skip to content

China desk n. 02

China / Desk — 26 Oct 2026

Beijing answered a week of US measures against its AI firms with a mirror tool. The commerce ministry's draft rules would bar foreign entities that infringe Chinese trade secrets from trade, investment and entry. They will likely be adopted largely as drafted. The Party's cyberspace…

curated by Paolo De Rosa updated source tiers background essays how the desks work

Beijing answered a week of US measures against its AI firms with a mirror tool. The commerce ministry's draft rules would bar foreign entities that infringe Chinese trade secrets from trade, investment and entry. They will likely be adopted largely as drafted. The Party's cyberspace commission published the informatization plan to 2030, which names an AI law and extends model filing to agents; filing will likely come first. With the EU asking for new trade instruments, MOFCOM warned Brussels and London against further restrictions, and retaliation on consumer exports is the likely first answer. New export controls license tunnel borers only for unnamed countries "in dispute with China", while China takes agent security standards to ISO and prepares to ratify WAICO.

At a glance

Period covered: 16 to 26 October 2026.

  • The informatization plan for 2026 to 2030: an AI law, agent filing and NetID. China will likely extend model filing to AI agents within a year, before any AI law.
  • Washington's measures against Chinese AI, and Beijing's trade-secrets answer. MOFCOM will likely adopt the trade-secrets rules largely as drafted and use them first against a US firm, matching Washington's sanctions.
  • AI safety by standard: from TC260 to ISO and WAICO. China will almost certainly ratify WAICO in November, adding a governance body to its push on ISO standards for agents and model testing.
  • EU–China: the trade and tech deal track. Beijing will likely answer the next EU trade measure with targeted retaliation on consumer exports, not rare earths, while keeping the October deal alive.
  • Export controls: from AI know-how to tunnel borers, licences by destination. Beijing is likely to keep licensing by destination, naming no country, as its main new export-control design.

Coming up: 29 Oct, Fifth Plenum of the Party Central Committee, 26 to 29 October; 30 Oct, MIIT: 29 recommended national standard projects; 30 Oct, PBoC: draft rules for the central credit database; 2 Nov, NPC Standing Committee: 25th session, 2 to 6 November.


Threads

The informatization plan for 2026 to 2030: an AI law, agent filing and NetID

Regulation & Standards

Bottom line. China will likely extend model filing to AI agents within a year, before any AI law. The plan names both, but only filing has working machinery.
Likely (60 to 90%), moderate confidence. Main limit: the plan sets direction, not dates or drafts.

What happened. On 23 October the Party's top cyberspace body, the Central Cyberspace Affairs Commission, published China's informatization plan for 2026 to 2030. It sets 12 targets, among them the uptake of AI agents, and 25 tasks. On AI it goes further than earlier plans. It lists an AI law among the 'foundational' laws to advance, with laws on telecoms and cybercrime. It extends model filing to agents, on-device models and 'anthropomorphic' companion services. It also promises to promote the national network ID and to back WAICO, the AI body China proposed. (CAC)

Beijing's line. The internet regulator (CAC) presents the plan as the road to 网络强国, a 'cyber great power'. Data export is to get easier through sector guides, negative lists in free-trade zones and a one-stop service centre. Cooperation on data abroad is offered on reciprocity, in health, connected cars, fintech and AI.

Outside view. No major outside analysis had appeared by publication. The CAC's own question-and-answer text repeats the plan's priorities and adds no dates.

For Europe. Two groups in Europe are affected. AI providers that serve both markets will face Chinese filing for agents and companion apps, while the AI Act registers high-risk systems instead. Firms that move data out of China get clearer exits, but the reciprocity condition ties Chinese concessions to what Europe offers in return. The timing of both depends on CAC drafts not yet published.


Washington's measures against Chinese AI, and Beijing's trade-secrets answer

AI & Compute

Bottom line. MOFCOM will likely adopt the trade-secrets rules largely as drafted and use them first against a US firm, matching Washington's sanctions.
Likely (60 to 90%), moderate confidence. Main limit: no case is named, and Beijing has held back similar tools during past truces.

