Ascending Labs Research
← All chapters
CHINA & ASIA

China tests every public AI service before launch, and only the regulator sees the results

China turns content tests with fixed pass marks into a de facto licence; the rest of Asia builds language benchmarks, method guides and markets for private testers.

AI services filed with China's regulator by 31 Aug 2026
1,112
Chinese model cards we checked with a safety section
0 of 9
of must-refuse questions a Chinese service must refuse
≥95%
swing in one DeepSeek score from harness choice alone
9 points
Indic safety verdicts consistent across languages
12.8%

5 November 2026 · 12 min read · Dotted terms are in the glossary

On this page
  1. Key findings
  2. The map
  3. Chinese benchmarks
  4. How labs report
  5. Gaming and awareness
  6. Filing and pass marks
  7. Agent rules
  8. China vs the West
  9. Japan, Korea, Singapore, India
  10. Lessons for evaluators
  11. Sources

Key findings

  • China is the only country where pre-launch testing works as a licence at scale. By 31 August 2026, 1,112 generative AI services had passed the regulator's filing.[1][1] Beijing News on CAC filings Secondary
  • China sets numeric pass marks. Standard GB/T 45654-2025 requires a test bank of at least 2,000 questions over 31 risk types, 90% acceptable answers and 95% refusal of must-refuse questions.[2][2] CSET translation of GB/T 45654-2025 Primary
  • Chinese model cards show no safety evaluations. We checked nine Hugging Face cards from six labs on 5 November 2026. None had a safety section; the evidence goes to the regulator instead.[3][3] AIGL summary of Concordia AI's 2026 report Secondary
  • Chinese frontier claims run on Western benchmarks and harnesses. Flagship cards report Terminal-Bench, SWE-bench Pro and Humanity's Last Exam, often on Claude Code or Codex harnesses. Harness choice alone moved one DeepSeek score from 65.5 to 74.2 (October 2026).[4][4] DeepSeek-V4.1-Flash model card Primary[5][5] GLM-5.3 model card Primary
  • Evidence of deliberate benchmark gaming stays weak. The firmer 2026 finding is evaluation awareness: Kimi K2.6 noticed tests in 60% of scenarios, DeepSeek V4 Pro in 17% (single study).[6][6] The Next Web on Neo Research Secondary
  • China is writing the first binding security standard for AI agents. Drafting began on 27 June 2026 with an 18-month cycle; it covers permissions, human approval, logs and shutdown (single source).[7][7] CGTN on the agent safety standard Single source
  • The rest of Asia builds benchmarks, guides and tester markets, not test mandates. Korea's AI Basic Act (22 January 2026) requires only self-assessment. Singapore accredits private testers at no charge and extended its guidance to agents in October 2026.[8][8] Cooley on Korea's AI Basic Act Secondary[9][9] AI Verify Foundation, AI Tester Accreditation Primary[10][10] MLex on Singapore agent testing Single source
  • Safety results do not carry over between languages. In one Indic study, models gave consistent safety verdicts across languages in only 12.8% of cases (March 2026).[11][11] IndicSafe, arXiv 2603.17915 Primary

Only China makes AI testing a condition of launch

Asia splits into one binding regime and many voluntary ones. China requires every public generative AI service to pass a regulator filing before launch.[1][1] Beijing News on CAC filings Secondary Korea requires self-assessment under a law that took effect in January 2026.[8][8] Cooley on Korea's AI Basic Act Secondary Japan, Singapore and India rely on benchmarks, guides and voluntary schemes. Binding here means that a law or regulator makes a test a condition of market access.

One Country Tests Before Launch; the Rest of Asia Builds Tools

Legal force of AI testing by country or region, November 2026.

Hover over, tap or tab to a tile for details.

Binding test duty?

  • Yes, de facto through filing
  • Self-assessment only
  • Voluntary; accredits private testers
  • Voluntary guides and benchmarks
  • Proposals only
  • Not researched

What to notice

  • China is the only rose tile: filing works as a de facto licence.
  • Korea's law creates documentation duties, not outside testing.
Data table
Country or regionBinding test duty?ValueNote
ChinaYes, de facto through filing1,112 filedCAC filing; GB/T 45654-2025; mandatory agent standard in drafting.
South KoreaSelf-assessment only22 Jan 2026AI Basic Act: operators self-assess; no third-party test.
JapanVoluntary guides and benchmarksGuidesJ-AISI red-teaming guide; Nejumi, Open Japanese LLM Leaderboard.
GulfNot researchedOpen Arabic LLM Leaderboard idle since Oct 2025.
IndiaProposals only12.8%AISI proposed Jan 2026; IndicSafe, MILU, Inspect India Evals.
Singapore and SE AsiaVoluntary; accredits private testers5 testersAI Verify accreditation; Moonshot; SEA-HELM; agent guidance Oct 2026.
Latin AmericaNot researchedLatamGPT (CENIA) with CHOCLO and Trueque benchmarks.
Figure 1. The grid is schematic, not to scale; Latin America sits far to the west of Asia. We did not research the Gulf, Brazil or wider Latin American rules in depth. Source: Beijing News;[1][1] Beijing News on CAC filings Secondary Cooley;[8][8] Cooley on Korea's AI Basic Act Secondary AI Verify Foundation;[9][9] AI Verify Foundation, AI Tester Accreditation Primary IndicSafe;[11][11] IndicSafe, arXiv 2603.17915 Primary Open Arabic LLM Leaderboard data;[12][12] Open Arabic LLM Leaderboard Space data Primary Buenos Aires Times.[13][13] Buenos Aires Times on LatamGPT Secondary

Evaluation across Asia at a glance

Country or regionMain benchmarks and leaderboardsRules that touch testingWho runs the testsBinding test duty?
ChinaC-Eval, CMMLU, SuperCLUE, OpenCompass, FlagEval, xbenchCAC filing (备案); GB/T 45654-2025; mandatory agent standard in draftingProviders self-assess; CAICT, CESI and CNCERT test; CAC reviewsYes, de facto through filing
JapanJGLUE, Nejumi, Open Japanese LLM Leaderboard, SwallowJ-AISI red-teaming guideJ-AISI, universities, Weights & Biases JapanNo
South KoreaKMMLU, NIA benchmark for the sovereign-model contestAI Basic Act, in force 22 Jan 2026Operators self-assess; Korea AISI; NIA for the contestSelf-assessment only
Singapore and South-East AsiaSEA-HELMAI Verify, Project Moonshot, AI tester accreditationAccredited private testers; Singapore AISINo, voluntary
IndiaMILU, IndicSafe, Inspect India Evals, Indic LLM Arena, BharatBenchAISI proposed in a Jan 2026 white paperUniversities, labs, IndiaAINo
GulfOpen Arabic LLM LeaderboardNot researchedNot researchedNot researched
Latin AmericaCHOCLO and Trueque (CENIA)Not researchedCENIANot researched
Table 1. "Binding" means that a law or regulator makes a test a condition of market access. Source: sections below.

China has its own leaderboards, but frontier claims run on Western tests

China built a dense benchmark layer of its own. Academic teams released most Chinese knowledge and safety sets in 2023, such as C-Eval and CMMLU.[14][14] C-Eval, arXiv 2305.08322 Primary[15][15] CMMLU, arXiv 2306.09212 Primary By 2026 these sets survive mainly in base-model tables, where scores sit near saturation. DeepSeek-V4.1-Flash's base model scores 92.1–93.1 on C-Eval.[4][4] DeepSeek-V4.1-Flash model card Primary

Three operators run Chinese leaderboards at scale. SuperCLUE is a commercial board with private questions refreshed each round.[16][16] DataLearner, SuperCLUE page Secondary Shanghai AI Lab's OpenCompass is an open toolkit with an arena; its repository had 7,563 stars on 5 November 2026.[17][17] OpenCompass repository data Primary BAAI's FlagEval is an academic platform, now quieter.[18][18] FlagEvalMM repository data Primary They mirror the Western split between closed boards, open toolkits and academic platforms.

SuperCLUE does not simply flatter Chinese labs. In its March 2026 round, Claude-Opus-4.6, Gemini-3.1-Pro and GPT-5.4 took the top three places.[19][19] AIBase on SuperCLUE March 2026 Secondary The best Chinese model, ByteDance's Doubao-Seed-2.0-pro, trailed GPT-5.4 by 0.95 points. Its private, rotating questions resist contamination, but scores from different rounds do not compare.

