Executive Summary

The report went out on October 8, 2026. The byline carries three names, Mark Chen, Doug and Dylan Patel, while the page's author meta tag lists only Mark Chen. It lands twenty-six days after Dario Amodei argued in an essay for deliberately slowing the pace at the frontier, and immediately after the American and Chinese heads of state put superintelligence on a formal agenda. We covered the Washington side of that in a piece on who audits the superintelligence accord. The report asks one question. What is China actually doing?

To answer it the authors built two original datasets. One counts, exhaustively, every model release from nine Chinese AI companies between 2021 and September 15, 2026. The other codes 102 expert and official texts and 65 executive statements from the same period. The widely quoted figure comes from the first. Before repeating that figure, this article looks at the rule that produced it, because every rate further down rests on the definitions fixed in this section.

1.1Nine companies and 857 releases were fixed first

Nine companies are in scope: four hyperscalers (ByteDance, Alibaba, Tencent, Baidu) and five startups (DeepSeek, Moonshot, Zhipu/Z.ai, MiniMax, StepFun). The denominator is 857, split into 741 product models and 116 research models. Each row carries a first public date, a weights status, a license and a source. So before it commented on Chinese AI, this census built a registry where there had been none.

Three kinds of material were searched: developer model cards, release notes and technical reports. Nothing outside those three. That choice sets the size of the number, a point that returns in sections 4 and 6.

1.2What gets to count as a "result" is the whole census

The bar for counting one is narrow. There has to be a quantitative or substantive finding about harmful output, jailbreaks, toxicity, privacy, refusal or dangerous capability, and that finding has to be tied to the model's name. The report puts it this way.

"Our standard is strict: a result means a quantitative or substantive finding on harmful output, jailbreaks, toxicity, privacy, refusal, or dangerous capability, tied to the named model. Statements that a model was 'safety-trained' or 'evaluated' do not count. A flagship model's result is not extrapolated to other sizes or snapshots."

Split that into what counts and what does not and it comes out as follows. The right-hand column of this table is what returns in section 2 as thirteen releases.

The counting rule from the report's prose, split into three fields. Because of the third row, third-party evaluations never enter this statistic. What measuring from the outside actually looks like is set out in our piece on testing Chinese models' refusal behavior externally.

1.3The report put two caveats on its own figures

Two caveats sit in the same paragraph. The first is about scope: the report writes that "not found" is bounded by the material checked and does not mean "not tested." The second is about comparison. Companies name model variants at different granularity, and the report says plainly that Alibaba's 238 releases count every Qwen size and snapshot one by one. That makes the per-company rates indicative only.

Neither caveat is this article's discovery. The report wrote them first, and the coverage already picked them up. One English outlet wrote that the census measured transparency rather than proving the absence of safety work; another wrote that the report published no comparable figure for US developers. So this article does not stop at rediscovering those two sentences. Two more fields are worth opening: what the opposite of 3.6% actually is (section 2), and how far the date column that holds the figure up is filled in (section 4).

This is the sentence that travelled furthest. Of 857 releases, developers published safety test results for 31, or 3.6%. The sentence that usually follows it is the one that goes wrong: that the remaining 96.4% disclosed nothing. What the report puts under "no disclosure of any kind" is 813 releases, 94.9%. Thirteen releases sit between the two numbers, and those thirteen are what this section is about.

The report splits 857 into six buckets, and each bucket asks something different. Is there a result? When was it there? Can the result be pinned to this model? Is there only a claim? Is there no developer document at all?

The six buckets from the report's prose. 9 + 16 + 6 = 31, and 31 + 10 + 3 + 813 = 857. The 3.6% and the 94.9% are not each other's complement: the first answers "is there a result?", the second answers "is there nothing at all?"

Pebblous rebuilt the report's six buckets as a band. The upper band is proportional to 857; the lower one expands the 44 on the left. The orange-outlined block is the ten releases that claim an evaluation without writing down a number.

2.1"Safety-trained" is the sentence the census decided not to count

Ten releases carry a claim of evaluation with no numbers attached, and three are known only from press or investor records. Those thirteen are neither silence nor record. The counting rule from section 1 is what created this bucket. The report decided that "safety-trained" would not count, and that decision changes the shape of the statistic. Loosen the rule on the same material and 3.6% climbs past 4%; loosen it further and it passes 5%.

