In September 2024 the Ministry of Industry and Information Technology and ten other departments issued a notice on the coordinated development of new information infrastructure. The document addresses the relationship between networks, computing power, data and security, but its effect does not stay at the planning level. Once compute is laid out as infrastructure, the companies that connect to it must answer three questions at once: where the resources come from, how data moves, and who is responsible for security.
Four dimensions, not one data hall
Discussion of compute has usually centred on the number of data centres, racks and utilisation rates. This notice places networks, compute, data and security in one coordinating framework, so a compute project is no longer only a question of siting and power supply. Network latency determines whether capacity can be called remotely; data-circulation rules determine whether training corpora can be aggregated across entities; security capability determines whether the system can run continuously.
For AI companies this yields a practical distinction: building a facility, renting capacity and hybrid deployment carry different obligations. Building means taking on more of the facility-side and security-side responsibility. Renting means writing the boundary into the contract — whose equipment processes the data, who keeps the logs, who reports an incident.
New-technology risk assessment enters the infrastructure context
The notice calls for stronger risk assessment of new technologies including artificial intelligence. In an infrastructure document, this points not to the evaluation of a single model’s performance but to the overall risk of compute and network systems carrying AI services. Safety assessment before launch, stability and abuse prevention during operation, and data disposal after decommissioning all require an assigned owner and a record.
The value of risk assessment lies in producing a reviewable reasoning process. A single conclusory report is hard to rely on during an inspection or an incident review. A risk register, the assessment method, residual risks and mitigation measures need to sit in one document to form a usable chain of evidence.
Identification and filing of important data transmits downstream
The notice requires identification and filing of important data. In AI settings this is easily underestimated: training corpora, model parameters, operation logs and user interaction records may each fall within the category, and the answer depends on sector catalogues and actual business practice. Identification is not a one-off label. Greater aggregation or a change of application scenario can change the conclusion.
Filing fixes the identification result externally. Once identification is done, internal classification, access control and outbound assessment have a stable starting point. Where the identification conclusion and actual processing activities diverge for long, subsequent filings, assessments and contractual arrangements lose their foundation.
Three tasks that can start now
Place compute, network and data suppliers on one list, marking the data types each touches and the security duties each bears. Check whether existing security assessments cover infrastructure-level risk rather than only content safety at the model layer. Review the basis for important-data identification and its filing status, confirming the catalogue version, the responsible department and the date of last update.
None of these tasks needs to wait for implementing rules. What they share is the consolidation of information held separately by procurement, engineering and legal, so that compliance judgments rest on something that can be checked.
For a review of security duties across compute and network architecture, see our cybersecurity compliance service; for important-data identification, classification and filing, see data compliance.
This article is based on the notice on promoting the coordinated development of new information infrastructure issued by the Ministry of Industry and Information Technology and ten other departments in September 2024, and on public information. It is for reference only and does not constitute legal advice.