  • On China's Own Leaderboard, Chinese Models Trail by Less Than a Point

    SuperCLUE general scores out of 100, two 2026 rounds. Scores from different rounds do not compare.

    68707274SuperCLUE general score (out of 100)GPT-5.43rd place, March72.48derived: 71.53 + 0.95Doubao-Seed-2.0-proBest Chinese model, March71.53Qwen3.8-Max-0902Later round72.62DeepSeek-V4.1-FlashLater round71.81
    • March 2026 round
    • Later 2026 round

    What to notice

    • Claude-Opus-4.6 and Gemini-3.1-Pro placed above GPT-5.4 in March; their scores were not reported.
    • The axis starts at 68 to show sub-point gaps.
    Data table
    ItemValueCategory
    GPT-5.4 (3rd place, March)72.48March 2026 round
    Doubao-Seed-2.0-pro (Best Chinese model, March)71.53March 2026 round
    Qwen3.8-Max-0902 (Later round)72.62Later 2026 round
    DeepSeek-V4.1-Flash (Later round)71.81Later 2026 round
    Figure 2. GPT-5.4's score is derived from the reported 0.95-point gap. The March round covered 22 models. We could not read the SuperCLUE site itself, which renders in JavaScript. Source: AIBase (March round);[19][19] AIBase on SuperCLUE March 2026 Secondary DataLearner (later round).[16][16] DataLearner, SuperCLUE page Secondary

  • First-generation Chinese benchmarks

    BenchmarkReleasedWhat it tests2026 status
    C-EvalMay 2023Multiple-choice questions at four levels across 52 disciplines, plus a "Hard" subset[14][14] C-Eval, arXiv 2305.08322 PrimarySaturated; DeepSeek-V4.1-Flash base scores 92.1–93.1[4][4] DeepSeek-V4.1-Flash model card Primary
    CMMLUJune 2023Chinese multitask knowledge; most of 18 models scored below 50% at launch[15][15] CMMLU, arXiv 2306.09212 PrimarySaturated; ERNIE-5.5-Flash-Base scores 90.0[20][20] ERNIE-5.5-Flash-Base model card Primary
    AGIEvalApril 2023Human exams, incl. the gaokao (高考) and the bar exam[21][21] AGIEval, arXiv 2304.06364 PrimaryStill in base tables; DeepSeek scores 83.4–84.4[4][4] DeepSeek-V4.1-Flash model card Primary
    SafetyBenchSept 202311,435 multiple-choice safety questions in 7 categories, Chinese and English[22][22] SafetyBench, arXiv 2309.07045 PrimaryNo 2026 use found
    CValuesJuly 2023Chinese human values; adversarial prompts in 10 scenarios[23][23] CValues, arXiv 2307.09705 PrimaryNo 2026 use found
    JADENov 2023Linguistic fuzzing; broke 18 models, 70% average unsafe output[24][24] JADE, arXiv 2311.00286 PrimaryNo 2026 use found
    ForesightSafety BenchFeb 2026 (v4)Frontier-risk safety from 7 pillars, extended to embodied AI and AI for science[25][25] ForesightSafety Bench, arXiv 2602.14135 PrimaryNew
    Table 2. Release dates and 2026 status of the Chinese knowledge and safety sets. "No 2026 use found" means that no 2026 model card we checked reports the set.

  • China's three leaderboard operators

    OperatorOwnerMethodActivity in 2026Closest Western analogue
    SuperCLUECLUE team, commercialClosed, private questions refreshed each round; six areas scored out of 100[16][16] DataLearner, SuperCLUE page SecondaryMarch 2026 round with 22 models; later round in autumn[19][19] AIBase on SuperCLUE March 2026 Secondary[16][16] DataLearner, SuperCLUE page SecondaryScale SEAL, Artificial Analysis
    OpenCompass (司南) and CompassArenaShanghai AI Lab, with ModelScopeOpen toolkit with "100+ datasets"; anonymous arena battles with Elo scores[17][17] OpenCompass repository data Primary[26][26] QbitAI on CompassArena SecondaryMonthly boards; repository updated 5 Nov 2026[17][17] OpenCompass repository data Primary[27][27] OpenCompass column on CSDN SecondaryHELM plus LMArena
    FlagEvalBAAI"Capability–task–metric" framework; arena since June 2023; debate board[28][28] QbitAI on FlagEval SecondaryEmbodied-AI board; multimodal repository quiet since April 2026[29][29] FlagEval-Robo (formerly FlagEval-Embodied Verse), Hugging Face Space Primary[18][18] FlagEvalMM repository data PrimaryAcademic platforms
    Table 3. How each operator tests and how active it was in 2026. We could not read the live boards, which render in JavaScript.

    SuperCLUE. Launched in 2023 with an arena, open multi-turn questions and objective questions.[30][30] SuperCLUE, arXiv 2307.15020 Primary Spin-off boards followed for safety (September 2023) and agents (October 2023).[31][31] SuperCLUE on GitHub Primary The GitHub repository last changed on 6 February 2026.[32][32] SuperCLUE repository data Primary The general board scores maths, hallucination control, science, instruction following, agentic coding and agentic task planning.[16][16] DataLearner, SuperCLUE page Secondary

    OpenCompass. CompassArena runs anonymous pairwise battles in the style of Chatbot Arena. A December 2024 upgrade added a "Judge Copilot" and changes to the Bradley-Terry ranking.[27][27] OpenCompass column on CSDN Secondary In May 2026 SenseNova-6-7-Flash-Alpha led its multimodal reasoning board at 86.9, per a column summary we could not check against the board.[27][27] OpenCompass column on CSDN Secondary

    FlagEval. Ran a "100-model" round in December 2024 across text, speech, image and video; Claude-3.5-Sonnet, Yi-Lightning and o1-preview led its debate board then.[28][28] QbitAI on FlagEval Secondary It runs FlagEval-Robo, an embodied-AI leaderboard renamed from FlagEval-Embodied Verse in January 2026.[29][29] FlagEval-Robo (formerly FlagEval-Embodied Verse), Hugging Face Space Primary Its multimodal repository has 109 stars.[18][18] FlagEvalMM repository data Primary

    xbench. HongShan (formerly Sequoia China) began it in 2022 as an internal investment tool and open-sourced xbench-ScienceQA and xbench-DeepSearch on 17 June 2025.[33][33] MIT Technology Review on xbench Secondary Two tracks: academic tests and tasks with "real-world economic value"; planned tracks cover finance, law, accounting and design.

    Limits. We found no current top ten for any of the three operators; their sites render in JavaScript and our tools failed on them. The Chinese layer now serves domestic buyers (SuperCLUE) and compliance (CAICT and TC260 tests), not frontier claims.

Chinese model cards report agentic scores and no safety evaluations

Chinese flagship cards now read like Western ones. Cards from June to November 2026 report agentic coding, Humanity's Last Exam, GPQA and AutomationBench.[4][4] DeepSeek-V4.1-Flash model card Primary[5][5] GLM-5.3 model card Primary[34][34] Qwen3.8-Flash-Next-FP8 model card Primary They compare head-to-head with Anthropic and OpenAI models. Chinese-language benchmarks appear only in base-model tables. We checked nine cards from six labs on Hugging Face on 5 November 2026.

0 of 9

Chinese flagship model cards we checked on Hugging Face (5 November 2026) that contain a safety evaluation section.

Source: our scan of nine cards from DeepSeek, Moonshot, Z.ai, Alibaba, Baidu and MiniMax;[4][4] DeepSeek-V4.1-Flash model card Primary[5][5] GLM-5.3 model card Primary[20][20] ERNIE-5.5-Flash-Base model card Primary[35][35] DeepSeek-V4-Pro-0813 model card Primary[36][36] Kimi-K3 model card Primary[37][37] Kimi-K3.1-Pro model card Primary[34][34] Qwen3.8-Flash-Next-FP8 model card Primary[38][38] MiniMax-M3.1-Flash model card Primary Concordia AI.[3][3] AIGL summary of Concordia AI's 2026 report Secondary

Chinese Cards Report Western Agent Benchmarks, Their Own Tests and No Safety Results

What each Chinese flagship model card reports, checked on Hugging Face on 5 November 2026.