Which rule is the right one is not for this article to settle. One thing is clear, though. Change the rule and the number changes, yet what gets quoted is the number, not the rule. Every sentence that repeats 3.6% is in fact repeating "3.6% under this definition."

2.2More than half of the thirty-one disclosures sit on the output side

The contents of the 31 lean one way too. Eighteen report harmful-output or refusal results and seven report jailbreak resistance. Nine documents touch code or cybersecurity, and seven of those nine are secure-code-generation tests on coding models. Only three touch cyber-offense capability or biological risk. None of those three comes from a hyperscaler. These numbers must not be added up: a single document often reports several categories, so 18 + 7 + 9 overshoots 31.

The report names the three that touch cyber-offense or biological risk. They are Zhipu's GLM-5.2 responsibility note, the same company's GLM-5.3 cyber-capability note, and Moonshot's Kimi K2 technical report. Across 857 releases from nine companies over more than five years, three documents reach into this territory, and two companies produced those three.

Within the nine releases where a result was there at launch, four are behavioral safety tests (Qwen2-72B-Instruct, MiniMax-Text-01, Seed-OSS-36B-Instruct, DeepSeek-V3). The rest are output safety scores, secure-code tests, and one capability evaluation. The report adds a line here: no Chinese frontier text model has yet shipped with a dangerous-capability evaluation against the domains the International Dialogues on AI Safety (IDAIS) statements name, and GLM-5.3's cyber record is the closest thing to it.

2.3349 days is how long it took after launch for a safety appendix to reach the paper

Among the 16 documented only after the fact, the median lag is 42 days and the longest is 349. That longest case is DeepSeek-R1. One more field is worth opening here: what exactly was that "verified safety appendix"? Checked directly, it was a revision of the same paper. The first version of the R1 technical report, arXiv:2501.12948, went up on January 22, 2025, and the second version, which contains the safety appendix "D.3 DeepSeek-R1 Safety Report," went up on January 4, 2026. Counting from the model's public release on January 20, 2025, that is 349 days.

Most of the write-ups led with company names, listing Alibaba, ByteDance, Tencent, Baidu and DeepSeek side by side and attaching 3.6% to the row. That is less wrong than incomplete: the chart with all nine rows never appears in the prose and lives only inside a figure, so a reader who stays in the prose sees those names as interchangeable. Open the figure and every row carries a different number.

The nine rows of the report's chart. Ordered by release count, not by rate. The three columns sum to 857, 31 and 9, matching the headline figures. ⚠️ This table is not a ranking, for reasons set out below.

DeepSeek has a result attached to 6 of its 93 releases, close to twice the 3.6% average. Alibaba has 7 of 238. Grouped, as the report presents it: the five startups account for 20 results across 317 releases (6.3%), the four hyperscalers for 11 across 540 (2%). And the report nails the point down immediately after: no company is doing this as routine practice.

The report adds a few lines on why the rows differ. Zhipu is the only developer with a result every year since 2022. DeepSeek documented V3 at launch, and none of R1, V3.1 or the V4 family at launch. So what this table shows is less whose rate is higher than whether the thing is a procedure or an event. One company does it annually; for the rest, one family occasionally ships with a document attached.

3.1The report ruled out the league table first

The reason this table cannot be read as a report card is written in the report's own words: companies name variants at different granularity.

"Companies also name variants at different granularity (Alibaba's 238 releases count every Qwen size and snapshot), so per-company rates are indicative rather than a ranking."

When two denominators follow different counting rules, the rates do not compare. A company that gives every mid-size model a new name and increments a number for every snapshot ends up with a denominator in the hundreds; a company that treats a family as one release stays in the dozens. The numerator, safety documents, tends to arrive per family, so the finer a company slices its denominator, the lower its rate falls. Why the denominator has to be read first is something we worked through at length in a piece on the denominator behind AI diffusion metrics.

3.2Two registries count the same company as 238 and as 469

That the denominator is a function of how you count can be checked from outside as well. On October 12, 2026 we queried Hugging Face's public API directly for the number of repositories under each organization account. Alibaba's Qwen account holds 469. The report counts the same company as 238 releases.

