⚠️ Editorial note: The open source ecosystem in China operates under a distinct institutional framework — characterized by state-led initiatives, intranet-like boundaries, and top-down governance. Readers should be aware that this context differs from the community-driven open source model common in other regions. The term “open source” as used in Chinese media may refer to practices that diverge from the conventional definition.

China Open Source Daily — 2026-10-18

🏛️ Policy & Regulation — TC260’s “Guidelines for the Security of Open-Source AI Models” Moves From Participant Recruitment to Formal Drafting on 2026-09-30, While GB/T 48110-2026 on Open-Source Model Platforms Enters Force on 2026-12-01

1. National Technical Committee 260 on Cybersecurity (TC260) — National Standard Plan No. 20264767-T-469, 《网络安全技术 人工智能模型开源安全指南》 (“Cybersecurity Technology — Guidelines for the Security of Open-Source AI Models”), plan issued 2026-09-30, status “in drafting” (正在起草), 15-month project cycle, ICS 35.030, administered by the Standardization Administration of China.

2. The drafting coalition: lead drafting unit Zhejiang University, with the China Electronics Standardization Institute (CESI, 中国电子技术标准化研究院) and Pujiang National Laboratory (浦江国家实验室). This is the same Zhejiang-led item that TC260’s WG9 (AI Safety) put into participant recruitment on 2026-08-03 with an application deadline of 2026-08-14 — a recruitment notice that, until now, was the only publicly documented trace of the standard. The 2026-09-30 plan number is what converts an unfunded participant call into a budgeted standard project with a clock attached.

3. Its sibling cluster, assigned around the same period, defines the perimeter: 20264764-T-469 《人工智能模型开发安全指南》 (AI model development security guide), 20264773-T-469 《人工智能基础模型安全测试方法》 (foundation-model security testing methods), 20264771-T-469 《端侧大模型网络安全指南》 (on-device large-model cybersecurity guide), 20263731-Z-469 《大模型安全网关产品安全指南》 (large-model security gateway product security guide). Five documents, five different points in a model’s life: open-sourcing, development, testing, on-device deployment, and gateway interception.

4. The adjacent publication track: GB/T 48110-2026 《人工智能 开源模型平台技术要求》 (“Artificial intelligence — Technical requirements for open source model platform”), published 2026-08-28, implementing 2026-12-01, under TC28/SC42 (the AI subcommittee of the national information technology standardization committee). Plan No. 20243672-T-469, issued 2024-12-31. Drafting units: CESI, the OpenAtom Foundation (开放原子开源基金会), Alibaba Cloud, BAAI, Inspur Software, Beijing Software Product Quality Testing and Inspection Center, and Harbin Institute of Technology (Shenzhen). Lead drafters include Fan Kefeng (CESI) and Li Bo (OpenAtom).

5. The deadline structure: GB/T 48110-2026 binds on 2026-12-01 — six weeks after this briefing. The open-source model security guide has 15 months from 2026-09-30, i.e. a drafting window ending roughly 2027-12-30. One track is closing; the other has just opened.

Institutional Analysis & Commentary:

The two documents are usually read as one policy story (“China regulates open-source AI”). They are actually two different institutional objects, and the difference is the analytically interesting part.

  • GB/T 48110-2026 governs the platform; the security guide governs the act. A “technical requirements for open source model platform” standard does not reach into your licence or your community. It reaches into the thing that warehouses weights and serves them: repository interfaces, download paths, provenance and version metadata, model cards, availability guarantees. It is an infrastructure standard in the strict sense — it specifies what a distribution surface must look like for downstream state verification to be mechanically possible. The security guide, by contrast, reaches into the act of open-sourcing: what a publisher must assess before release, and what must be told to the downloader afterwards. Read jointly, the pair converts “open source” in China from a licence-permission regime (the right to use, modify, distribute, conditioned by a legal instrument) into an infrastructure-disclosure regime (the obligation to expose provenance, provenance-adjacent risk, and downstream responsibility through a compliant channel). This is not a Chinese peculiarity; it is the general drift of AI-era open-source governance everywhere. What is distinctive is the completeness of the chain and its administrative authorship: TC28/SC42 plus OpenAtom for the platform, TC260/WG9 plus a national laboratory and a university for the act.

