China to regulate AI from data to deployment: NDRC fast-tracks a full-lifecycle law covering DeepSeek, Alibaba and Moonshot

China is accelerating plans for a comprehensive law to govern artificial intelligence across its entire lifecycle, from the data and computing power used to build models to the way they are deployed and used. The announcement came on November 3, 2026, from the country’s top economic planner, the National Development and Reform Commission (NDRC), as reported by Bloomberg — and it puts China’s biggest AI developers, including DeepSeek, Moonshot and Alibaba, inside the first frame of the new regime.

The significance is the scope. Rather than regulating only algorithms or AI services after they reach users, Beijing wants rules that follow AI from resource inputs through model development, operation and risk management. The exact obligations are not yet written: reporting of the briefing is clear that the scope of application and the specific duties for each company will be determined through future decrees and detailed criteria. What November 3 settled is the direction, the architecture and the names in the frame.

What Wang announced

Wang Ruomeng, deputy director of the NDRC’s Department of Innovation and High-Tech Development, set out the plan at a press conference on November 3, according to a readout of the briefing. He described a broad social consensus that AI brings opportunity and risk together, and said development and security would be coordinated during the current five-year plan period, with safety running through AI research, application and governance.

The first of four work areas he named is the governance rule system itself: accelerate foundational, comprehensive AI legislation; strengthen legislation on the common inputs of AI, including data, computing power and algorithms, as well as rules for key application scenarios; and establish safety standards and ethical guidelines covering the entire lifecycle, with implementation assessed periodically and provisions revised as technology moves. Yonhap’s account of the briefing adds that the framework is meant to expand management beyond existing algorithm- and service-level regulation to cover resource input, model development, operation and risk management.

Wang pitched the project as cooperative rather than purely domestic. AI safety, he said, “is not a problem one company, industry or country can tackle alone,” as reported in a readout carried by The Edge. That framing matters for foreign labs and suppliers watching the law: Beijing is presenting lifecycle safety as a shared problem, even as the rules themselves will be written in China, for the Chinese market first.

Disclosure, sandboxes and transition periods

The second work area is the regulatory environment around the law. Companies should expect reasonable transition periods for new policies rather than an overnight switch, compliance guidance tailored to different industries, and regulatory sandboxes for AI in various fields, where new technologies can be tested in pilot projects across sectors and regions before permanent rules bite. Management mechanisms would cover the application, testing, usage and exit of AI systems — the full journey of a product, not just its launch.

The third area is collaborative governance, and it is where the duties land on companies. Government departments, industry organisations, enterprises and the public would share defined responsibilities, with developers and operators expected to strengthen risk-management awareness, disclose safety risks in a timely manner, and proactively report safety incidents and system vulnerabilities. In parallel, Yonhap reports, China plans to operate regulatory sandboxes where firms can try out new AI technologies with a degree of trial and error while safety standards are established through pilots.

Who is in scope — and what is not decided yet

The regime is expected to apply to China’s leading AI companies, including DeepSeek, Moonshot AI and Alibaba Group, Bloomberg Law reports. All three are building models and products designed to compete with those of OpenAI and Anthropic in the United States, and all three would face the same lifecycle duties: managing risk in the data and computing they use, in the models they build, and in the services they operate.

Two cautions belong in any honest account of the announcement. First, no enactment date or draft text was reported from the briefing; this is an acceleration of legislation, not a law in force. Second, the companies named are the expected scope, not a final list — the decrees and detailed criteria that follow will decide which developers and operators fall inside the regime and what each must do. Until those appear, the practical question for any lab operating in China is not whether lifecycle regulation is coming, but how much of its training data, compute and deployment practice it can already document.

The social side: jobs, deepfakes and dependency

The fourth work area reaches beyond the model itself, into the social impacts of AI. Beijing plans to monitor changes in employment structures and strengthen monitoring and early warning of employment displacement risks, while promoting the inclusion of new professions such as model trainers and data annotators in the national occupational classification system — formal recognition for the human labour behind AI systems.

The same work area covers traceability for algorithmic discrimination, deepfakes and privacy breaches, and stronger guidance and intervention to prevent addiction and emotional dependency on AI. That breadth is the point of a lifecycle law: the risks being regulated are not only a model going wrong, but the labour, the outputs and the users around it. As one account of the plan puts it, the law would put AI under supervision at every stage, from the data and computers used to build it to the way it is used.

What to watch next

The next signals will be the draft legislation itself, the sector sandboxes and the first decrees setting scope and obligations. Watch in particular for three things: whether the transition periods are long enough for labs to rebuild data and compute documentation; whether incident and vulnerability reporting comes with timelines and penalties, or remains a disclosure principle; and whether the sandboxes produce standards that travel beyond China, as Beijing’s framing of AI safety as a shared problem suggests it hopes they might. None of that was settled on November 3. What was settled is that China intends to regulate the whole lifecycle, and that its frontier labs should plan as if they are already inside it.