Queried directly against the Hugging Face public API on October 12, 2026. ⚠️ This table is not a comparison between companies. A Hugging Face repository is not a release: quantizations, derivatives, non-language models and demos are mixed in, one company may run several accounts, and much of google's 1,136 is not a language model at all.

Neither number is wrong. They count different things. Until someone fixes what one release is, the denominator moves with whoever is counting, and rates built on top of it cannot be laid side by side.

3.3No release-level count of US developers is visible yet

So what share would US companies show under the same rule? That this question has no answer has already been pointed out. Look one step past it and two public indices do measure American and Chinese firms by the same yardstick. In both, though, a row is a company.

The unit of each count, separated out. ⚠️ The scores and grades from the two indices are not used here to compare companies, because that would route around the ranking the report ruled out. What those indices measure is company policy and disclosure practice.

There is no way to convert a company-level score into a release-level rate. So the answer to "what is the US share?" is not yet a number. The answer is this: among public counts, we could not find a registry built release by release in a way that could answer the question. China now has one, and it was built by a private research firm rather than a regulator.

"Was it disclosed at launch?" is not a judgment but a subtraction. Take the date the result was published, subtract the date the model was published, and zero or less means at launch while a positive number means afterwards. So where do rows without a date go? The answer sits in a footnote under the report's quarterly chart: 82 releases known only to the year or with no confirmable date, and 8 releases dated before 2023, are excluded from the count.

That footnote never appears in the prose. Yet add up every quarterly bar in the chart and the total is 767, exactly 857 minus 90. The exclusion was really applied, and reading the bars by eye gives the right values.

That footnote, drawn here as a band by Pebblous. The fifteen quarterly bars sum to 767, which matches 857 less the 90 excluded.

Eighty-two releases is 9.6% of the whole. This is not a flaw in the report so much as the cost of building a registry in a field that has none. What makes it matter is which figure those empty cells hold up. The 1.1% disclosed-at-launch rate is the output of a date comparison, and a date comparison is only possible on rows that have dates.

4.1Two lines stay on the floor, and no policy date lifts them

Quarter by quarter, releases climb from 3 in Q1 2023 to 101 in Q3 2025. The report's prose stops there. The chart has four more quarters after that, and the bars come down. The final quarter, though, covers only July 1 to September 15, so it is not the same length of time as the bars beside it.

Two more lines run across the same chart. Releases carrying a result never exceed 7 in a quarter, and releases disclosed at launch never exceed 3, with nine of the fifteen quarters at zero. While the bars grew thirtyfold, the two lines stayed on the floor.

Pebblous redrew the chart from the report's figures. The two dashed lines are not per-quarter values but the ceilings the report states. According to the report, no policy date in this period left a mark on either line, including the 2023 interim measures, the 1.0 and 2.0 editions of the safety governance framework, and the labeling rules.

The bars in the report's chart are split once more by color. Open-weight releases make up more than half of every quarter since mid-2023. That is why the dataset in section 1 records a weights status on every row, and the Shanghai AI Lab framework in section 6 treats open-weight release as the highest-risk deployment setting. The deployment mode written down as the most dangerous has been the majority throughout the period.

4.23.6% is a floor, not a final figure

The 349-day maximum lag brings an arithmetic consequence with it. Count 349 days back from the census cut-off of September 15, 2026 and you land on October 1, 2025, the first day of Q4 2025. Everything released after that is still inside the window in which a result could appear. By the quarterly bars that is 54 in Q4 2025, 54 in Q1 2026, 45 in Q2 and 23 in Q3: 176 releases, or 23% of the 767 with confirmed dates. That matches the figure the report gives.

So 3.6% is the share confirmed so far, not the final disclosure rate. The 1.1% disclosed at launch, by contrast, is immune to lag, because it compares dates that have already passed. Two figures from the same report behave differently, and the one that will not move is the second.

