China's NDRC Accelerates Comprehensive AI Law, Names DeepSeek, Alibaba, and Moonshot in Scope

China is fast-tracking a comprehensive AI law that covers the entire lifecycle of frontier models — from training data and compute procurement through deployment — and has named DeepSeek, Alibaba, and Moonshot as the domestic developers explicitly in scope. The move signals Beijing's shift from a patchwork of sector-specific AI rules toward a unified statutory framework that rivals the EU AI Act in breadth.

The announcement came from senior National Development and Reform Commission (NDRC) official Wang Ruomeng, as reported by Bloomberg. The NDRC — China's central economic planning agency — is coordinating the draft law across ministries, with incident-disclosure requirements and sandbox gating requirements expected to take effect by 2027.

What the Law Would Require

Based on Wang Ruomeng's statements, the framework will impose three major categories of obligation on covered developers:

1. Lifecycle coverage. Unlike China's existing Generative AI Interim Measures (2023) and Algorithm Recommendation Rules (2022), which target specific deployment contexts, the new law would apply to the full model development pipeline — including data sourcing, compute acquisition, training runs, evaluation, and deployment.

2. Incident disclosure. Covered companies would be required to report security incidents, capability surprises, and "safety-relevant events" to regulators within a defined timeframe. The specific disclosure windows have not yet been published.

3. Sandbox gating. Before deploying certain frontier models publicly, developers would need to pass through a regulatory sandbox — a controlled testing environment where government evaluators assess capability and risk before commercial release is permitted.

DeepSeek, Alibaba (through its Qwen model family), and Moonshot (maker of the Kimi model) were named explicitly by Wang as domestic developers in scope. The framing suggests Beijing is drawing a clear line: these are China's frontier labs, and they will be regulated as such.

Why Now

The NDRC's accelerated timeline follows a year of high-profile AI incidents globally, including multiple cases of model outputs that generated diplomatic or security complications. Beijing has also been watching the EU AI Act's implementation — which entered enforcement for high-risk system obligations in August 2026 — and appears to be calibrating its own framework to be broadly comparable in scope while preserving flexibility for state-aligned deployments.

China's approach departs from the EU model in one significant way: state use of AI is unlikely to face the same restrictions as commercial deployment. The EU AI Act explicitly covers government high-risk AI systems; China's draft law is expected to carve out national security and public administration applications.

The explicit naming of specific companies in a pre-draft announcement is itself notable. In Western regulatory contexts, regulators rarely name individual firms before a law is final. The NDRC's public naming signals these companies are already in active dialogue with regulators — and that the law's scope is not ambiguous.

What This Means for Chinese AI

For DeepSeek: The open-weight lab, which released its R1 and V3 models to global audiences and sparked a wave of model efficiency research, now faces a compliance burden that could affect its release cadence. Open-weight models are harder to "sandbox" than API-only deployments — how the law handles open releases will be a critical detail to watch.

For Alibaba: The Qwen model family is deeply integrated into Alibaba Cloud products used by enterprises across Southeast Asia and the Middle East. A sandbox gating requirement could create compliance complexity for international customers.

For Moonshot: The maker of the Kimi long-context model is among China's fastest-growing AI startups. Regulatory overhead at this stage of growth carries more friction than it would for established players.

For global AI competition: A comprehensive Chinese AI regulatory framework — even one that differs from the EU model — creates a third major regulatory regime alongside the EU and the emerging U.S. patchwork. Multinational companies deploying AI across these jurisdictions will face significantly more complex compliance requirements.

What to Watch

The NDRC has not published a draft law text or opened a formal comment period as of this writing. The next step is the release of a consultation draft, expected in early 2027. Watch for how the law handles open-weight models and whether state-affiliated developers like Baidu and the CAAI (Chinese Association for Artificial Intelligence) are treated differently from commercial labs.

By Hector Herrera