1. Background
of the introductionCentralized by the National Information Security Standardization Technical Committee (TC260), released by the National Standardization Administration, released on April 25, 2025, and implemented on November 1, 2025. This standard is an upgraded version of the previous recommended standard, aiming to provide an enforceable security baseline for generative AI services and guide corporate compliance and government regulation.
2. Scope of application
Applicable to generative artificial intelligence services with public opinion attributes or social mobilization capabilities, including the whole process of generating and delivering text, images, audio, video and other content to the public, and also providing a reference for regulatory authorities and evaluation agencies for security assessment.
3. Main content
- training data security: Data sources must be legal, true, accurate, and diverse to prevent infringement, manipulation, and security risks.
- Model security: Prevent models from being misused and spread harmful information, and improve controllability, explainability, and attack resistance.
- Security management measures: including user identity authentication, access rights control, log retention, emergency response, and security vulnerability repair.
- Risk prevention and control: Establish a risk monitoring mechanism to provide timely early warning and disposal of potential security threats.
- Appendix requirements: Appendix A lists the potential risks of training data and generated content; Appendix B provides security assessment methods and reference indicators.
4. Nature of implementation
It is a recommended national standard and does not have legal enforceability, but as an important reference standard for industry safety governance and supervision, the actual implementation value is high.
For details, please refer to the official website:
https://www.tc260.org.cn/upload/2025-06-30/1751257342816036759.pdf