Some of the releases inside that window are named in the report's prose. The 2026 frontier releases — GLM-5.2, Moonshot's Kimi K2.5 through K3, the DeepSeek V4 family, Qwen3.7-Max and Qwen3.8-Max, and Doubao Seed 2.1 — were all undocumented at launch. The single exception is GLM-5.3, with its capability evaluation note, and that is the "one capability evaluation" counted when section 2.2 broke down the nine. The open window is on the 3.6% side. On the 1.1% side, the frontier releases of 2026 are already stacking up zeros.

4.3The 93% for reasoning models is the better side of the average

Reasoning models, "the fastest-moving category," shipped without a published result 93% of the time, the report says. That sentence often gets carried as "reasoning models are the darkest corner," but put the numbers side by side and it runs the other way. Across the whole set, the share with no disclosure of any kind is 94.9%, and the share with no confirmed result at any point is 96.4%. The 93% is lower than both.

The three shares have different denominators. The size of the reasoning model population is not in the report, so no release count is back-calculated here. Only the ordering of the shares is usable.

Why single the category out, then? Not because the rate is worse but because the category matters. The qualifier the report attaches is "fastest-moving." In the same paragraph the weight falls on a different point: no Chinese frontier text model has yet shipped carrying a dangerous-capability evaluation.

4.4Other trackers record the same quarters as an acceleration

Reading the last four quarters of declining bars as Chinese model releases slowing down runs into other evidence. Epoch AI records four frontier-class open models arriving in the eight weeks between late April and mid-June 2026, and the mid-2026 round-ups from Artificial Analysis and Hugging Face describe Chinese labs as accelerating.

This is not a contradiction but a difference of denominator. SemiAnalysis's 857 is a narrow, deep count of every variant and snapshot from nine companies; the others are broad, shallow counts of notable or frontier-class models only. An exhaustive census also picks up recent releases less completely, because documentation accumulates over time, and the partial final bar truncates in the same direction. So this article uses neither as a conclusion. Its axis is not release velocity but whether a record exists.

That is the disclosure record. But the disclosure rate is the evidence this report offers. The conclusion is institutional, and it lives in the last column of a chart. The report tabulates nine binding rules China has issued since 2025 and asks of each one whether it reaches frontier training. For all nine the answer is "does not reach" or "no frontier-specific threshold."

The nine rows of the report's chart. Its prose enumerates only eight of them and leaves GB/T 45654-2025 to the chart alone. ⚠️ The report gathers all nine under the heading "binding rules," but the legal-status column of that same chart records GB/T 45654-2025 as a recommended national standard and the May 2026 implementing opinions on AI agents as policy guidance. The nine in this table are the chart's nine, and "binding" is as wide as that chart made it. What the May 2026 agent rules actually separate is set out in our piece on China's decision tiers for AI agents.

What those nine rows govern is, in every case, what an AI says and what it does to people. Not one obligation is triggered by compute or by model capability. The line the report puts under this chart is short.

"Compliance therefore tells us nothing about frontier safety. A Chinese lab can satisfy every rule on this list without ever running a dangerous-capability evaluation."

This is not a claim that Chinese regulation is weak. In the same passage the report describes a regime stricter than any in the world on content and on process for public-facing services. What is loose is the frontier, and the comparison it reaches for is the EU and California, where obligations switch on at a compute threshold. One regime holds the strictest field and the loosest one at the same time. The speed side has numbers attached too: the State Council's AI+ Action Plan targets adoption of agents and intelligent terminals at 70% by 2027 and 90% by 2030.

5.1The document that names the most advanced risks is the least binding

The gap is not one of awareness. The AI Safety Governance Framework 3.0, issued by TC260 on September 14, 2026, added a new category of model risk called behavior deviating from expectations. Acquiring permissions and external resources without authorization, circumventing safeguards, deceiving evaluators, concealing true capability and refusing instructions all sit under it, with boxed examples of a model disabling a shutdown script, a model hiding capability during evaluation, and a model escaping its sandbox into live systems. The report notes that this document's vocabulary overlaps strikingly with the Dario Amodei essay Chinese state media criticized the same week.

Yet the same document puts "advance AI innovation and development as the top priority" in its first principle. And until the state mandates it, the framework is advisory. The report counts seven documents in five days that week, every one of them about how agents or applied services are built, deployed and offered to whom. The frontier gap did not move that week either. A comprehensive AI law appeared in the 2023 and 2024 legislative plans and dropped out in 2025, which the report dates to four months after the DeepSeek moment.

