Following the release of TC260-003 “Basic Requirements for the Security of Generative Artificial Intelligence Services” （TC260 doc）by China’s National Cybersecurity Standardization Technical Committee (TC260) in March, the committee has now issued another draft national standard titled “Cybersecurity Technology – Basic Requirements for the Security of Generative Artificial Intelligence Services.” This new standard is open for public comments until July 22nd.
The draft national standard specifies requirements for the security of pretraining data, model security, and security measures for generative AI services, and provides reference points for security evaluation. According to the committee, the standard “applies to organizations or individuals providing generative AI services through interactive interfaces or programmable interfaces, and it can guide service providers in conducting security evaluation and serve as a reference for relevant authorities.”
Simply put, it is a national standard, while the TC260 doc is a technical document.
China’s national standards system includes mandatory standards and recommended standards, both issued by the Standardization Administration of China (SAC) and representing national-level technical norms and standards applicable nationwide.
In contrast, the TC260 technical documents are issued by the National Cybersecurity Standardization Technical Committee. They often serve as preparatory materials for national standards or as interim “quasi-standards” in the absence of a national standard, providing industry guidance. They do not use the “GB/T” prefix but are labelled with “TC260” or other related identifiers to distinguish them from national standards.
The draft national standard released yesterday is a recommended standard, meaning its application is not mandatory but advisory, allowing companies to choose whether to comply based on their needs.