What happened. Washington moved against Chinese AI four times in a week. On 19 October the State Department sanctioned five entities, among them Shanghai Zhisuan Technology and the start-up investor MiraclePlus. The case rests on Google AI trade secrets that a former Google engineer was convicted of stealing. Homeland Security barred DeepSeek products from civilian agencies' systems. The Pentagon reported that universities had cut ties with listed Chinese institutes, and the Treasury proposed wider limits on investment in China. On 26 October MOFCOM answered with a draft to bar foreign entities that infringe Chinese trade secrets from trade, investment and entry, and to fine them. (MOFCOM)

Beijing's line. In four statements MOFCOM accused Washington of 泛化国家安全概念, 'stretching the concept of national security'. On DeepSeek it said China keeps AI 'safe, controllable and reliable' and urged use of the US–China AI dialogue. The draft's trigger is wide: harm, or a 'real threat', to China's interests.

Outside view. SCMP's experts expect the DeepSeek ban to deter US firms from adopting cheap Chinese models. The models keep gaining. DeepSeek's new Flash model topped Arena's open-model web-coding board, and Artificial Analysis ranked Kimi K3.1 Pro fourth overall.

For Europe. The draft covers any foreign entity. A European firm in a trade-secret dispute with a Chinese partner could face market exclusion by ministerial decision, not only a lawsuit. Once final, it applies at once. EU bodies weighing their own limits on DeepSeek should expect Beijing to treat them as political.


AI safety by standard: from TC260 to ISO and WAICO

Regulation & Standards · followed since 16 October 2026

Bottom line. China will almost certainly ratify WAICO in November, adding a governance body to its push on ISO standards for agents and model testing.
Almost certainly (90% or more), moderate confidence. Main limit: the WAICO text is unverified and its signatories are not published.

Since the last issue. Four new Chinese work items at ISO/IEC SC27, including an agent security reference model; WAICO ratification on the NPC Standing Committee agenda.

What happened. The national cybersecurity standards committee (TC260) reported that China won four new preliminary work items at ISO/IEC's security committee, SC27. Two are on AI: an agent security reference model and a safety evaluation of AI foundation models. The meetings ran from 8 September to 8 October, partly in Leuven and Kaunas, with 49 Chinese delegates. China now leads 25 standards there. Separately, the NPC Standing Committee will ratify the agreement creating the World AI Cooperation Organization (WAICO) at its 2 to 6 November session. (TC260)

Beijing's line. TC260 presents the results as turning Chinese national standards into international ones, which the new informatization plan asks for. In the CAC-affiliated magazine, commentary turns to agents: who is liable when an agent 'does the wrong thing' rather than says it. NERCIS relays the UN scientific panel's warning that loss-of-control risks are rising.

Outside view. NPC Observer reports that almost 40 countries have signed the WAICO agreement, which enters into force after three ratifications; it could not verify the circulating text. No major outside analysis of the SC27 items was found.

For Europe. European experts drafting AI Act standards will meet these Chinese drafts at ISO, where international standards are often adopted as European ones. An agent security model led by China could set the reference before CEN-CENELEC covers agents. The work items are at an early stage, so drafts are at least a year away.


EU–China: the trade and tech deal track

EU–China · followed since 16 October 2026

Bottom line. Beijing will likely answer the next EU trade measure with targeted retaliation on consumer exports, not rare earths, while keeping the October deal alive.
Likely (60 to 90%), moderate confidence. Main limit: the EU has not chosen its new instruments, so the trigger and its timing are unknown.

Since the last issue. EU leaders ask for new trade instruments on 16 October; MOFCOM warns Brussels and London against further restrictions.

What happened. EU leaders met on 15 and 16 October, a week after the hybrid-car arrangement with Beijing. Their conclusions do not name China. They 'took stock of global macroeconomic imbalances' and ask the Commission to 'urgently enhance the EU toolbox with new instruments'. Commission President von der Leyen called the deficit with China structural and unsustainable. France's President Macron proposed measures on chemicals, plastics and ferro-alloys. (MOFCOM)

Beijing's line. The commerce ministry (MOFCOM) replied the same day to reports of a 'dual-track' approach. It denied that EU pressure had worked and warned Europe not to 'underestimate China's determination'. On 19 October it told the UK not to 'dance to the EU's tune' on car tariffs, and threatened countermeasures. The foreign ministry kept a softer line: trade differences can be settled by dialogue.

