Filed under national-standard
Every brief tagged "national-standard".
- § 01 · AI-AGENTS
Who Lets a Personal AI Agent In? Meta Muse, US Banks and Retailers, and the Pre-Research Behind China's Agent Data-Processing Standard
A full translation. 网安寻路人 opens a series, written with the core drafting group of the national standard Security Requirements for Data Processing by AI Agents (智能体数据处理安全要求), now being drafted, which shares the standard's preliminary research. The first installment is a case study, not a Chinese rule. It follows how US banks and retailers responded after Meta launched its personal agent Muse on September 8, 2026 and passed 10 million users in about six weeks. Amazon, JPMorgan, Schwab, and Morgan Stanley blocked or restricted outside agents, while Walmart, Shopify, and Best Buy opened controlled gateways. The author traces two fault lines. The first is identity, overreach, and liability: agents logging in with customers' credentials leave platforms unable to tell the customer, a mistaken agent, and an impostor apart. The second is control of shopping entry points and profit pools, from Amazon's roughly $70 billion ad business to banks' low-cost deposits. The industry's answer is moving from 'silent agents' toward verifiable agent identity (KYA), scoped credentials, read-only interfaces, and human approval for high-risk acts. With the original's seven charts, its timeline, its ten-row comparison of institutional policies, and its 26 notes.
- § 02 · DATA-ASSETS
Two Registrations, One Word: China's New Data-Asset Standards and the Line Between 登记 and 登记
On 2 July 2026 China issued two national standards for data as an asset — GB/T 47949-2026 (classification and codes) and GB/T 47950-2026 (registration guidance) — both effective 1 September 2026. They give data assets a fixed place in the asset-classification code system (block A0806020000, including a first-ever asset code for AI-training multimodal data measured in tokens) and a step-by-step model for putting data on an organization's own books. The trap for overseas counsel is the word 登记 (registration): these MOF/SAC standards register data as an asset internally, while the National Data Administration's Data Property Rights Registration Work Guide (Trial), finalized 1 July 2026, registers rights in data externally through a certificated institution. Same word, two regimes, two artifacts, two purposes. This DCC brief separates them, reads the two standards for what they require, and explains why the 入表 (balance-sheet entry) vs 确权 (rights confirmation) distinction keeps tripping up data-asset deals.
- § 03 · SENSITIVE-PERSONAL-INFORMATION
Seven Highlights of China's New Sensitive Personal Information Processing Standard — and What They Mean in Practice
GB/T 45574-2025 《数据安全技术 敏感个人信息处理安全要求》 (Data Security Technology — Security Requirements for Processing Sensitive Personal Information) is China's first dedicated national standard on sensitive personal information (敏感个人信息), effective 1 November 2025. Authored by Wang Yi, Zhao Yanming, and Zeng Lingwei of the Shenzhen Data Exchange DEXC+ program, this brief walks through the seven highlights the standard introduces: a recalibrated scope of what counts as sensitive personal information under PIPL, dynamic classification logic, a new linkage between sensitive-PI volume and the important data threshold, industry-specific and group-specific protections, data-security-maturity requirements, a model written-consent template, and tightened lifecycle obligations covering collection, storage, display, and audit. The operational takeaway for overseas counsel: the standard converts PIPL's high-level sensitive-PI obligations into testable, auditable requirements — compliance teams should treat it as the primary implementation guide for PIPL Article 28 and beyond.