On 30 June 2025, GB/T 45907-2025, Artificial Intelligence — Assessment of Service Capability Maturity, was issued and took effect by the State Administration for Market Regulation and the Standardization Administration of China, with the national information technology standardization committee as the responsible technical body. It is the first Chinese national standard to treat “AI service capability” as an assessment object in its own right.
It assesses the service, not the model
Earlier AI standards were built around models and systems: the security baseline for generative services, the filing requirements for algorithms and deep synthesis. All of them target “the thing itself”. GB/T 45907 assesses something different — the ability of a service provider to deliver AI services.
The standard proposes a framework that breaks capability down into capability domains and capability items, specifies maturity levels with corresponding scores, and describes assessment methods. For the first time, “AI service capability” has a public, comparable yardstick, rather than being judged by reputation in a procurement conversation.
What the five levels mean
Maturity is graded in five levels — initial, developing, robust, excellent and outstanding — numbered (i) to (v). The higher the level, the stronger the organisation’s process stability, repeatability and capacity for continuous improvement.
The logic will be familiar to anyone who has worked with software capability maturity models: what is measured is not how well a single delivery went, but whether good delivery can be repeated reliably. For a company, the level is not a one-off exam score but a condition that has to be sustained through systems and processes.
Who will use this yardstick
The standard is expressly designed for two uses: assessing a service provider’s overall AI service capability maturity, and assessing individual capability domains and items.
For buyers — particularly government bodies and state-owned enterprises — it provides a basis for selection. See our note on the action plan for AI application service providers. For providers themselves, an assessment result is evidence of capability: in tenders, project acceptance and compliance explanations, a maturity level carries more weight than a self-description.
How it fits with existing rules
Maturity assessment does not replace security and compliance requirements. Generative services must still meet the basic security requirements for generative AI services, and algorithm and deep synthesis services must still complete filing. The maturity standard fills a different dimension: whether capability can be delivered consistently.
Layered together, a provider’s compliance work in effect splits into two lines — one for lawful launch, one for credible capability. See our note on generative AI filing and registration.
Where companies can start
First, run a self-assessment against the capability domains, identifying the items where weaknesses cluster rather than asking broadly whether the company is “good enough”.
Second, turn assessment evidence into routine records — process documents, delivery records and improvement loops — instead of assembling material at short notice.
Third, keep two kinds of statement apart in external documents: proof of compliance qualification and proof of capability maturity each belong in their own place.
The value of standardisation is that it turns a vague judgement into a verifiable conclusion. As AI services enter government and large-enterprise procurement, those who can describe their capability on a common scale are more likely to clear the first screening round. See our note on China’s AI development and deployment framework.
This article is based on GB/T 45907-2025 Artificial Intelligence — Assessment of Service Capability Maturity and public information and is for reference only; it does not constitute legal advice.