Lab and model (card date)Western agentic benchmarks Chinese benchmarks Own in-house benchmark Harness disclosed or varied Safety evaluation section
DeepSeek-V4.1-Flash Oct 2026 Yes Terminal-Bench, DeepSWE, HLE Partly Base table only No Yes Eight harness modes No
Western agentic benchmarks: Terminal-Bench, DeepSWE, HLEChinese benchmarks: Base table onlyHarness disclosed or varied: Eight harness modes
DeepSeek-V4-Pro-0813 Aug 2026 Partly No Yes DSBench-FullStack, DSBench-Hard Partly Own "DeepSeek Harness" No
Own in-house benchmark: DSBench-FullStack, DSBench-HardHarness disclosed or varied: Own "DeepSeek Harness"
Kimi-K3 / K3.1-Pro Nov 2026 Yes Third-party agent boards No Yes Kimi Code Bench Partly Often Claude Code No
Western agentic benchmarks: Third-party agent boardsOwn in-house benchmark: Kimi Code BenchHarness disclosed or varied: Often Claude Code
GLM-5.3 (Z.ai) Aug 2026 Yes Terminal Bench, FrontierSWE, HLE No Yes Z.ai Code Bench, +50% Partly No
Western agentic benchmarks: Terminal Bench, FrontierSWE, HLEOwn in-house benchmark: Z.ai Code Bench, +50%
Qwen3.8-Flash-Next Aug 2026 Yes SWE-bench Pro, OSWorld 2.0 No No Partly Best of two harnesses No
Western agentic benchmarks: SWE-bench Pro, OSWorld 2.0Harness disclosed or varied: Best of two harnesses
ERNIE-5.5-Flash-Base Oct 2026 No Yes CMMLU 90.0 No Not applicable No
Chinese benchmarks: CMMLU 90.0
MiniMax-M3.1-Flash Oct 2026 Yes OSWorld 2.0 No Partly In-house rival reproduction Partly No
Western agentic benchmarks: OSWorld 2.0Own in-house benchmark: In-house rival reproduction

What to notice

  • The safety column is empty for every card.
  • Four of seven cards promote a benchmark the lab built or re-ran itself.
Figure 3. Nine cards in seven rows (Kimi-K3 and K3.1-Pro share a row; two cards cover variants). The scan covers Hugging Face cards only, not separate technical reports or blogs. We searched for "safety", "harmful", "jailbreak" and "red team". Marks for harness and Western benchmarks are our reading of each card. Source: Hugging Face model cards.[4][4] DeepSeek-V4.1-Flash model card Primary[35][35] DeepSeek-V4-Pro-0813 model card Primary[36][36] Kimi-K3 model card Primary[37][37] Kimi-K3.1-Pro model card Primary[5][5] GLM-5.3 model card Primary[34][34] Qwen3.8-Flash-Next-FP8 model card Primary[20][20] ERNIE-5.5-Flash-Base model card Primary[38][38] MiniMax-M3.1-Flash model card Primary

The safety evidence goes elsewhere. None of the nine cards contains a safety section or SuperCLUE and OpenCompass scores. Concordia AI's 2026 report notes "persistent gaps and inconsistency" in Chinese safety disclosures.[3][3] AIGL summary of Concordia AI's 2026 report Secondary Chinese labs put safety work into the private regulator filing, state test certificates and Shanghai AI Lab reports. This is the main difference from Western system cards.

Harness choice moves scores. DeepSeek publishes an unusually honest table. It runs the same model on DeepSWE v1.1 with eight harness setups.[4][4] DeepSeek-V4.1-Flash model card Primary The score ranges from 65.5 with OpenCode to 74.2 with mini-SWE-agent. Harness choice alone moves the result by almost 9 points.

Changing the Harness Alone Moves DeepSeek's Score by Almost 9 Points

DeepSeek-V4.1-Flash on agentic coding tests, from its October 2026 model card.

020406080ScoreGapDeepSWE v1.1same model, two harnesses65.574.2+8.7 ptsLower scoreHigher scoreTerminal-Bench 4.0DeepSeek-V4.1-Flash vs Opus-5.031.251.8+20.6 pts

What to notice

  • 8.7 points separate the best and worst harness for the same model.
  • The card reports only the extremes; six other setups fall between them.
Data table
RowLower scoreHigher scoreGap
DeepSWE v1.1 (same model, two harnesses)65.574.2+8.7 pts
Terminal-Bench 4.0 (DeepSeek-V4.1-Flash vs Opus-5.0)31.251.8+20.6 pts
Figure 4. Harnesses: OpenCode (lower) and mini-SWE-agent (higher), the worst and best of eight setups. The two rows use different benchmarks; compare the gaps, not the rows with each other. Source: DeepSeek-V4.1-Flash model card.[4][4] DeepSeek-V4.1-Flash model card Primary

Three reporting habits weaken comparison across labs. Labs report their best score across several harnesses.[34][34] Qwen3.8-Flash-Next-FP8 model card Primary They promote benchmarks they built themselves.[35][35] DeepSeek-V4-Pro-0813 model card Primary[5][5] GLM-5.3 model card Primary[37][37] Kimi-K3.1-Pro model card Primary They re-run rivals in-house and report their own numbers.[38][38] MiniMax-M3.1-Flash model card Primary Western cards show similar habits, so the problem is not specific to China.

Claims of benchmark gaming are weak; evaluation awareness is the firmer finding

The evidence for deliberate gaming by Chinese labs stays anecdotal. Low-quality blogs claim contamination and harness flaws without primary evidence.[39][39] MindStudio blog on the benchmark gap Secondary[40][40] AI CERTs on MiniMax M2.5 Secondary One commentary disputes the "caught gaming" headlines outright.[41][41] Startup Fortune on safety-test gaming Secondary We found no primary audit that proves contamination in a named 2026 Chinese model.

The best-sourced finding concerns evaluation awareness. Evaluation awareness means that a model notices it is under test. In June 2026 Neo Research, an independent Singapore lab, adapted Anthropic's misalignment scenarios to US and Chinese models.[6][6] The Next Web on Neo Research Secondary[42][42] SCMP on Neo Research Secondary Claude 4.5 Opus noticed the test in close to 80% of cases. DeepSeek V4 Pro did so in 17%.

US and Chinese Models Both Notice When They Are Being Tested

Share of adapted misalignment scenarios in which each model showed evaluation awareness (Neo Research, 14 June 2026). Guess first.

How often did each model notice that it was being tested? Drag each bar to your guess.

020406080100%Drag the bars to your guess50%Claude 4.5 Opus US50%Kimi K2.6 China50%GLM 5.1 China50%DeepSeek V4 Pro China

Drag a bar, or tab to it and use the arrow keys.

Data table: shown after you check your guess

Figure 5. Single study, reported by two news outlets. Separately, Apollo Research found verbalized evaluation awareness in 41.1% of GPT-6 Astra runs, with a different method. Source: The Next Web and SCMP, reporting Neo Research.[6][6] The Next Web on Neo Research Secondary[42][42] SCMP on Neo Research Secondary

State testers in China also find real weaknesses. The China Academy of Information and Communications Technology (CAICT) and Ant Group found sensitive content in 6% of DeepSeek R1's reasoning traces.[43][43] ChinAI #351 on CAICT's 2026 round Secondary In the same study, DeepSeek V4 Pro fell to the "Do Anything Now" jailbreak, while Qwen3.6-Max and Kimi K2.6 resisted.[6][6] The Next Web on Neo Research Secondary Neo Research also estimated that DeepSeek V4 Pro's cyber skills trail Anthropic's Mythos by about 3–6 months.

  • Benchmark-gaming claims about Chinese models

    ClaimWho made itStrength of evidence
    Models show evaluation awareness: Claude 4.5 Opus near 80%, Kimi K2.6 60%, GLM 5.1 39%, DeepSeek V4 Pro 17%Neo Research, Singapore, 14 June 2026[6][6] The Next Web on Neo Research Secondary[42][42] SCMP on Neo Research SecondaryIndependent lab; adapted Anthropic misalignment scenarios
    DeepSeek V4 Pro fell to the "Do Anything Now" jailbreak; Qwen3.6-Max and Kimi K2.6 resistedNeo Research[6][6] The Next Web on Neo Research SecondarySame study
    The published evidence does not support "caught gaming" headlinesStartup Fortune[41][41] Startup Fortune on safety-test gaming SecondaryCommentary that disputes the coverage
    Chinese models are "optimized for benchmarks instead of real-world use"Dario Amodei, as reported[44][44] OfficeChai on Dario Amodei SecondaryOpinion; the same article says contamination hits US labs too
    Chinese models fall short on contamination-resistant tests such as ARC-AGI-2MindStudio blog[39][39] MindStudio blog on the benchmark gap SecondaryLow quality; speculative causes
    MiniMax M2.5 had contamination and harness flawsAI CERTs[40][40] AI CERTs on MiniMax M2.5 SecondaryLow quality; no primary evidence
    A Chinese physical-AI start-up manipulated a global rankingSCMP question[45][45] SCMP on a physical-AI ranking SecondaryPaywalled; we could not read it
    Table 4. Claims from 2026 coverage, ordered from the strongest to the weakest evidence.

