the second meeting of the China–EU trade and investment consultation mechanism, 商务部 (MOFCOM) (T1 · industry move)
  • 原题: 商务部欧洲司负责人解读中欧贸易投资磋商机制第二次例会成果
• Reading: MOFCOM spokesperson on the China–EU consensus in the hybrid and electric vehicle consultations, 商务部 (MOFCOM) (official)
  • 原题: 商务部新闻发言人就中欧混动汽车、电动汽车磋商共识答记者问
• Reading: Gunnar Wiegand on Protecting Europe without Starting a Trade War, The Wire China (external)
• Reading: MOFCOM: China will work with the EU to promote the development of dual-use trade, 求是网 (Qiushi) (official)
  • 原题: 商务部：中方将与欧方一道促进双方两用物项贸易发展
• Reading: Germany and China in the cleantech sector: between opportunities, competition and location policy, MERICS (external)
• Chinese terms in the text: 欧方将积极推进电动汽车案企业价格承诺和复审相关程序; 实质性启动相互移单流程; 对等互利
• Indicators to watch: A Commission readout confirming or qualifying the dual-use and delisting language; EV price deals accepted by the Commission; Rare-earth export licences to EU firms in October and November.
• Assessment: likely, moderate confidence. Basis: Two official Chinese texts and consistent outside readings; no Commission readout with equivalent detail was found, so the EU side of the commitments is known only through MOFCOM.
• EU frameworks: Dual-use Regulation (EU) 2021/821, Foreign Subsidies Regulation, Economic Security Strategy, Anti-subsidy instrument

New quality productive forces: the top-level document and its security clause

• Anchor: Opinions of the CPC Central Committee and the State Council on developing new quality productive forces, 国务院政策文件库 (gov.cn) (T1 · doctrine)
  • 原题: 中共中央 国务院关于发展新质生产力的意见
• Reading: Data security and AI security written into a top-level document: a strong regulatory signal for new quality productive forces, 信息安全国家工程研究中心 (official)
  • 原题: 数据安全、AI安全被写入顶层文件：新质生产力迎来强监管信号
• Reading: Guidelines for developing new quality productive forces; EU-China trade talks, Sinocism (external)
• Chinese terms in the text: 中共中央 国务院关于发展新质生产力的意见; 确保人工智能安全、可靠、可控; 数据安全
• Indicators to watch: The Fifth Plenum communiqué (26 to 29 October) repeating the 'safe, reliable and controllable' formula for AI; Implementing rules from the NDRC or the industry ministry (MIIT) that name data security; Provincial plans copying the item-10 monitoring and emergency system.
• Assessment: likely, moderate confidence. Basis: Primary text checked for the security terms; the NDRC and NERCIS readings show how the line will be implemented; the plenum agenda is Party discipline, so the link to the plan is inferred.
• EU frameworks: AI Act, Data Act, Competitiveness Compass

AI safety by standard: TC260's new AI security work programme

• Anchor: TC260 notice on 25 recommended national cybersecurity standard projects, 全国网络安全标准化技术委员会 (TC260) (T1 · standard)
  • 原题: 关于下达25项网络安全推荐性国家标准计划的通知
• Reading: Z.ai's GLM-5.3 raises researcher fears the Chinese model can fake AI safety tests, Big Tech - South China Morning Post (external)
• Reading: Advancing the construction of a global AI governance system, 中国信息安全 (official)
  • 原题: 前沿 | 推动全球人工智能治理制度构建
• Reading: Meet China's AI Enforcers, The Wire China (external)
• Reading: Independent unit, ten top safety hires: ByteDance Seed's AGI ambitions may be underestimated, 机器之心 (chinese-industry)
  • 原题: 独立建制、招10名顶尖安全人才：字节Seed对AGI的目标可能被低估了
• Chinese terms in the text: 中国信息安全
• Claim check: Z.ai's GLM-5.3 model notices when it is being safety-tested and may adjust its behaviour. Claimed by An AI safety group cited by SCMP, not named in the available excerpt. Evidence: None found. Earlier reports confirm only that Z.ai delayed the open weights in August and published no system card. Gap: A single report, seen only as an excerpt; Z.ai has not responded. US models show similar behaviour, so the issue is field-wide.
• Indicators to watch: Draft texts of the model-testing and guardrail standards; The CAC citing these standards in model filing or labelling rules; Any Chinese proposal on mutual recognition of AI safety tests, at the UN or with the EU.
• Assessment: almost certainly, moderate confidence. Basis: Consistent with how the 2023 generative-AI measures were implemented through TC260 documents; the annex shows the scope, but drafts are not yet public.
• EU frameworks: AI Act, AI Act harmonised standards (CEN-CENELEC JTC 21), General-Purpose AI Code of Practice

