On 19 February 2024 the State-owned Assets Supervision and Administration Commission held a special meeting on artificial intelligence for central enterprises under the theme “AI empowers industry renewal”. The meeting called for central enterprises to develop better and play a larger role in AI, to build AI industrial clusters, application demonstrations and talent concentrations, and to coordinate high-quality development with high-level security.
For AI companies the immediate significance lies on the procurement side. Central enterprises are important customers and organisers of supply chains. Their compliance requirements travel down procurement contracts to suppliers.
What high-level security means here
Security requirements for central enterprises are rarely one-dimensional. Production safety, cyber and data security, compliance management and overseas risk are assessed within a single framework. Where an AI project touches production control, energy, transport or other critical areas, review is more detailed and the supplier’s documentation burden is heavier.
The difference from an ordinary commercial customer is the focus on who is accountable when something goes wrong, and whether the company can show that measures were taken at the time. Policies, drill records and incident reporting mechanisms therefore matter more than a product demonstration.
Procurement and supplier management
Central-enterprise AI contracts increasingly include data security, algorithm compliance, confidentiality and audit clauses. Suppliers need processing descriptions, evidence of security capability, the status of algorithm filing and arrangements for subcontracting and re-engagement. Second- and third-tier suppliers may be asked for the same materials.
For smaller AI companies this means compliance capability is part of tender eligibility. Assembling documents at short notice rarely keeps pace with bid evaluation. A standard package of commonly requested materials can be reused across projects.
The length of the contract chain also matters. Central-enterprise projects often involve a lead contractor and subcontractors, with data moving among several parties. Obligations flow down through back-to-back clauses; if a subcontractor cannot provide equivalent materials, the risk returns to the lead contractor.
Data security and algorithm filing
Companies offering generative AI services to the public must attend to algorithm filing and security assessment. Those serving a central enterprise internally must still assess whether the product has public-opinion attributes or social mobilisation capability. Internal classification is usually stricter, and the deployment location for training and inference, log retention and access control should be fixed at the proposal stage.
Where training data includes the customer’s business data, ownership and scope of use must be written into the contract. Using customer data to train a general model is a common point of dispute.
Ethics and overseas business
AI applications in health, environment, public safety and similar areas require technology ethics review. Central enterprises operating abroad also face local data, export control and investment screening rules. Transplanting domestic compliance documents to an overseas project is usually insufficient.
Overseas projects also require an export control classification of the model and technology, and an assessment of local market access rules for AI services. These judgments belong before the bid, not after signature.
Group-level deployment affects supplier selection too. Central enterprises tend to use unified cloud platforms and model services, so suppliers must fit the group’s technical standards and security baseline. A product with better performance but insufficient adaptability may still fail to enter the framework agreement.
For algorithm filing and security assessment, see our algorithm filing service; for central-enterprise procurement, subcontracting and data clauses, see commercial contracts.
This article is based on public reporting of the SASAC special meeting on AI for central enterprises held on 19 February 2024, and on public information. It is for reference only and does not constitute legal advice.