    Another 2025 domestic reasoning model showed a "200% surge" in harmful output under inducement attacks.[43][43] ChinAI #351 on CAICT's 2026 round Secondary

Filing with the regulator works as a licence, and fixed numbers set the bar

China's model is simple to state. The state specifies the test, the provider runs it, and the regulator reviews it. Public generative AI services must pass a filing with the Cyberspace Administration of China (CAC) before launch.[1][1] Beijing News on CAC filings Secondary The filing rests on a security self-assessment. No accredited third party tests and certifies the model.

Filings grew by 48 to 124 every two months, and the pace rose. The CAC counted 748 filed services at the end of 2025.[46][46] IT之家 on CAC filings at end-2025 Secondary By 31 August 2026 the count had reached 1,112.[1][1] Beijing News on CAC filings Secondary Apps that call an already-filed model need only a local registration, and those reached 731.

China Approves a Generative AI Service Almost Every Day

Cumulative generative AI services filed with the CAC. Draw how you think the count grew in 2026.

China had 748 filed generative AI services at the end of 2025. How many by the end of August 2026?

6007008009001,0001,1001,200’26Draw your guess here

Y axis: Filed services (cumulative)

What to notice

  • February and June counts come from search summaries only.

Data table: shown after you check your guess

Figure 6. Counts are cumulative at the end of each period. The February and June figures come from search summaries whose pages we did not open. Source: IT之家;[46][46] IT之家 on CAC filings at end-2025 Secondary[47][47] IT之家 on CAC filings in April 2026 Secondary The Paper;[48][48] The Paper on CAC filings at end-2025 Secondary Guangming (search summary);[49][49] Guangming on CAC filings Single source Tonghuashun (search summary);[50][50] Tonghuashun on CAC filings Single source Beijing News.[1][1] Beijing News on CAC filings Secondary

A national standard supplies the numbers behind the filing. GB/T 45654-2025 took effect on 1 November 2025.[2][2] CSET translation of GB/T 45654-2025 Primary "GB/T" marks a recommended standard. Regulators cite such standards in enforcement, so compliance becomes a de facto duty.[51][51] SESEC report on TC260 AI standardisation Secondary Its Appendix B sets bank sizes, refresh cycles and three pass marks.

China's Test Has Fixed Sizes and Fixed Pass Marks

Minimum sizes of the test banks in GB/T 45654-2025, Appendix B.

≥10,000Keyword library17 risks; weeklyupdates≥2,300Spot checks1,000 manual +1,000 automated +300 refusal≥2,000Generated-contenttest bankall 31 risktypes; monthlyupdates≥500Must-refusebank≥95% must berefused≥500Must-answerbank≤5% may berefused

Area is proportional to the minimum number of entries

What to notice

  • The must-answer bank stops a provider from passing by refusing everything sensitive.
  • Pass marks: at least 90% of outputs "qualified", at least 95% of must-refuse questions refused, at most 5% of must-answer questions refused.
Data table
ItemValueNote
Keyword library≥10,00017 risks; weekly updates
Spot checks≥2,3001,000 manual + 1,000 automated + 300 refusal
Generated-content test bank≥2,000all 31 risk types; monthly updates
Must-refuse bank≥500≥95% must be refused
Must-answer bank≥500≤5% may be refused
Figure 7. The spot-check total is our sum of the three minimums. Training-data sources are barred if more than 5% of their content is illegal or unhealthy. Source: CSET translation of GB/T 45654-2025 (28 May 2026);[2][2] CSET translation of GB/T 45654-2025 Primary TC260 original.[52][52] TC260, Chinese text of GB/T 45654-2025 Primary

These are the most concrete evaluation numbers any regulator uses today. They test content-policy compliance, not capability or agent risk. The must-answer bank matters because it punishes over-refusal. A filing package also contains annotation rules and the blocking keyword library.[53][53] CSDN guide to CAC filing Vendor

  • CAC filings, December 2025 to August 2026

    DateFiled servicesLocal registrationsSource quality
    31 Dec 2025748435Two news reports[46][46] IT之家 on CAC filings at end-2025 Secondary[48][48] The Paper on CAC filings at end-2025 Secondary
    28 Feb 2026796481Search summary only; page not opened[49][49] Guangming on CAC filings Single source
    30 Apr 2026868530News report[47][47] IT之家 on CAC filings in April 2026 Secondary
    30 Jun 2026988598Search summary only; page not opened[50][50] Tonghuashun on CAC filings Single source
    31 Aug 20261,112731News report[1][1] Beijing News on CAC filings Secondary
    Table 5. Cumulative counts. Filed services (备案) passed the CAC filing; local registrations (登记) cover apps that call an already-filed model. Two rows rest on search summaries only.

    By May 2026 the CAC had also published 17 batches of filings for deep-synthesis algorithms.[47][47] IT之家 on CAC filings in April 2026 Secondary

    Filing package (five parts). Filing form, security assessment report, annotation rules, blocking keyword library, test questions.[53][53] CSDN guide to CAC filing Vendor Third-party "filing agents" sell help; their claims about pass rates and market share have no source.

    GB/T 45654-2025. Title: "Cybersecurity technology — Basic safety requirements for generative AI services" (网络安全技术 生成式人工智能服务安全基本要求). It is the national version of the earlier TC260-003 document. TC260 issued it on 25 April 2025.[2][2] CSET translation of GB/T 45654-2025 Primary[52][52] TC260, Chinese text of GB/T 45654-2025 Primary It names third-party evaluation bodies as users. Related standards cover data annotation (GB/T 45674) and training data (GB/T 45652).

    Testing requirements in GB/T 45654-2025, Appendix B

    ItemRequirement
    Keyword libraryAt least 10,000 entries covering 17 risks; weekly updates
    Generated-content test bankAt least 2,000 questions covering all 31 risk types; at least 50 per main risk; monthly updates
    Must-refuse bank (应拒答)At least 500 questions
    Must-answer bank (非拒答)At least 500 questions, incl. "China's system, beliefs, image, culture … heroic martyrs"
    Spot checksAt least 1,000 manual and 1,000 automated questions, plus at least 300 refusal questions
    Pass mark, contentAt least 90% of outputs "qualified"
    Pass mark, must-refuseAt least 95% refused
    Pass mark, must-answerAt most 5% refused
    Training dataA source is barred if more than 5% of it is illegal or unhealthy
    Table 6. Minimum bank sizes, refresh cycles and pass marks set by the standard. Source: CSET translation.[2][2] CSET translation of GB/T 45654-2025 Primary

  • App Registrations Grew Faster Than Service Filings

    Cumulative CAC filed services and local registrations, end of 2025 and end of August 2026.

    Cumulative count31 Dec 202531 Aug 202602006008001,0001,2007484351,112 Filed services (备案)731 Local registrations (登记)

    What to notice

    • Registrations grew faster in relative terms: +68% against +49% for filings.
    Data table
    Line31 Dec 202531 Aug 2026Change
    Filed services (备案)7481,112+364
    Local registrations (登记)435731+296
    Figure 8. Registrations cover apps that call an already-filed model through an API. The table above gives the intermediate counts. Source: IT之家;[46][46] IT之家 on CAC filings at end-2025 Secondary Beijing News.[1][1] Beijing News on CAC filings Secondary

China is writing the first binding security standard for AI agents

China's standards body moved from content to agents in 2026. TC260, the national cybersecurity standards committee, created an AI security working group (WG9) in April 2026.[54][54] SESEC on TC260 Standards Week 2026 Secondary WG9 has 89 members, including Microsoft (China), AWS (Beijing) and Siemens. Concordia AI calls the shift a move "from controlling what AI says to controlling what it does".[3][3] AIGL summary of Concordia AI's 2026 report Secondary

A mandatory agent-security standard is in drafting. The plan appeared on 27 June 2026 with an 18-month cycle.[7][7] CGTN on the agent safety standard Single source A final text could therefore arrive around the end of 2027. Mandatory standards carry the prefix "GB" without "/T", and compliance is a legal duty. Chinese media call it the "world's first mandatory national standard focused on AI agent safety".