  • The disclosed vocabulary of the obligation is already on the record. TC260’s AI Safety Governance Framework 3.0 (released 2026-09-14) contains the passage the security guide inherits almost verbatim (Section 4.4.4): while cultivating the open-source innovation ecosystem, one must simultaneously raise open-source ecosystem security capability; encourage open-sourcing of training and inference frameworks, software tools, key components and evaluation benchmarks to further improve open-model transparency; and have open-model providers and open-source communities jointly perfect open-source rules, strengthen the security-responsibility and risk-hazard-notification responsibility and obligation owed to model download users, and make explicit the “prohibited behaviours” (禁止性行为) of open-model download and use, in order to prevent misuse. Three words in that list are institutionally loaded. Obligation (责任义务) makes publication a continuing duty rather than a one-time act. Notification (告知) makes the publisher’s communication channel a regulated artefact. Prohibited behaviours introduces downstream-use restrictions into the open-source channel — a concept that classic FLOSS licensing handles through conditions of use, and that standard-setting now handles through a state-authored list. Whether those three words survive into the standard text is the open question; that they are the drafting brief is not.

  • The drafting coalition tells you the model of expertise being applied. A university leads; a standards institute supplies the process; a national laboratory supplies the test regime. This is the same division of labour visible in TC260’s 2026-10-13 assignment of 25 new recommended national standard projects, eleven of them AI-security, with leads drawn from the state security-testing centre, two state AI laboratories, Alibaba Cloud and CNCERT. Nobody in that set is a maintainer. This is a structural observation, not an accusation: the people who will write the rules for open-weight publication are standards professionals and lab scientists, and the population with the most tacit knowledge about what actually breaks when you open a model — maintainers of small downstream projects — is represented, if at all, through the enterprise units that employ them.

  • The most underrated clause in the whole architecture is the notification duty. Oliver Williamson’s L1/L2/L3 layering explains why. At L2 (the institutional environment) the state can draft rules freely. At L3 (governance) it needs a party who can be entrusted with execution. A regime that puts the disclosure obligation on the publisher is cheap to legislate and cheap to enforce — an inspector reads the model card. A regime that puts the risk-assessment obligation on the downloader is expensive, because downloaders are numerous, anonymous, and outside the jurisdiction. The legal scholars Liao Huijiao (廖慧姣) and Zhang Taolüe (张韬略) of Tongji University’s law school made exactly this point in their 2026 analysis: China currently lacks adequate mechanisms for risk assessment of open-source models, tracking their diffusion, and monitoring backdoor risks in foreign-origin open-source models — and they propose a permanent Open Source AI Risk Assessment Center with a diffusion-tiered scheme (low / medium / high dissemination risk). Read the TC260 drafting cluster against that proposal and the design logic becomes legible: security testing methods, model-development guides, on-device guides, gateway product guides. Those are four of the instruments you would need if such an assessment capability were ever built.

Sources:

🏗️ Institutional Change — The Export Catalogue’s Open-Source Safe Harbor and the Standards Track Are Two Regimes With One Object

1. Recap of the regulatory position, now documented at primary source. MOFCOM/MOST Announcement No. 48 of 2026 (2026-10-16) states in Article 1: technologies that have already entered the public domain through open-sourcing or the publication of academic papers are not brought within the scope of management (对已通过开源、发表学术论文等方式进入公共领域的技术,不纳入管理范围). The MOFCOM spokesperson’s Q&A adds the symmetric provision: for AI technology exports in the form of open-sourcing (人工智能类技术开源), Chinese firms building and operating their own compute centres abroad, overseas chip tape-out, joint R&D using overseas resources, and participation in international standard-setting, facilitated measures including automatic licensing apply, in practice achieving “file and out” (即报即出).

2. What this means in procedural terms. The safe harbour is not a permission. It is a falling-outside: the technology never enters the licensing procedure at all. The automatic-licensing route is the opposite: it enters the procedure and exits it on filing. Two different institutional mechanisms, both labelled “open source friendly”, with materially different residual state discretion.

3. The asymmetry that has gone unremarked. The export-control instrument treats open-sourcing as a release from control. The standards instrument treats open-sourcing as a point of control. Same administrative year, same object, same word.

Institutional Analysis & Commentary:

This is the single most useful observation available this week, and it is not a contradiction — it is a division of labour, and seeing it as such clarifies what “open source” means inside the Chinese administrative apparatus.

