China's NDRC moves to fast-track a comprehensive AI law, asks companies to self-report incidents and vulnerabilities

China's National Development and Reform Commission (NDRC), the country's top economic planning agency, said at a November 3 press conference that it would speed up work on a comprehensive, foundational law for AI, according to reports. The agency also reportedly said it would set safety standards covering every stage from development through operation, and would require companies to disclose safety risks and proactively report incidents and vulnerabilities. No draft text or timeline has been released yet.

What it means for Japanese companies: There is no direct impact yet. But companies that offer AI services in China through Chinese subsidiaries or partners will likely need to set up internal channels for reporting incidents and disclosing risks. Companies that have built Chinese open models into their operations should also check what reporting obligations will fall on the developers of those models.

What was said: a comprehensive law and safety standards for every stage

The remarks were made by Wang Ruomeng, deputy director-general of the NDRC's Department of Innovation and High-Tech Development, which oversees technology and high-tech industries, according to reports. China already has rules on specific topics, such as generative AI services and labeling of AI-generated text and images. This time, a senior official at the agency that steers China's economy has publicly signaled a plan to bring those rules together under one broad law.

Wang was quoted as saying:

The language about building a "main framework" suggests a plan to pass one broad law first and then add detailed rules beneath it. The safety standards will reportedly cover the full lifecycle, from development through operation after release. The idea is that the rules would not stop at testing before a model is released, but would also deal with problems that come up while the model is in use.

What companies would have to do: disclose risks and self-report incidents and vulnerabilities

For companies, this is the most concrete part of the announcement.

The rules would apply both to companies that build AI (developers) and to companies that run it as a service (operators). They would be asked to do three things: strengthen their awareness of risk management, promptly disclose safety risks, and proactively report incidents and vulnerabilities. Based on what has been reported, officials did not say how serious an incident must be to require a report, how many days companies would have to file, or which agency would receive the reports. Penalties for not complying were not reported either.

In English-language coverage, Malaysia's The Star reported the press conference under a headline describing the plans as coming "after global security lapses." This autumn, several overseas AI labs disclosed cases in which agents under testing reached real-world systems. OpenAI notified authorities about a month after discovering that a model in training had accessed an Australian government statistics website. One of its executives apologized before the Australian parliament and acknowledged that the notification was late. Anthropic also disclosed on its own that a model under testing had sent made-up reports to a U.S. police reporting website. In the U.S. and Europe, Microsoft President Brad Smith and an open letter from scientists in 34 countries have called for mandatory incident reporting. China's plan points in the same direction. The difference is that most U.S. and European efforts are still voluntary corporate commitments or proposals, while China's government is trying to put these requirements into law.

Sector-specific regulatory sandboxes and regular reviews

Wang also reportedly said China would set up regulatory sandboxes, where new technologies and services can be tested within a set scope and under set conditions, for individual sectors such as healthcare and finance. Details such as which sectors would come first and who would run the sandboxes were not reported.

He also reportedly said the rules would not be fixed once written.

AI models are replaced every few months. The idea is to build a review process into the system from the start, so the text of the law does not fall behind the technology. By offering both strict safety obligations and spaces where testing is allowed, the NDRC appears to be trying to keep its role as an agency that also promotes the industry.

Outreach beyond China's borders

Wang also reportedly spoke about international frameworks.

China is trying to host the main international venue for setting AI governance rules. The domestic comprehensive law and the outward-facing organization can be read as two sides of the same strategy. Bloomberg's English-language report quoted Wang as saying the following, though his original remarks in Chinese could not be confirmed.

The argument that no single country can solve safety alone is nearly the same as what U.S. and European labs and governments say. The difference lies in where that cooperation takes place and who sets the standards.

What is still unknown

Many key points remain blank. First, the draft text and when it will go to the National People's Congress, China's legislature. Second, whether reporting incidents and vulnerabilities will be a best-effort goal or an obligation backed by penalties. Third, how far the rules will reach foreign companies and companies using models released in China. Fourth, which sectors will get sandboxes first.

In Japan, the AI Promotion Act, enacted in 2025, is designed to support research, development and adoption, and does not make incident reporting mandatory with penalties. If China's law ends up making incident reporting a legal obligation for companies, Japanese companies doing business in China will face reporting rules stricter than Japan's before they do at home. The next thing to watch is whether the NDRC releases the details in a formal document.