5.2Of the three capability-triggered regimes, one writes publication into law

The report names the EU and California in a single line as its comparison. Writing from Korea, we need one more column. Separate the three regimes by what triggers them and by where the evaluation result goes, and it looks like this.

Four regimes, separated by trigger and by destination. The EU row has to be read in two parts, statute and voluntary code: participation in the code is voluntary, and even there publication is a summary "to the extent necessary." The Korean government has stated that no domestic model currently meets the threshold, and a grace period is in place. The scope of California's incident reporting is handled separately in our piece on SB 53 incident reports.

Pebblous combined the report's table with the text of four regimes into one figure. "Submission" on the EU row follows the statute; the conditional published summary under the voluntary code of practice is not represented here.

Concluding that China lacks the capacity to evaluate frontier models would be wrong, and the report says so first. Shanghai AI Lab published a Frontier AI Risk Management Framework in July 2025 and, after two revisions, released version 2.0 at the World AI Conference in July 2026. It draws thirteen red lines across five risk domains and says deployment stops in the red zone. According to the report it proposes effective-compute jumps of 4× and 10× as evaluation trigger points, treats open-weight release as the highest-risk deployment setting, and asks developers to measure how cheaply fine-tuning strips safety training before weights go out. The lab has also run some twenty Chinese and Western models through the UK AI Security Institute's evaluation tooling.

The institutions exist too. The evaluation run by CAICT, under the Ministry of Industry and Information Technology, is the closest thing to an official safety test in China, and its February 2026 version 2.0 added deception, loss of control, misuse in dangerous domains and agent risk. The China AI Safety and Development Association (CnAISDA), launched in Paris, is a network of eight institutions that represents China abroad. And then the report attaches one sentence to the whole ecosystem: none of these bodies has real authority.

The descriptions the report attaches to four bodies. Zhou Bowen, director of Shanghai AI Lab, also chairs TC260's AI safety working group. The two most frontier-oriented Chinese documents run through one person.

6.1There is a list of names, but the scores are not attached to them

Of those four rows, the one that meets this article's axis head-on is the second. CAICT tests models by invitation, with participation voluntary, and has published results quarterly since Q1 2024. Those publications are anonymous by practice. There is one exception, and the exception gives the sharper picture. The July 2025 test dedicated to large code models published the list of all fifteen models tested — and then reported scores only as a distribution of risk grades, not attached to names.

So the usable sentence is not "names are erased" but "there is a list, and the scores are not attached to it." Go back to the counting rule in section 1: even when a result exists, if it is not tied to a model's name it is never counted in the first place. Official evaluation and exhaustive census are built so that neither can see the other. The publication format of the February 2026 version 2.0 is something this article could not confirm, so what is written here runs only as far as past practice.

6.2None of the nine has published a frontier safety framework of its own

Two zeros in the charts are cleaner than 3.6%. One is that not one of the nine companies has published a frontier safety framework. The other is the zero section 2.2 already recorded: not a single Chinese frontier text model has gone out carrying a dangerous-capability evaluation of the risk domains the IDAIS statements name. The first is the far side of something Pebblous has written about before. If Western labs quietly revising safety commitments they had already published was that story, this is the place where there is no document to revise.

The talking is sparse too. The report assembled a list of 65 statements by founders, chief executives and chief scientists at the nine companies, compiled twice independently and cross-checked. Fifteen actually address frontier safety; nine express concern and propose something; six of those nine come from Zhipu alone. At five of the nine companies, the founder or chief executive has said nothing on the subject. DeepSeek's Liang Wenfeng has made no public statement on safety or regulation in four years, and a 6,000-word keynote by Alibaba's Wu Yongming in September 2025 contains neither the word safety nor the word risk.

Pebblous redrew the "frontier safety statements" column from the report's leader-statement matrix as a bar chart. The figure counts only the statements that actually address frontier safety, out of 65 statements compiled across two independent passes. The body's "six of those nine" points at the nine of these fifteen that pair a concern with a proposal, so Zhipu's six sit inside that nine as well, and both figures are correct. Three bars sit at zero, while the body's tally of five silent companies looks only at the top of the house, the founder and the chief executive. The single statements from Alibaba and DeepSeek came from lieutenants, which the next paragraph takes up. Source: SemiAnalysis inventory of 65 leader statements.