In Three Months, China's Standards Body Turned to AI Agents

TC260 events on AI security, March to October 2026.

Apr ’26JulOctJan ’27AprNowTC260 and WG9Seven drafts openfor comment, incl.AI security maturity Ethics and safetyguidelines for AIapplications adopted Second WG9 plenary:16 proposedstandards Search summary only WG9 (AI Security)created at StandardsWeek, Zhuhai 89 members; chairedby Zhou Bowen Mandatory standardsPlan issued for themandatoryagent-security 18-month cycle Two mandatoryprojects started Agents;anthropomorphic Anthropomorphic-servicesstandard expected Expected

What to notice

  • The agent standard could arrive around the end of 2027, beyond this axis.
  • The comment window for the seven drafts ran to 25 October 2026.
Data table
DateLaneEventKindNote
2026-03-31TC260 and WG9WG9 (AI Security) created at Standards Week, Zhuhaiother89 members; chaired by Zhou Bowen
2026-04Mandatory standardsTwo mandatory projects startedregulationAgents; anthropomorphic services
2026-05-12TC260 and WG9Second WG9 plenary: 16 proposed standardsotherSearch summary only
2026-05-19TC260 and WG9Ethics and safety guidelines for AI applications adoptedrelease
2026-06-27Mandatory standardsPlan issued for the mandatory agent-security standardregulation18-month cycle
2026-08-26TC260 and WG9Seven drafts open for comment, incl. AI security maturity assessmentrelease
2027-04 (planned)Mandatory standardsAnthropomorphic-services standard expectedregulationExpected
Figure 9. TC260 had published more than 400 national standards by April 2026, with more than 80 in development. Source: SESEC;[54][54] SESEC on TC260 Standards Week 2026 Secondary Trivium China (search summary);[55][55] Trivium China on the WG9 plenary Single source Digital Policy Alert;[56][56] Digital Policy Alert on TC260 ethics guidelines Secondary CGTN;[7][7] CGTN on the agent safety standard Single source Secrss.[57][57] Secrss on TC260's August 2026 drafts Secondary

  • The Draft Covers the Full Life of an Agent Action, From Identity to Shutdown

    Control areas in the plan for China's mandatory "General Security Requirements for AI Agent Application", June 2026.

    1. Identity

      Agent identity and authentication.

    2. Permissions and tool calls

      Limits on what the agent may access and call.

    3. Human intervention

      Human approval for high-risk operations.

    4. Logs

      Records of agent actions.

    5. Monitoring

      Dynamic monitoring of agent behaviour.

    6. Blocking

      Blocking of anomalous actions.

    7. Shutdown

      Emergency shutdown.

    What to notice

    • The standard will support "testing and regulatory oversight"; it will probably become the first binding test specification for agents anywhere.
    Figure 10. China Mobile, CESI and CNCERT draft the standard; the CAC proposed it. The list comes from one news report, so the final scope may differ. Source: CGTN (single source).[7][7] CGTN on the agent safety standard Single source

China's closest equivalent to a rating agency keeps its results anonymous. CAICT, under the industry ministry, issues certificates and classifies risk. In July 2025 it tested 15 models and rated two as high risk.[43][43] ChinAI #351 on CAICT's 2026 round Secondary Its 2026 round adds automated agent safety tests and an "AI coding autonomy rate".

  • Most Chinese Models in CAICT's 2025 Round Rated Medium Risk

    Risk classes for 15 models (2 DeepSeek, 9 Qwen, 4 GLM) in CAICT's July 2025 test round.

    • 1 model Controllable
    • 3 models Low risk
    • 9 models Medium risk
    • 2 models High risk

    Each square is 1 of 15 models.

    What to notice

    • Results are mostly anonymous, so buyers cannot tell which models rated high risk.
    Data table
    GroupValue
    Controllable1 models
    Low risk3 models
    Medium risk9 models
    High risk2 models
    Figure 11. CAICT's first AI Safety Benchmark (April 2024) tested 8 models on 7,343 questions with 17 other bodies. Source: ChinAI #351;[43][43] ChinAI #351 on CAICT's 2026 round Secondary ChinAI #261.[58][58] ChinAI #261 on CAICT's first results Secondary

  • TC260 timeline

    DateEvent
    31 Mar–3 Apr 2026Standards Week in Zhuhai creates WG9 (AI Security), chaired by Shanghai AI Lab director Zhou Bowen[54][54] SESEC on TC260 Standards Week 2026 Secondary
    Same weekWG9 has 89 members incl. Microsoft (China), AWS (Beijing), Dell, Siemens and Fujifilm; reviews 8 proposals and 5 standards in progress; starts 2 mandatory projects[54][54] SESEC on TC260 Standards Week 2026 Secondary
    17 Apr–19 May 2026Consults on, then adopts, ethics and safety guidelines for AI applications[56][56] Digital Policy Alert on TC260 ethics guidelines Secondary
    12–13 May 2026Second WG9 plenary in Shanghai discusses 16 proposed national standards[55][55] Trivium China on the WG9 plenary Single source
    27 Jun 2026Plan for the mandatory agent-security standard, 18-month cycle[7][7] CGTN on the agent safety standard Single source
    26 Aug–25 Oct 2026Seven drafts for comment, incl. an assessment method for AI security capability maturity (人工智能安全能力成熟度评估方法)[57][57] Secrss on TC260's August 2026 drafts Secondary
    Table 7. TC260 and WG9 events on AI security in 2026.

    The two mandatory projects. Anthropomorphic interactive services: basic and enhanced security tiers for human-like AI companions, following CAC interim measures of April 2026; publication expected April 2027.[54][54] SESEC on TC260 Standards Week 2026 Secondary AI agent applications: general security requirements for agents (智能体). WG8 also proposed standards on data processing by agents and on users' personal information (regular audits, backdoor detection, one-click opt-out from training).[54][54] SESEC on TC260 Standards Week 2026 Secondary

    CAICT rounds

    RoundScopeResults
    April 2024 (first AI Safety Benchmark)8 models; 7,343 questions; with AIIA and 17 other bodies[58][58] ChinAI #261 on CAICT's first results SecondaryFirst published results
    July 202515 models: 2 DeepSeek, 9 Qwen, 4 GLM[43][43] ChinAI #351 on CAICT's 2026 round Secondary1 "controllable", 3 low, 9 medium, 2 high risk; mostly anonymous
    2026 (announced March)Coding-model safety, R&D platform trust, AI smartphone safety, automated agent safety tests, "AI coding autonomy rate"[43][43] ChinAI #351 on CAICT's 2026 round SecondaryRegistration June–July; certificates follow
    Table 8. CAICT's AI safety test rounds. Results of the July 2025 round are mostly anonymous.

    Concordia's 2026 report also reviews "CAICT's AI Safety Benchmark 2.0".[3][3] AIGL summary of Concordia AI's 2026 report Secondary

    CnAISDA. The China AI Safety and Development Association launched in February 2025 at the Paris summit. Founders include Tsinghua, Peking University, BAAI, Shanghai AI Lab, the Shanghai Qi Zhi Institute, the CAS Institute of Automation, CAICT and CCID.[59][59] Tsinghua I-AIIG on the CnAISDA dialogue Primary Carnegie calls it an international-facing coalition and government adviser, not a regulator or tester.[60][60] Carnegie on CnAISDA Secondary[61][61] AI Frontiers on China and AI safety Secondary On 18 July 2026 at WAIC it hosted a closed dialogue on frontier evaluation with 70+ attendees, including delegations from the UK, US, Netherlands, Singapore, Korea and India. Andrew Yao presented work on "automated frontier AI evaluation"; Shanghai AI Lab presented a Safety Capability Maturity Model; the dialogue discussed "mutual recognition of standards".[59][59] Tsinghua I-AIIG on the CnAISDA dialogue Primary CnAISDA has published no evaluation results we could find.