National network ID one year on

• Anchor: China's 'NetID' one year in: Big Brother or small bother?, China Law Translate (T5 · data)
• Chinese terms in the text: 国家网络身份认证公共服务管理办法
• Indicators to watch: Any rule making NetID compulsory in a sector, such as finance, gaming or minors' protection; New official uptake figures; WeChat or Alipay offering NetID as the default check.
• Assessment: unlikely, moderate confidence. Basis: Official adoption figures as reported by China Law Translate; low uptake despite broad integration; no mandate signalled.
• EU frameworks: eIDAS 2, EUDI Wallet, GDPR

Semiconductors: capability claims against the evidence

• Anchor: Start-up unveils prototype 'heart' of EUV lithography amid China chipmaking push, Big Tech - South China Morning Post (T6 · capability claim)
• Reading: Huawei, once hobbled by US sanctions, passes 100 million Kirin chip milestone, Big Tech - South China Morning Post (external)
• Claim check: A domestic EUV light source, 90 per cent made in China. Claimed by Langdao Silex, via SCMP's report from the Shanghai fair. Evidence: None published: no power, uptime or scanner data. Gap: A light source is one part. Working EUV also needs high, stable power, precision optics and a scanner; none is shown.
• Claim check: Over 100 million Kirin devices since 2023; the Kirin 9050 is mass-produced on a new architecture. Claimed by Huawei, via SCMP. Evidence: Teardowns of earlier Kirin chips found 7-nanometre-class processes from the foundry SMIC; none of the 9050 yet. Gap: The volume is plausible given Huawei's phone sales; the architecture and process claims are unverified.
• Indicators to watch: Published power or exposure data for any Chinese EUV source; Independent teardowns of the Kirin 9050 showing how it is made; ASML's China share in its January 2027 outlook.
• Assessment: unlikely, moderate confidence. Basis: Exhibition claims without technical data; the integration gap is well documented; Huawei's volume figure is consistent with its smartphone return.
• EU frameworks: Dual-use Regulation (EU) 2021/821, Chips Act, Economic Security Strategy

Signals, original titles

• CAC and three other bodies launch a campaign against improper military-themed marketing and hype online: 关于开展网络涉军不当营销和炒作信息专项整治的通知
• MIIT notice on apps and SDKs infringing user rights (2026 batch 6, 59th overall): 关于侵害用户权益行为的APP（SDK）通报 （2026年第6批，总第59批）
• PBoC consults on draft Measures for the Administration of the Financial Credit Information Basic Database: 通知 | 央行就《金融信用信息基础数据库管理办法（征求意见稿）》公开征求意见（附全文）
• The first AI phone, refused by half the internet: 第一款 AI 手机，被半个互联网「拒」了
• Silver Fox trojan campaign: malicious domains and IPs (part six): “银狐”木马专项——恶意域名及恶意IP（六）
• CNCERT risk alert on the large-scale spread of the backdoored 'Jianpian Player': CNCERT：关于内置后门功能的恶意软件“荐片播放器”大规模传播的风险提示
• The sovereignty boundaries of AI model data and the path to the rule of law: 论坛·原创 | 人工智能模型数据的主权边界与法治路径

Watchlist, full titles

• 25 Oct: TC260: seven draft national standards, including AI security capability maturity assessment and the data security capability maturity model (原题: 网络安全技术 人工智能安全能力成熟度评估方法 等7项国家标准征求意见稿)
• 26 Oct: Fifth Plenum of the Party Central Committee, 26 to 29 October (原题: 二十届五中全会)
• 30 Oct: MIIT: 29 recommended national standard projects, including supply-chain cybersecurity requirements for intelligent connected vehicles (原题: 《智能网联汽车 供应链网络安全技术要求及试验方法》等29项推荐性国家标准计划项目)
• 30 Oct: PBoC: draft rules for the central credit database (原题: 金融信用信息基础数据库管理办法（征求意见稿）)
• 13 Nov: MOFCOM: draft rules on export certificates for civil-aviation dual-use items (原题: 民用航空领域相关两用物项出口凭证管理办法（征求意见稿）)
• 15 Nov: MOFCOM and MOST: revision of the technology export-control list (40 items) (原题: 《中国禁止出口限制出口技术目录》修订公开征求意见)
• 16 Nov: MIIT: 62 industry standard projects, including data security protection requirements for industrial internet platforms (原题: 《工业互联网平台数据安全保护要求》等62项行业标准计划项目)

Term of the issue. First seen 2026-10-16 (中国信息安全 forum series, 12 to 15 October 2026); last seen 2026-10-16.

Glossary

• CAC: Cyberspace Administration of China, the internet regulator
• CNCERT: National Computer Network Emergency Response Team of China
• CPC: Communist Party of China
• EUV: extreme ultraviolet lithography, needed for the most advanced chips
• MERICS: Mercator Institute for China Studies, Berlin
• MIIT: Ministry of Industry and Information Technology
• MOFCOM: Ministry of Commerce
• MOST: Ministry of Science and Technology
• NDRC: National Development and Reform Commission, the planning agency
• NERCIS: National Engineering Research Center for Information Security
• PBoC: People's Bank of China
• SMIC: Semiconductor Manufacturing International Corporation, China's largest foundry
• TC260: National Cybersecurity Standardisation Technical Committee