The export catalogue’s authors care about a bilateral transaction: does technology cross a border? For that question, a technology that is already downloadable from anywhere has no border to cross, so controlling it is futile. The exclusion is not ideological generosity; it is enforcement realism. The MOFCOM Q&A is explicit that the test is “whether restricted technology moves from inside mainland China to outside it”.

The standards authors care about a unilateral act with diffuse consequences: does a released artefact produce downstream harm that the publisher can foresee and communicate? For that question, open-sourcing is precisely the moment of maximum institutional leverage, because after release there is no counterparty to regulate. Hence the notification duty.

Placed side by side, the two regimes give the Chinese state something that no single instrument could: the ability to encourage open-weight release at the trade layer (because it disarms foreign containment and builds developer dependency abroad) while thickening obligations at the standards layer (because an exported ecosystem needs quality control). A lab can be told, truthfully, that open-sourcing is the fastest compliant route to global distribution — and simultaneously that open-sourcing now triggers disclosure duties. Neither statement is a lie, and the combination is the actual policy.

The institutional-economics point is that this combination is available because the two instruments are authored by different bodies under different statutes with different vocabularies. Coase’s analysis of the firm turned on the observation that a single authority can coordinate what the market would price separately; the mirror observation holds for states. Fragmented authorship is usually described as a defect — regulatory overlap, forum shopping, compliance confusion. Here it functions as a design: the trade regulator can afford to be liberal precisely because the standards regulator is not, and vice versa. Whether that is an accident of bureaucratic division or a deliberate equilibrium is not something this series can establish from public documents. That it produces a coherent outward-facing position is observable.

Sources:

🔍 Commentary — Standardisation Wants to Run First, and the Reason Is Cost Ordering

Taken together, the two items above describe a single institutional choice being made in China inside a six-week window.

The publication track is closing into enforcement: GB/T 48110-2026 becomes binding on 2026-12-01, six weeks out, specifying what an open-source model platform must expose. The drafting track is opening: 20264767-T-469 gives open-source model security a 15-month clock ending roughly 2027-12-30, and its sibling cluster covers testing, development, on-device deployment and gateway products. And the trade track has already decided, in the export catalogue, that open-sourcing is a route out of the licensing regime.

Why does standardisation run ahead of legislation and, in practice, ahead of licence-based self-governance? Douglass North’s answer is path dependence: institutions with the lowest marginal cost of amendment get amended first, and once amended they constrain what later institutions can say. A recommended national standard can be drafted, assigned, revised and published inside 15 to 18 months by a committee of a few dozen people, through a procedure that requires no legislature and no community consensus. A licence family requires agreement among a diffuse population and has no enforcement arm at all. A statute takes years. The order in which these instruments are produced is therefore not a policy preference — it is a cost ordering, and the consequential fact is that the cheapest instrument writes the vocabulary that the expensive ones inherit.

Set this against the sector-specific groundwork already documented in this series — CAICT’s OSCAR “open source + peak practice” recognition cycle, with its three participant categories, its five directions, and its November results announcement at the OSCAR Open Source Industry Conference — and the layering becomes visible: recognition instrument, then platform standard, then security standard, then deployment practice. Each layer presumes the one beneath it. None of them requires a maintainer to agree to anything.

That is the precise shape of the divergence this series has been tracking, and it is worth restating without inflation. It is not that China is producing “fake open source” while the West produces “real open source” — the Chinese ecosystem contains genuine FLOSS work, and the Mulan V2 licence’s OSI certification, with more than 330,000 adopting projects, is not a fiction. It is that China is building the institutional capacity to make open-source compliance administratively legible — platform conformance, notification duty, recognition cycles, security testing — faster and more completely than it is building the institutional capacity to make it self-governed. Those are different capabilities. A regime can be excellent at the first and thin on the second, and the resulting “open source” will pass every inspection while quietly relocating the decision rights that made it a commons.

The test to apply over the next twelve months is concrete and checkable: when the TC260 open-source model security guide reaches its consultation draft, will it be published for public comment with the same visibility as the export-control catalogue, and will downstream maintainers — not only drafting-unit enterprises — be able to file objections against specific clauses? If yes, the standardisation-first path is compatible with a commons. If no, the vocabulary will have been written by the only parties with an incentive to write it, and the word “open” in the resulting regime will be doing less work than it appears to.