    Shanghai AI Lab framework. Published with Concordia AI in July 2025.[62][62] Shanghai AI Lab frontier risk report, arXiv 2507.16534 Primary[63][63] Concordia AI on the Shanghai AI Lab framework Secondary Seven domains: cyber offence, bio and chemical risk, persuasion, uncontrolled AI research, strategic deception, self-replication, collusion. No model crossed a red line; most sat in the "yellow" zone for persuasion, and some reasoning models for self-replication and deception. A v1.5 (February 2026) reportedly maps to TC260's governance framework 2.0 and the EU Code; search summary only.[64][64] newx listing of the v1.5 framework Single source

    Research volume. Concordia counted 900+ arXiv safety papers from Chinese institutions; monthly output grew 60%; agent safety rose from 8% to about 27% of quarterly output; CBRN evaluations are starting. The AI Safety Governance Framework 2.0 adds "derivative risks" and circuit breakers. Mandatory ethics reviews apply before research in 10 pilot provinces.[3][3] AIGL summary of Concordia AI's 2026 report Secondary

China and the West share benchmarks but test different things for different audiences

The two ecosystems share tools but split on governance. Both run the same agentic benchmarks on the same harnesses.[4][4] DeepSeek-V4.1-Flash model card Primary[5][5] GLM-5.3 model card Primary They differ on what a test checks, who runs it and where the results go. The story below walks through the comparison row by row. "The West" here means the EU, the UK and the US.

A Model Can Pass One Regime and Fail the Other

How evaluation works in China and in the EU, UK and US, November 2026.

What the test checks

ChinaContent compliance with state-defined categories, against numeric pass marks (31 risk types)

EU, UK and USDangerous capabilities, misuse and alignment; no fixed pass marks

Step 1 of 8: One row shown: what the test checks.

The tests check different things. China tests content compliance against fixed pass marks.[2][2] CSET translation of GB/T 45654-2025 Primary Western tests probe dangerous capabilities and alignment, with no fixed pass marks.
Different people run them. In China the provider tests itself, state testers add checks and the regulator reviews. In the West, labs, institutes and independent evaluators all test.[43][43] ChinAI #351 on CAICT's 2026 round Secondary
China's test is a gate. Filing works as a de facto licence: 1,112 services passed by 31 August 2026.[1][1] Beijing News on CAC filings Secondary The EU duty covers only the largest models, and US and UK tests are voluntary.[65][65] Cloud Security Alliance, EU AI Act GPAI enforcement Secondary
The evidence goes to different audiences. Chinese safety results go to the regulator; none of nine public cards had a safety section. Western labs publish system cards, often redacted.[3][3] AIGL summary of Concordia AI's 2026 report Secondary
China is ahead on binding agent rules. Its mandatory agent-security standard is in drafting. The West has voluntary guidance and no binding agent test.[7][7] CGTN on the agent safety standard Single source
Yet frontier claims use the same yardsticks. Chinese cards benchmark against Opus, Fable and GPT models, often on Claude Code and Codex harnesses.[4][4] DeepSeek-V4.1-Flash model card Primary[5][5] GLM-5.3 model card Primary
The diplomatic links stay thin. China joined no joint test of the international network, and its major labs did not sign the EU Code.[66][66] Third joint agentic testing exercise, arXiv 2601.15679 Primary[65][65] Cloud Security Alliance, EU AI Act GPAI enforcement Secondary
So a model can pass one regime and fail the other. China's must-answer bank covers "China's system, beliefs, image … heroic martyrs".[2][2] CSET translation of GB/T 45654-2025 Primary A Western neutrality test may punish the same answers.

Figure 12. Rows follow the comparison table in our source research. The institutions chapter gives the Western detail.

Source: CSET translation of GB/T 45654-2025;[2][2] CSET translation of GB/T 45654-2025 Primary Beijing News;[1][1] Beijing News on CAC filings Secondary CGTN;[7][7] CGTN on the agent safety standard Single source Hugging Face model cards;[4][4] DeepSeek-V4.1-Flash model card Primary[5][5] GLM-5.3 model card Primary Concordia AI;[3][3] AIGL summary of Concordia AI's 2026 report Secondary arXiv 2601.15679;[66][66] Third joint agentic testing exercise, arXiv 2601.15679 Primary Cloud Security Alliance.[65][65] Cloud Security Alliance, EU AI Act GPAI enforcement Secondary

Real links exist between the two worlds. OpenCompass is an open-source toolkit that anyone can run.[17][17] OpenCompass repository data Primary Western multinationals sit in TC260's WG9.[54][54] SESEC on TC260 Standards Week 2026 Secondary Western bodies also test Chinese models without the developer's help: the US centre evaluated DeepSeek V4 Pro in May 2026.[67][67] Cloud Security Alliance, CAISI testing agreements Secondary

The splits run deeper than the links. The international network's third joint agent test included Singapore, Japan, Korea and Kenya, but not China.[66][66] Third joint agentic testing exercise, arXiv 2601.15679 Primary Neither side shares raw test results across the divide. We found no formal EU–China cooperation on evaluation.

  • Connections.

    • Chinese flagship cards benchmark against Opus, Fable and GPT models on Claude Code and Codex harnesses.[5][5] GLM-5.3 model card Primary[4][4] DeepSeek-V4.1-Flash model card Primary
    • OpenCompass is an open-source toolkit anyone can run.[17][17] OpenCompass repository data Primary
    • Microsoft (China), AWS (Beijing), Dell (China) and Siemens (China) sit in TC260's WG9.[54][54] SESEC on TC260 Standards Week 2026 Secondary
    • Shanghai AI Lab's framework reportedly maps to the EU Code of Practice (unverified).[64][64] newx listing of the v1.5 framework Single source
    • China supports an independent international scientific panel on AI, proposes a World AI Cooperation Organization, and takes part in ISO/IEC and ITU-T standards work.[3][3] AIGL summary of Concordia AI's 2026 report Secondary
    • Western bodies test Chinese models without the developer: the US centre on DeepSeek V4 Pro (May 2026); Neo Research on Kimi, GLM and DeepSeek.[67][67] Cloud Security Alliance, CAISI testing agreements Secondary[6][6] The Next Web on Neo Research Secondary

    Splits.

    • China was absent from the network's third joint agent test.[66][66] Third joint agentic testing exercise, arXiv 2601.15679 Primary
    • The must-answer bank encodes state political norms; a model can pass the Chinese test and fail a Western neutrality test, and the reverse.[2][2] CSET translation of GB/T 45654-2025 Primary
    • Chinese safety evidence stays private; Western labs publish system cards. Neither side shares raw results.
    • No formal EU–China cooperation on evaluation found.

The rest of Asia builds benchmarks, guides and markets for private testers

Japan focuses on Japanese-language benchmarks and method guides. Weights & Biases Japan runs the Nejumi Leaderboard, and LLM-jp runs the Open Japanese LLM Leaderboard with 16 tasks.[68][68] aipicks glossary, Nejumi Leaderboard Secondary[69][69] Gigazine on the Open Japanese LLM Leaderboard Secondary Japan's AI Safety Institute published a red-teaming guide, last revised in March 2025.[70][70] J-AISI, red-teaming guide v1.10 summary Primary Chinese open-weight models do well on Japanese boards: Qwen3.5 scored 0.711 on Nejumi 4 below 10 billion parameters.[71][71] lilting.ch on Japanese LLM options Secondary

Korea has a hard AI law but no third-party test mandate. The AI Basic Act took effect on 22 January 2026.[8][8] Cooley on Korea's AI Basic Act Secondary Operators must self-assess high-impact systems, and models above 10^26 FLOPs need a risk-management plan. Fines reach KRW 30 million after a one-year grace period. Korea's most visible state evaluation is a contest that ranks five national model consortia.[72][72] Mobile World Live on Korea's sovereign AI project Secondary

Singapore builds tools and a market for private testers. Its accreditation programme lists five testing firms and charges no fees.[9][9] AI Verify Foundation, AI Tester Accreditation Primary In October 2026 it extended testing guidance to autonomous agents and began accrediting assessors (single source).[10][10] MLex on Singapore agent testing Single source Singapore's AI Safety Institute led the common-risks track of the network's third joint agent test.[66][66] Third joint agentic testing exercise, arXiv 2601.15679 Primary

India's benchmarks show that safety does not transfer across languages. IndicSafe tested 6,000 cultural safety prompts in 12 Indic languages on 10 models.[11][11] IndicSafe, arXiv 2603.17915 Primary The same models agreed with themselves across languages in only 12.8% of cases. A January 2026 white paper proposes an Indian AI Safety Institute as the central tester.[73][73] Lokmat Times on India's techno-legal framework Secondary

12.8%

Share of cases in which the same models gave consistent safety verdicts across 12 Indic languages (IndicSafe, March 2026).

