On 19 May 2026, at the “AI Empowering the Building of Network Civilisation” forum of the 2026 China Network Civilization Conference, the National Technical Committee on Information Security (TC260) released the AI Application Ethics and Security Guideline 1.0, numbered TC260-005. The guideline focuses on ethical and security issues in AI applications, sets guidance for the development, provision and use of AI applications, and calls on relevant parties to understand and properly address the ethical and security impact of their activities, upholding a human-centred approach and “AI for good”.

Why ethical boundaries are drawn at the “application” stage

Earlier governance documents tended to focus on single elements such as models, algorithms or data. The application stage is special because it is where ethical risk actually becomes visible: however strong a model is, it affects users and society only when it enters a concrete product, service and scenario. By starting from “application”, the guideline attaches ethics and security requirements to the place where risk occurs.

This is how “human-centred and AI for good” lands — not as an abstract statement, but as a demand that developers and users identify, assess and handle ethical and security impacts in their application activities.

Development, provision and use: three stages of guidance

The guideline allocates responsibility by party and stage. At the development stage, ethical and security considerations must be built in during design rather than patched in afterwards. At the provision stage, the provider must describe and manage the functions offered, the audience addressed and the possible impacts. At the use stage, the user must apply AI reasonably in concrete scenarios and avoid improper uses.

The value of the three-stage structure is that every party along the chain can find its place. The common deflection — “I only provide the model” or “I only call the API” — is harder to sustain under this structure.

The Opinions on the Regulated Application and Innovative Development of AI Agents, released around the same time, work in tandem with the guideline. Agents can plan autonomously and execute multi-step actions, so their application risk exceeds that of mere content generation, and the demands on governance architecture and safety measures are more specific — see our analysis of the AI agent application opinions.

Together the two send a signal: as AI moves from “generating content” to “acting autonomously”, ethical and security constraints extend along the boundary of capability — a direction consistent with the earlier AI safety governance framework.

Requirements for governance architecture and product design

First, build an ethics review mechanism. Bring ethical and security assessment into product initiation and launch processes, and specify who reviews, what is reviewed and how conclusions are recorded.

Second, conduct impact assessments. For applications that may affect user rights or social order, produce a deliverable assessment document.

Third, monitor continuously. Ethical and security impact is not a one-off judgement; it must be monitored and updated during operation.

Fourth, put requirements into documents. Whether internal governance rules or materials for partners, verifiable written records are needed.

Overseas developments offer a reference, such as the UK Information Commissioner’s Office guidance on agentic AI compliance — see the ICO agentic AI compliance guide.

For support on ethics and security assessment, governance mechanisms, and data and algorithm compliance, see our Data Compliance and Algorithm Filing services.

This article is based on public information on the release of the AI Application Ethics and Security Guideline 1.0 (TC260-005) by the National Technical Committee on Information Security on 19 May 2026. It is for reference only and does not constitute legal advice.