Outside view. MERICS reads the hybrid deal as a pause, not a settlement. It expects any retaliation to start with goods China does not need, such as food, drink and luxury, as with cognac before. Rare earths would be the strongest lever, but Beijing still needs European machine tools and lithography. The Wire China argues the two sides are already in a trade war.

For Europe. European food, drink, cosmetics and luxury exporters are the most exposed if the Commission adds safeguards on chemicals or machinery. The trigger would be new EU instruments, which leaders want urgently but have not chosen. The rare-earth licences promised in October remain a second exposure: China can slow them without any formal measure.


Export controls: from AI know-how to tunnel borers, licences by destination

Semiconductors & Supply Chain · followed since 16 October 2026

Bottom line. Beijing is likely to keep licensing by destination, naming no country, as its main new export-control design. It lets MOFCOM target disputes without listing adversaries.
Likely (60 to 90%), moderate confidence. Main limit: the 'sensitive countries' are not named, so who is targeted cannot be checked.

Since the last issue. Announcements 49 to 52 of 19 October: tunnel-boring machines controlled for unnamed 'sensitive countries', drone controls eased, customs checks tightened.

What happened. On 19 October the commerce ministry (MOFCOM) and customs put tunnel-boring machines, walking excavators and high-altitude concrete sprayers, with parts and know-how, under export control from 18 November. A licence is needed only for 'sensitive countries and regions in dispute with China', which the rule does not name. Elsewhere, exporters register and buyers promise not to pass the goods on. The same day, with the military's equipment department, MOFCOM eased drone controls and tightened customs checks on suspected dual-use goods. (MOFCOM)

Beijing's line. MOFCOM calls the items clearly dual-use and the step 'international practice'. It says it told the countries in its export-control dialogues in advance. On drones it says some once-advanced products are now consumer goods, and that it supports civilian drone trade.

Outside view. ChinaTalk calls the technology catalogue a 'toolbox of weaponizable dependencies' now extended to AI, and notes the interim registration of 16 October has no precedent. SCMP's analysts see short-term costs for Chinese AI developers and longer-term leverage for Beijing.

For Europe. European contractors and dealers that buy Chinese tunnelling machines for projects abroad are bound by the re-export ban, even outside China. Without a published list, their compliance teams cannot tell which destinations count until a licence is refused. The drone easing helps European buyers of civilian drones from 18 November.


Signals

Regulation & Standards

Cyber Operations & Attribution

AI & Compute

Semiconductors & Supply Chain

Platforms & Data

Digital Sovereignty & Identity

Narrative & Discourse


Worth reading


Background from cyber/verso


Watchlist

Date What Type
29 Oct Fifth Plenum of the Party Central Committee, 26 to 29 October. Opened on 26 October with a decision on strict Party governance; watch the communiqué for technology and AI-safety language event
30 Oct MIIT: 29 recommended national standard projects consultation
30 Oct PBoC: draft rules for the central credit database consultation
2 Nov NPC Standing Committee: 25th session, 2 to 6 November. Also the Criminal Procedure Law amendment and the anti-cross-border-corruption bill event
13 Nov CAC: platforms must file for designation as having huge numbers of minor users event
13 Nov MOFCOM: draft rules on export certificates for civil-aviation dual-use items consultation
15 Nov MIIT: draft 2026 norms for the photovoltaic manufacturing industry. Industry entry rules at a time of overcapacity consultation
15 Nov MOFCOM and MOST: revision of the technology export-control list. Interim export registration already in force consultation
16 Nov MIIT: 62 industry standard projects consultation
18 Nov MIIT: draft guide to the national connected-vehicle standards system consultation
18 Nov MOFCOM: export controls on tunnel-boring machines and adjusted drone and dredger controls take effect event
24 Nov MOFCOM: draft Special Provisions on Protecting Chinese Trade Secrets. Sanctions on foreign entities; in force on publication once final consultation
1 Dec NDRC: new Measures for the Administration of Outbound Investment take effect. 76 articles, replacing the 2017 measures; investors now include individuals event