The unit of the silence, though, is closer to seniority than to company. Xue Hui, Alibaba's vice president for security, acknowledged in September 2025 that AI safety capability lags the advance of model capability, and said new risks such as self-replication should be taken into research. Chen Deli, a DeepSeek researcher, said at Wuzhen that over a longer horizon the risks could be greater. Where safety literacy exists in these companies, the report concludes, it sits with the lieutenants rather than the commanders. Within the same nine there is a case pointing the other way. Zhipu's Zhang Peng signed the IDAIS Beijing red lines in March 2024, and two months later put his company's name to the Seoul Frontier AI Safety Commitments, the only Chinese company to do so at the time. This is the same developer that section 3 identified as the only one with a result every year.

The people who sit where the rules get written and the people who demand binding frontier rules barely overlap either. The report sorts 32 influential figures along two axes: ten who demand but hold no position, four who hold both position and demand, eight with position only, and ten with neither. A chart footnote then pares the four back. Two of them enter the demand column solely by signing an international statement, and one person's demand is a licensing regime for high-risk uses rather than a capability threshold. Of the 102 expert texts, thirteen call for binding frontier obligations, and in the report's words none of those thirteen got what it asked for.

The quadrant counts from the report's 32-figure matrix, redrawn by Pebblous. The highlighted cell (4 people) holds both a domestic position and a demand for binding rules — two entered it by signature alone, and one of them asked for a licensing regime covering high-risk uses. Source: SemiAnalysis expert matrix (32 individuals).

What those thirteen asked for connects directly to this article's axis. Six of them are technical: five IDAIS statements and an April 2026 editorial in National Science Review. They demand five things — registration of training runs above compute thresholds, safety cases submitted to regulators before release, independent third-party audits, shutdown of all copies of a model that crosses a red line, and legal mechanisms to enforce all of it. The remaining seven are model-law drafts from legal and policy scholars, arguing that binding obligations belong inside a comprehensive AI law.

The first two of those five are demands for a record before they are demands for more safety. Register training runs and the denominator this census had to build by hand comes into existence; require safety cases before release and the date column from section 4 is filled in from the start. Put differently, what Chinese scientists asked for and did not get is precisely the material SemiAnalysis assembled by hand-searching four years of model cards. Zeng Yi, a co-author of that editorial, sits on the National AI Governance Committee, and what the editorial says is that the progress of AI governance is alarmingly slow and that relying on the self-control of AI developers is an illusion. The line the report puts underneath is that the state's answer, so far, has been to rely on exactly that.

6.3Two counterarguments from inside China sit in the report as well

Reading this report as "China doesn't care about safety" and closing the file means dropping the voices pointing the other way that the report itself carries. There are two. Zhu Songchun, director of the Beijing Institute for General Artificial Intelligence, told the 2026 World AI Conference that the "human extinction narrative" is one of three technical misjudgments packaged for capital. The other two are the claim that large language models are AGI and the scaling law. On Anthropic raising money at a trillion-dollar valuation while saying its Mythos model was too dangerous to release, he said the industry calls the practice of selling risk and marketing fear "Oppenheimer-style marketing." He added a caveat in the same appearance: this does not mean AI safety and regulation are unimportant, but that there is a logic of capital in inflating the problem to the level of human extinction.

Zhi Zhenfeng of the Institute of Law at the Chinese Academy of Social Sciences wrote from a different angle in December 2025. The great-power debate over comprehensive AI legislation, he argued, has taken on the character of "cognitive domain shaping," a term borrowed from military vocabulary. Washington passes almost no binding federal AI regulation and loosens the reins at home, he observed, while the flood of bills that never pass is misread on the Chinese side as evidence that America is tightening. In his words, the United States "shapes the cognitive domain by setting the AI legislative agenda, inducing other countries to tighten regulation and slow their own innovation."