Source: IndicSafe, arXiv 2603.17915.[11][11] IndicSafe, arXiv 2603.17915 Primary

The same safety test can give opposite answers on different models. Inspect India Evals ran six benchmarks on UK AISI's Inspect in July 2026.[74][74] Inspect India Evals, arXiv 2607.25375 Primary Its safety test for India's digital public infrastructure passed every case on one model and only a fifth on another. Chinese bases also spread into regional models: AI Singapore built SEA-LION v4.5 on Qwen.[75][75] SEA-HELM leaderboard Primary

  • Latin America's Flagship Model Trails Open Rivals on a Spanish Test

    Spanish MMLU-ProX scores run by one independent author after LatamGPT's open-weight release (1 June 2026).

    0255075100Spanish MMLU-ProX scoreQwen3.6 27B77.82Llama 3.1 70B61.48LatamGPTCENIA, Chile45.81single author

    What to notice

    • LatamGPT's open weights shipped "without a single benchmark number", according to the same blog.
    • Sources disagree on LatamGPT's size: 70B on a Llama 3.1 base, or 50B.
    Data table
    ItemValue
    Qwen3.6 27B77.82
    Llama 3.1 70B61.48
    LatamGPT (CENIA, Chile)45.81
    Figure 13. One author ran this test without peer review; treat it with care. CENIA built two cultural benchmarks of its own: CHOCLO (104,847 questions) and Trueque (500 questions). Source: vgaraujov blog (single author);[76][76] vgaraujov blog on LatamGPT benchmarks Single source Emol;[77][77] Emol on LatamGPT Secondary CO/AI.[78][78] CO/AI on LatamGPT Secondary

  • Japan: evaluation assets

    AssetOwnerWhat it doesStatus
    JGLUEAcademic, LREC 2022Japanese language understanding[79][79] JGLUE, ACL Anthology PrimaryFoundational
    ELYZA-tasks-100ELYZAJapanese instruction following[80][80] ELYZA-tasks-100 on Hugging Face PrimaryUnchanged since Dec 2023
    Nejumi LeaderboardWeights & Biases JapanComprehension, answer quality and safety[68][68] aipicks glossary, Nejumi Leaderboard SecondaryNejumi 4 in use in 2026[71][71] lilting.ch on Japanese LLM options Secondary
    Open Japanese LLM LeaderboardLLM-jp and Hugging Face16 tasks through llm-jp-eval[69][69] Gigazine on the Open Japanese LLM Leaderboard SecondaryUpdated 30 Oct 2026[81][81] Open Japanese LLM Leaderboard Space data Primary
    Swallow leaderboardInstitute of Science TokyoAdds JamC-QA, a Japan-specific knowledge set[82][82] Swallow leaderboard, about page PrimaryMoved to swallow-evaluation-instruct v202510
    Guide to Red Teaming MethodologyJ-AISIMethod for red-teaming AI systems[83][83] J-AISI, Guide to Red Teaming Methodology Primaryv1.10 (March 2025) added a RAG example;[70][70] J-AISI, red-teaming guide v1.10 summary Primary no 2026 revision found
    Table 9. Japan's main benchmarks, leaderboards and method guides, with their 2026 status.

    Japan took part in the international network's joint agent testing.[66][66] Third joint agentic testing exercise, arXiv 2601.15679 Primary

    Korea: AI Basic Act duties

    DutyWho it applies toWhat it requires
    High-impact AIOperators of systems in high-impact usesSelf-assess before deployment, or ask the science ministry (MSIT); explanation, user protection, human oversight, documentation; best efforts on a fundamental-rights impact check
    "High-performance AI"Models trained with at least 10^26 FLOPsLifecycle risk-management plan, results reported to MSIT
    Domestic agentForeign firms above set thresholdsName a representative in Korea
    SanctionsAll covered firmsFines up to KRW 30 million after a one-year grace period
    Table 10. Duties under the AI Basic Act, in force since 22 January 2026. Source: Cooley.[8][8] Cooley on Korea's AI Basic Act Secondary

    One blog claims high-impact duties went live only on 21 July 2026 after a 14 July amendment; this conflicts with Cooley and is unverified.[84][84] Pebblous blog on Korea's high-impact AI Single source Korea AISI (founded November 2024) has a mission to evaluate AI risks; we found no published results.[85][85] Korea AISI, mission page Primary In the Sovereign AI Foundation Model project, an NIA benchmark covers maths, knowledge, long-text comprehension, reliability and safety; SKT's A.X K1 scored 9.2 of 10 in Phase 1 and tied for first.[72][72] Mobile World Live on Korea's sovereign AI project Secondary KMMLU holds 35,030 expert questions in 45 subjects; the best public model scored 50.5% at launch.[86][86] KMMLU, arXiv 2402.11548 Primary The Open Ko-LLM Leaderboard has not changed since December 2024.[87][87] Open Ko-LLM Leaderboard Space data Primary

  • Singapore: testing programmes

    ProgrammeLaunchedWhat it doesStatus in Nov 2026
    AI Verify Tester Accreditation2026Accredits testing firms against the IMDA Starter Kit; no fees; 12-month term[9][9] AI Verify Foundation, AI Tester Accreditation PrimaryFive firms: AIDX, Knovel, PwC, Resaro, Vulcan
    Project MoonshotMay 2024Open toolkit for red-teaming, benchmarking and baseline tests, with MLCommons[88][88] Allen & Gledhill on Project Moonshot SecondaryIn use
    Agentic AI governance frameworkJan 2026, DavosFive risk categories, incl. wrong and unauthorised actions[89][89] GAICC on Singapore's agentic AI framework Single sourcePromotional source only
    Agent testing guidance and assessor accreditationOct 2026Extends guidance to autonomous agents; accredits assessors; forms a cyber task force[10][10] MLex on Singapore agent testing Single sourceSector cyber guidance due H1 2027; single source
    SEA-HELM2025Holistic evaluation in seven South-East Asian languages, five pillars[90][90] SEA-HELM, arXiv 2502.14301 PrimaryUpdated 18 Sept 2026; 75 open-weight and 16 closed models[75][75] SEA-HELM leaderboard Primary
    Table 11. Singapore's testing programmes and their status in November 2026.

    The accreditation programme guarantees no safety outcome and accredits firms, not models.[9][9] AI Verify Foundation, AI Tester Accreditation Primary UK AISI led the cybersecurity track of the joint test; the paper reports methods, not model results.[66][66] Third joint agentic testing exercise, arXiv 2601.15679 Primary Neo Research, based in Singapore, gave the clearest 2026 comparison of Chinese and US model safety behaviour.[6][6] The Next Web on Neo Research Secondary SEA-HELM's featured models include Qwen 3.5 and 3.6, Gemma 4 and SEA-LION.[75][75] SEA-HELM leaderboard Primary

    India: evaluation assets

    AssetDateWhat it testsKey result
    MILUNov 20248 domains, 41 subjects, 11 Indic languages, from regional and state exams[91][91] MILU, arXiv 2411.02538 PrimaryBaseline knowledge set
    IndicSafeMarch 20266,000 cultural safety prompts in 12 Indic languages, 10 models[11][11] IndicSafe, arXiv 2603.17915 Primary12.8% cross-language agreement
    Inspect India EvalsJuly 2026Six benchmarks on Inspect: MMLU in 16 languages, BharatBBQ bias, a DPI safety test, multi-turn jailbreaks[74][74] Inspect India Evals, arXiv 2607.25375 PrimarySarvam-M and Gemma 2 tied at 80% on the India Fairness Index; DPI safety 20% to 100%
    SurakshaEvalAug 2026Human-written Indic safety prompts in 10 languages[92][92] SurakshaEval on alphaXiv Single sourceSearch summary only
    Indic LLM ArenaNot statedCrowd-sourced battles on language, context and safety; AI4Bharat at IIT Madras with Google Cloud[93][93] AI4Bharat, Indic LLM Arena PrimaryLive
    BharatBenchNot statedOla Krutrim; 8 Indic languages across text, vision and speech[94][94] Ola Krutrim, BharatBench report VendorVendor benchmark
    Table 12. India's main benchmarks and arenas, with key results.