Term of the issue

泛化国家安全概念, stretching the concept of national security

MOFCOM's standard charge against US measures: that Washington calls ordinary trade, research and investment a security matter. This issue it appeared in replies on the DeepSeek ban, the Pentagon's research review and the Treasury's investment rules. The same week MOFCOM drafted rules that act whenever foreign conduct poses a 'real threat' to China's 'sovereignty, security or development interests', a trigger at least as wide. The phrase describes the other side's method; it is not a limit Beijing applies to itself.


Sources and originals

Primary sources, Chinese originals and the basis of each assessment.

The informatization plan for 2026 to 2030: an AI law, agent filing and NetID

  • Anchor: The Central Cyberspace Affairs Commission issues the 15th Five-Year national informatization plan, 国家互联网信息办公室 (CAC) (T1 · doctrine)
    • 原题: 中央网络安全和信息化委员会印发《国家信息化“十五五”规划》
  • Reading: Q&A on the 15th Five-Year national informatization plan, 国家互联网信息办公室 (CAC) (official)
    • 原题: 《国家信息化“十五五”规划》答记者问
  • Chinese terms in the text: 国家信息化“十五五”规划; 对等互利
  • Indicators to watch: A CAC draft on filing for AI agents or companion services; An AI law on the State Council or NPC legislative plan; Free-trade-zone negative lists for data export in sectors that matter to EU firms.
  • Assessment: likely, moderate confidence. Basis: Primary text (plan PDF, sections 10 and 11) and the CAC question-and-answer text; the generative-AI filing system has run since 2023; the plan gives no date for an AI law.
  • EU frameworks: AI Act, GDPR, Data Act, EU Digital Identity Wallet

Washington's measures against Chinese AI, and Beijing's trade-secrets answer

AI safety by standard: from TC260 to ISO and WAICO

EU–China: the trade and tech deal track

Export controls: from AI know-how to tunnel borers, licences by destination

Signals, claim checks

  • CNCERT investigation report on malicious tampering with DNS resolution data by the foreign autonomous system AS 402425. Claim check: The redirection of Chinese users to gambling sites was carried out by tampering inside AS 402425, registered by the US company QOREXA LABS, which runs a bitcoin-related business. Claimed by CNCERT (20 October), reposted by NERCIS and China Information Security. Evidence offered: A description of the method (false route prefixes and AS sets registered in routing registries, then DNS rewriting), the registration date and a list of IP addresses; no routing data or packet captures published. Response: No response from QOREXA LABS or ARIN found; no US government reaction, and CNCERT does not accuse one. Independent sources: 0.

Signals, original titles

  • CNCERT investigation report on malicious tampering with DNS resolution data by the foreign autonomous system AS 402425: 关于中国境外自治域AS 402425恶意篡改部分DNS解析数据的调查报告
  • CNCERT in-depth report on the Silver Fox trojan group 'Jingtan (G02)': 关于“银狐”木马“镜昙(G02)”团伙攻击态势深入分析报告
  • CAC launches designation of platforms with huge numbers of minor users or significant influence on minors: 关于开展未成年人用户数量巨大和对未成年人群体具有显著影响的网络平台服务提供者认定工作的公告
  • State Council General Office Opinions on adapting to AI development to build an employment-friendly development model: 国办关于适应人工智能技术发展助力构建就业友好型发展方式的意见
  • Opinions of the General Offices of the CPC Central Committee and the State Council on deep integration of scientific and industrial innovation: 中办国办关于推动科技创新和产业创新深度融合的意见
  • MIIT consults on five mandatory national standards, including Car Data Security Requirements: 公开征求《汽车数据安全要求》等五项强制性国家标准的意见
  • China's first mandatory national standard on spatio-temporal data security for intelligent connected vehicles: 我国首部智能网联汽车时空数据安全强制性国家标准发布
  • Eight departments issue the 15th Five-Year plan to raise industrial foundation capabilities: 工业和信息化部等八部门关于印发《产业基础能力提升“十五五”规划》的通知
  • National Data Group founded: 国家数据集团成立
  • What the full upgrade of the digital yuan's 'foundation' will change: 数字人民币“基座”全面升级将带来哪些改变
  • CVERC finds 84 apps collecting and using personal information unlawfully: 国家计算机病毒应急处理中心检测发现84款违法违规收集使用个人信息的移动应用(2026.10.26)