And the report turns the same blade westward to close. Six days after the call to slow down, reporting appeared that Anthropic was weighing a new model ahead of an IPO, and four days after that Claude Opus 5.5 shipped. The launch post, which the company itself called its first release since asking for pacing, rewrites pacing as a way to "stay competitive with China." The report's last sentence is this.

"Nobody paces alone, not even the man who wrote the essay."

Why Pebblous Cares

The work was building a registry where none existed

What this report actually did was not commentary on Chinese AI. It was creating 857 rows and filling each one with a first public date, a weights status, a license and a source. That is the same kind of work Pebblous does in DataClinic when a client's dataset arrives and we check it for missingness, duplication and identifier consistency. Which is why the limits show up in the same shape as data quality limits do. The date field is empty on eighty-two rows, and those are the rows holding up the most widely quoted figure.

Deciding what counts as one release is primary-key design

The quietest sentence in this census is about a denominator. The report calls per-company rates indicative and gives its reason: companies name model variants at different granularity. In data quality the problem already has a name. It is entity resolution and primary-key design. Until that is settled, every rate that uses a count as its denominator fails to hold.

It is not that no specification exists for the thing results should attach to. Software already has identifier standards. A Package URL carries registry, name and snapshot in a single string of the form pkg:huggingface/{org}/{model}@{commit}, and CycloneDX's ML-BOM declares a model as a machine-learning component and holds model card fields inside it. SPDX 3.0.1's AI Profile defines the same slot. Annex XI of the EU AI Act requires a model description and evaluation results in the technical documentation. So what is missing is not the specification but the practice of filling that slot with results and publishing them. The adoption rate of these specifications is still low and the tooling immature, and that criticism is on the record too.

Where that ends up is CAICT in section 6. There is a list, the scores are not attached to the names, and so a result that exists is caught by no census at all. Turned around: the organization that ran the evaluation and the organization that can prove it ran one are different organizations. What separates them is neither the model nor the evaluation method. It is which identifier the result was tied to, and where it was left.

Four questions we have to hold up to ourselves

An admission first. Pebblous does not have a formal procedure for tying model and dataset evaluation results to a version identifier and leaving them in a publishable form either. The four items below are ones we have to apply to ourselves.

First, is there a stable identifier? When a version, a snapshot or a size changes, does it get a different name, or does the same name quietly change underneath? Second, are the evaluation results we publish tied to that identifier? "Our model was safety-trained" is the sentence this report decided not to count, and to be counted it has to say what was measured, on which model, and at what value. Third, measure the lag between evaluating and publishing. In this census the median for after-the-fact disclosure was 42 days and the longest was 349. What is that number in your organization, and does anyone know it? Fourth, separate publication from submission for the models you use. As the table in section 5 shows, Korea's regime and the EU's statute send results to the authorities. Those results exist, but they are not documents the adopting side can open. In procurement and due diligence, "it complies with the regulation" and "I can check it myself" are different fields.

The same test gets counted on one side and not the other

The vocabulary we use for AI safety mostly sits on the model side: alignment, red teaming, dangerous capability. The field this report opens is a different one. Two organizations run the same test, and one of them gets counted. The divide is not the test but the structure of the record. Pebblous can put this distinction into Korean first. Whether data is ready to go into a model, and whether what was done to a model is ready to be counted later, are two different inspections. The first has tools. The second still lives mostly in people's memory and internal wikis. And as long as rules attach to use instead of capability, the party demanding the second will be the buyer rather than the regulator for some time yet.

References

What this article reads

• 1.SemiAnalysis, Beijing Will Not Pace the Frontier: China's Speed-First AI Safety Regime, 2026-10-08. The byline carries Mark Chen, Doug and Dylan Patel; the page's author meta tag carries Mark Chen alone. The verbatim quotations and figures in the body were checked against the free full text and the six charts published with it. ⚠️ The report has a paywalled section, and the falsification tests for the next six months that the authors trailed sit inside it, so they could not be confirmed.
• 2.insideai.news · the420.in — the English coverage that reached this report first. The former noted the absence of a comparable figure for US developers; the latter noted first that the census measures transparency. The derived figure of "more than 150 a year" is the outlet's own arithmetic, 857 divided by roughly 5.7 years of coverage, and is not a figure from the report.

