China Advances AI Lifecycle Legislation, With Risk Reporting and Regulatory Sandboxes in View
China Advances AI Lifecycle Legislation, With Risk Reporting and Regulatory Sandboxes in View
China is moving toward a broader framework for artificial intelligence governance, with potential implications for businesses that combine AI with blockchain technology. The direction outlined by the National Development and Reform Commission on November 3 would extend oversight across the AI lifecycle—from data and computing resources to algorithms and real-world applications.
Developers and operators would be encouraged to disclose safety risks promptly and proactively report incidents and vulnerabilities. At the same time, policymakers envisage transition periods and regulatory sandboxes where companies could test new technologies under controlled conditions.
For crypto businesses, the distinction is important: the reported measures are a policy direction, not a finalized set of obligations. Companies should watch for the legislation’s eventual scope, implementation timetable and interaction with existing restrictions on cryptocurrency-related activities.
What Full-Lifecycle AI Oversight Could Mean
Rather than focusing only on a model’s output, the proposed approach would consider risks throughout development and deployment. That could include how training data is obtained, how systems are tested, what happens when a product is released, and how operators respond when something goes wrong.
China already regulates certain AI services. Its interim measures for generative AI services, effective since 2023, apply to qualifying services that generate content for the public in China. A broader law could add to that framework, although the precise relationship between existing measures and future legislation remains to be clarified.
For blockchain teams, AI can sit in many parts of a product: a support assistant, a transaction-monitoring tool, a smart contract analysis service or an automated trading interface. Each presents different risks. A chatbot that explains a transaction may expose sensitive user data, for example, while an AI agent capable of initiating transactions may introduce errors that are difficult to reverse.
The policy direction also reaches beyond technical security. Areas identified for attention include employment disruption, user dependence on AI, deepfakes, algorithmic discrimination and privacy leakage. These concerns could be relevant to crypto platforms that use AI to make account-access decisions, generate financial content or interact with users conversationally.
Why Risk Disclosure Matters for Crypto Products
The emphasis on reporting incidents and vulnerabilities is especially relevant to products handling digital assets. A failure may involve more than an incorrect answer: an AI system could misinterpret a contract, recommend a malicious address or persuade a user to approve an unsafe transaction.
Teams assessing their exposure could start by documenting:
- System boundaries: Which decisions are made by AI, and which require human approval?
- Data flows: What user information, wallet addresses or transaction details are sent to a model or third-party provider?
- Incident response: How will the team identify, contain and communicate a harmful output or security breach?
- User impact: Could an error lead to asset loss, exclusion from a service or disclosure of sensitive information?
These are practical governance questions, not a statement of finalized Chinese legal requirements. For a broader approach to identifying and managing AI risks, the NIST AI Risk Management Framework provides a useful reference.
Regulatory Sandboxes Could Create Room to Test
A regulatory sandbox generally allows a business to trial a product within defined limits while regulators observe the results. In the approach outlined on November 3, sandboxes could be established across industries, with mechanisms for applications, testing, use and exit. Rules could also be reviewed and adjusted over time.
For blockchain developers, a controlled test might help evaluate an AI-assisted security tool before wider deployment. Limits on participants, transaction values or system permissions could make it easier to identify failures without exposing a large user base.
However, a sandbox is not a blanket authorization to offer cryptocurrency services. Whether a project can participate would depend on the applicable program, its rules and the activity being tested. Businesses should assess AI requirements separately from the rules governing digital assets and financial services in their jurisdiction.
Reasonable transition periods could also give affected organizations time to adapt. Their duration and practical effect will depend on the final rules.
AI Agents Make Transaction Review More Important
One of the most consequential questions for crypto users is how much authority to give an AI system. An assistant can be useful for summarizing a contract or explaining a transaction, but its explanation is not proof that the action is safe.
Before approving an AI-suggested transaction, users should independently check:
- The destination address and network. A convincing explanation does not prevent funds from being sent to the wrong place.
- The asset and amount. Confirm what will leave the wallet and whether fees are reasonable.
- Contract permissions. Look closely at token approvals, especially permissions that allow a contract to spend assets later.
- The source of the request. Deepfake video, cloned voices and persuasive chat messages can make impersonation harder to spot.
- Sensitive information. Never provide a recovery phrase or private key to an AI assistant, support chat or website.
A hardware wallet such as OneKey can help keep private keys separate from an internet-connected device while allowing users to review and authorize transactions. It cannot determine whether every transaction is legitimate or prevent a user from approving a malicious request, so careful verification remains essential.
What to Watch Next
China’s push toward AI lifecycle legislation points to a governance model that considers both innovation and the harm AI systems can cause after deployment. For blockchain businesses, the immediate task is to map where AI is used, what it can access and how incidents would be handled.
The next important details are the draft law’s scope, any reporting requirements, the length of transition periods and the design of individual sandboxes. Until those are published, companies should treat the announced direction as a signal to prepare—not as a substitute for finalized rules.