Watchlist, full titles

  • 29 Oct: Fifth Plenum of the Party Central Committee, 26 to 29 October (原题: 二十届五中全会)
  • 30 Oct: MIIT: 29 recommended national standard projects, including supply-chain cybersecurity requirements for intelligent connected vehicles (原题: 《智能网联汽车 供应链网络安全技术要求及试验方法》等29项推荐性国家标准计划项目)
  • 30 Oct: PBoC: draft rules for the central credit database (原题: 金融信用信息基础数据库管理办法(征求意见稿))
  • 2 Nov: NPC Standing Committee: 25th session, 2 to 6 November, including ratification of the WAICO agreement (原题: 十四届全国人大常委会第二十五次会议)
  • 13 Nov: CAC: platforms must file for designation as having huge numbers of minor users (20 working days from 16 October) (原题: 未成年人用户数量巨大和对未成年人群体具有显著影响的网络平台服务提供者认定)
  • 13 Nov: MOFCOM: draft rules on export certificates for civil-aviation dual-use items (原题: 民用航空领域相关两用物项出口凭证管理办法(征求意见稿))
  • 15 Nov: MIIT: draft 2026 norms for the photovoltaic manufacturing industry (原题: 光伏制造行业规范条件(2026年本)(征求意见稿))
  • 15 Nov: MOFCOM and MOST: revision of the technology export-control list (40 items) (原题: 《中国禁止出口限制出口技术目录》修订公开征求意见)
  • 16 Nov: MIIT: 62 industry standard projects, including data security protection requirements for industrial internet platforms (原题: 《工业互联网平台数据安全保护要求》等62项行业标准计划项目)
  • 18 Nov: MIIT: draft guide to the national connected-vehicle standards system (2026 edition) (原题: 国家车联网技术标准体系建设指南(2026版)(征求意见稿))
  • 18 Nov: MOFCOM: export controls on tunnel-boring machines and adjusted drone and dredger controls take effect (原题: 商务部 海关总署公告2026年第49号、第50号、第51号)
  • 24 Nov: MOFCOM: draft Special Provisions on Protecting Chinese Trade Secrets (原题: 保护中国商业秘密特别规定(征求意见稿))
  • 1 Dec: NDRC: new Measures for the Administration of Outbound Investment take effect (原题: 对外投资管理办法)

Term of the issue. First seen 2026-10-26 (MOFCOM spokesperson, 20 to 24 October 2026); last seen 2026-10-26.


Glossary

  • CAC: Cyberspace Administration of China, the internet regulator
  • CNCERT: National Computer Network Emergency Response Team of China
  • CPC: Communist Party of China
  • CVERC: National Computer Virus Emergency Response Center
  • MERICS: Mercator Institute for China Studies, Berlin
  • MIIT: Ministry of Industry and Information Technology
  • MOFCOM: Ministry of Commerce
  • MOST: Ministry of Science and Technology
  • NDRC: National Development and Reform Commission, the planning agency
  • NERCIS: National Engineering Research Center for Information Security
  • NPC: National People's Congress
  • PBoC: People's Bank of China
  • TC260: National Cybersecurity Standardisation Technical Committee

How the desk works, and how to report an error: method and corrections.

newsletter

subscribe to cyber/verso

subscribe to receive cyber/verso's articles by email. Free, no tracking pixels, no tracked links. You can unsubscribe at any time. privacy notice.