On 29 February 2024 the National Technical Committee 260 on Cybersecurity (TC260) issued the Basic Security Requirements for Generative Artificial Intelligence Services (TC260-003). The document breaks security requirements into four layers: corpus, model, output and assessment method. A filing for a generative AI service must include security-assessment materials, which turns the exercise from a statement of principles into verifiable documentation. For companies preparing a filing or already in service, the difficulty is not reading the requirements but converting them into traceable records.
Four objects of assessment
Corpus safety concerns lawful sourcing, compliant content and proper annotation. Model safety concerns the training process, parameters and supply chain. Output safety concerns whether generated content is unlawful, infringing or misleading. Assessment method concerns sampling, testing and how conclusions are reached.
These are not parallel checkboxes. Corpus problems are amplified in output, model problems surface under specific prompts, and the method determines whether the first two can be proved at all. An assessment assembled as a one-off bundle of materials usually produces conclusions that contradict each other.
The evidence chain for corpus review
Corpus review starts with a list: source, acquisition method, licence documents, volume, purpose and storage location. Public scraping, customer-provided data, third-party purchases and self-generated data should be recorded separately because their licence scopes differ. Purchased data also requires checking whether training, fine-tuning and external service are permitted.
Blacklists and filtering rules need versions. A rule written in a policy but applied by individual judgment cannot demonstrate consistency. Mapping the keyword list, filter logs and blocked samples is what shows the control actually runs. IP review works the same way: provenance statements, licence evidence and infringement complaint records should corroborate one another.
Model testing and output sampling
Model testing needs scenario-based test sets covering the product’s main functions and high-risk prompts. Scale is less important than retaining versions, construction methods and expected results. Re-running after each model update is the only way to see regressions.
Output sampling addresses persistence. Frequency, sample source, decision criteria and handling process should be fixed in advance. Samples that reveal problems should enter a remediation workflow, not simply be removed from the report. Human review combined with automated filtering is more reliable than either alone.
Assessment reports and reassessment
A report should answer four questions: what was assessed, by what method, what was found, and what was done about it. Conclusions need to point to evidence; formulations such as “generally secure” cannot be verified.
Reassessment is triggered, not annual. A major model update, a change in corpus sources, a new application scenario or a security incident should each trigger it. Reassessment records tied to the released version are what allow a company to describe the current security state during an inspection.
For filing routes and material organisation, see our algorithm filing service; for provenance and licensing, see data compliance; for content security and technical controls, see cybersecurity compliance.
This article is based on the Basic Security Requirements for Generative Artificial Intelligence Services (TC260-003) issued by the National Technical Committee 260 on Cybersecurity on 29 February 2024, and on public information. It is for reference only and does not constitute legal advice.