Primary model documents

• 3.DeepSeek-AI, DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learning, arXiv:2501.12948 — v1 submitted 2025-01-22, v2 submitted 2026-01-04, with the safety appendix "D.3 DeepSeek-R1 Safety Report" appearing first in v2. The 349 days in section 2.3 is the interval from the model's public release on 2025-01-20 to the v2 submission. The same work also appeared in Nature 645, 633–638 (2025).
• 4.Moonshot AI, Kimi K2 technical report §4.3 Safety Evaluation · Z.ai, GLM-4.5 technical report (including SafetyBench scores) — cases where a result sits inside a developer document. We could not verify the same section in later editions of either family.
• 5.NIST CAISI, Evaluation of DeepSeek AI Models (2025-09) · Assessment of Z.ai's GLM-5.2 (2026-07) · SaferAI, GLM-5.2 evaluation report — third-party evaluations rather than developer documents, so they fall outside this census's counting rule. The third row of the table in section 1.2 is why.

Comparable counts and identifier standards

• 6.Stanford CRFM, Foundation Model Transparency Index (December 2025 edition) — one row is one developer, measured against 100 transparency indicators. DeepSeek and Alibaba entered for the first time.
• 7.Future of Life Institute, AI Safety Index — Summer 2026 — one row is one company, graded by an expert panel across 37 indicators in 6 domains. Evidence cut-off 2026-06-03. Section 3.3 does not cite the index's grades as a comparison between companies.
• 8.Hugging Face public API, queried directly (2026-10-12) — the repository counts per organization account in the table in section 3.2. A repository is not a release.
• 9.OWASP CycloneDX, Authoritative Guide to AI/ML-BOM (the ML-BOM 1.7 specification was published 2026-09-17) · SPDX 3.0.1 AI Profile · the Package URL specification — specifications for the model identifier an evaluation result would attach to.
• 10.Epoch AI, The Epoch Brief, October 2026 · Hugging Face, State of Open Models, Summer 2026 — the cross-checks in section 4.4. Broad, shallow counts of notable models only, so their denominator differs from the 857.

Regimes — statute and commentary

• 11.EU AI Act, Annex XI (technical documentation under Article 53(1)(a)) — requires a model description and evaluation results in the technical documentation, but as submission on request from the AI Office rather than publication.
• 12.EU General-Purpose AI Code of Practice (2025-07-10), Safety and Security chapter, Commitment 10 and Measure 10.2 — the code · Commission guidance. Participation is voluntary, and even the publication is a summary to the extent necessary to mitigate systemic risk. The clause has been read both as widening disclosure and as hollowed out by its exceptions (CSET).
• 13.California SB 53 (TFAIA) explained — the 10²⁶ compute threshold, publication of an annual safety framework and transparency reports, critical incident reporting within 15 days, and penalties up to $1 million per violation.
• 14.Korea's Framework Act on the Development of AI and Establishment of a Basis for Trust (in force 2026-01-22) and Article 24(1) of its enforcement decree — government release · Lawtimes commentary. Safety obligations attach only when cumulative compute of at least 10²⁶, use of state-of-the-art technology, and broad and serious risk to fundamental rights are all met, and the implementation results go to the Ministry of Science and ICT.

Chinese institutions

• 15.Shanghai AI Lab · Concordia AI, Frontier AI Risk Management Framework — v2.0 was released at the World AI Conference in July 2026 and draws thirteen red lines across five risk domains. ⚠️ The 4× and 10× effective-compute evaluation triggers and the open-weight clause are recorded here only as relayed by the report.
• 16.CAICT dedicated safety test for large code models (2025-07, coverage) · ChinAI #351 — invitation-based, published quarterly, anonymous by practice. The July 2025 test published the list of all fifteen models tested but reported scores only as a distribution of risk grades. ⚠️ The publication format of the February 2026 version 2.0 could not be confirmed.

Related Pebblous articles

• 17.Quietly revising a safety commitment (section 6.2) · China's decision tiers for AI agents (section 5) · Measuring Chinese models' refusal behavior from outside (section 1.2) · Reading the denominator first (section 3.1) · The scope of SB 53 incident reporting (section 5.2) · Who audits the superintelligence accord (section 1) · What the UK AI Security Institute does