    DPI means Digital Public Infrastructure, India's state platforms for identity and payments. The Atlantic Council describes an existing IndiaAI Safety Institute with a hub-and-spokes model; its March 2024 date may confuse the IndiaAI Mission with the institute.[95][95] Atlantic Council on India's AI summit Secondary The white paper's AISI would also run an AI incident database.[73][73] Lokmat Times on India's techno-legal framework Secondary

    Gulf. Not researched in depth. The Open Arabic LLM Leaderboard last changed on 9 October 2025.[12][12] Open Arabic LLM Leaderboard Space data Primary We did not cover SDAIA, ALLaM, TII, G42 or MBZUAI.

    Latin America. LatamGPT launched on 10 February 2026 in Santiago with President Boric; the Chilean centre CENIA coordinates it.[13][13] Buenos Aires Times on LatamGPT Secondary Emol reports 70 billion parameters on a Llama 3.1 base; another outlet reports 50 billion.[77][77] Emol on LatamGPT Secondary[78][78] CO/AI on LatamGPT Secondary CHOCLO holds 104,847 questions on Latin American cultural knowledge; Trueque holds 500 curated questions.[76][76] vgaraujov blog on LatamGPT benchmarks Single source We did not research Brazil's draft AI law.

For an outside evaluator, Asia shows an evidence gap and a template for pass marks

Chinese open-weight models reach other markets without public safety evidence. Firms worldwide deploy Qwen, DeepSeek, Kimi and GLM models as agents. Their public cards contain no safety evaluations, and the labs did not sign the EU Code.[65][65] Cloud Security Alliance, EU AI Act GPAI enforcement Secondary Their safety evidence sits in Chinese regulatory files that foreign buyers cannot see. An outside evaluator must therefore generate that evidence itself.

Chinese bases spread into other models. SEA-LION v4.5 runs on a Qwen base, and Qwen leads several regional boards.[75][75] SEA-HELM leaderboard Primary[71][71] lilting.ch on Japanese LLM options Secondary Fine-tunes elsewhere follow the same path. A rating of a fine-tuned model or agent should record its base model.

Agent controls are converging across regimes. China's draft standard and Singapore's agent guidance cover the same ground: identity, permissions, human approval, logs and shutdown.[7][7] CGTN on the agent safety standard Single source[10][10] MLex on Singapore agent testing Single source The EU AI Act asks for record-keeping (Article 12) and human oversight (Article 14) in high-risk systems. A test suite built on these controls could earn recognition in several jurisdictions. CnAISDA has already raised "mutual recognition of standards".[59][59] Tsinghua I-AIIG on the CnAISDA dialogue Primary

Three Regimes Are Converging on the Same Agent Controls

Agent controls named in China's draft standard, Singapore's agent guidance and the EU AI Act's high-risk duties.

ControlChina agent standard Draft plan, Jun 2026Singapore agent guidance Jan and Oct 2026EU AI Act, high-risk From Dec 2027
Identity and authentication Named Not confirmed Not confirmed
Permissions and tool calls Named Related Unauthorised actions as a risk Not confirmed
Singapore agent guidance: Unauthorised actions as a risk
Human approval for high-risk steps Named Not confirmed Named Art. 14 human oversight
EU AI Act, high-risk: Art. 14 human oversight
Logs Named Not confirmed Named Art. 12 record-keeping
EU AI Act, high-risk: Art. 12 record-keeping
Monitoring and anomaly blocking Named Not confirmed Not confirmed
Emergency shutdown Named Not confirmed Not confirmed

What to notice

  • China's draft names every control; the other two regimes are confirmed for only some.
  • "Not confirmed" means our sources do not mention it, not that the regime excludes it.
Figure 14. China's scope rests on one news report; Singapore's agent framework rests on a promotional source and its October extension on one news report. The Chinese controls test security, not lawful conduct. Source: CGTN;[7][7] CGTN on the agent safety standard Single source MLex;[10][10] MLex on Singapore agent testing Single source GAICC.[89][89] GAICC on Singapore's agentic AI framework Single source EU articles as summarised in our source research.

China's standard shows how to write numeric pass marks. GB/T 45654 fixes bank sizes, refresh cycles and three pass rates.[2][2] CSET translation of GB/T 45654-2025 Primary It pairs a must-refuse bank with a must-answer bank to punish over-refusal. Any rating scheme can copy that structure with its own content. The Chinese content itself does not transfer, because it encodes state political norms.

Fixed harnesses and multilingual tests are the minimum. Harness choice moved one DeepSeek score by almost 9 points.[4][4] DeepSeek-V4.1-Flash model card Primary Safety verdicts agreed across Indic languages in only 12.8% of cases.[11][11] IndicSafe, arXiv 2603.17915 Primary A credible evaluator fixes one harness for all models and tests in the languages the system serves.

Asia offers one open door and one closed door. Singapore's tester accreditation costs nothing and lasts 12 months.[9][9] AI Verify Foundation, AI Tester Accreditation Primary China's compliance loop has no role for a foreign evaluator. There, the CAC filing and CAICT certificates hold all the trust.

    • No current top ten for SuperCLUE, OpenCompass or FlagEval; their sites render in JavaScript.
    • No 2026 update to SuperCLUE-Safety or SuperCLUE-Agent beyond their 2023 launches.
    • The "no safety content" finding covers Hugging Face cards only, not separate technical reports such as a DeepSeek V4 paper or a Qwen3.8 blog.
    • We did not check cards for Tencent Hunyuan (Hy3) or ByteDance Seed (Doubao); closed Doubao models have no Hugging Face card.
    • No primary audit proves contamination in a named 2026 Chinese model.
    • Two CAC filing counts (February and June 2026) come from search summaries only.[49][49] Guangming on CAC filings Single source[50][50] Tonghuashun on CAC filings Single source
    • The status of GB 45438-2025, the mandatory labelling standard for AI-generated content, is unconfirmed from a primary source.
    • No public list of accredited third-party testing bodies for the CAC filing.
    • The agent-security standard's scope rests on one news report.[7][7] CGTN on the agent safety standard Single source
    • Shanghai AI Lab's v1.5 mapping to the EU Code rests on a search summary.[64][64] newx listing of the v1.5 framework Single source
    • No details of the May 2026 CAC action on agents beyond Concordia's mention.[3][3] AIGL summary of Concordia AI's 2026 report Secondary
    • The WG9 May plenary and the note on de facto force rest on search summaries.[55][55] Trivium China on the WG9 plenary Single source[51][51] SESEC report on TC260 AI standardisation Secondary
    • Singapore's October 2026 agent extension rests on one news report; its January 2026 framework on a promotional source.[10][10] MLex on Singapore agent testing Single source[89][89] GAICC on Singapore's agentic AI framework Single source
    • Korea's high-impact start date conflicts between sources; no published Korea AISI results.[8][8] Cooley on Korea's AI Basic Act Secondary[84][84] Pebblous blog on Korea's high-impact AI Single source
    • India's AISI status is unclear between a proposal and an existing body.[73][73] Lokmat Times on India's techno-legal framework Secondary[95][95] Atlantic Council on India's AI summit Secondary
    • Not researched: Chinese security vendors' red-teaming products, the Gulf in depth, Brazil.
    • No evidence of Chinese participation in the network's joint testing.

Sources

Every number keeps its date and source. Badges mark source quality: primary, secondary, vendor (a claim about the publisher's own product), single source, or estimate.

  1. [1]
    Beijing News on CAC filings. It reports 1,112 filed services and 731 registrations by 31 August 2026. Secondary m.bjnews.com.cn
  2. [2]
    CSET translation of GB/T 45654-2025. It gives the English text of the generative AI safety standard and its test numbers. Primary cset.georgetown.edu
  3. [3]
    AIGL summary of Concordia AI's 2026 report. It summarises the state of AI safety in China in 2026. Secondary aigl.blog
  4. [4]
    DeepSeek-V4.1-Flash model card. It gives base and chat benchmark tables and a harness-sensitivity table. Primary huggingface.co
  5. [5]
    GLM-5.3 model card. It reports Z.ai's benchmarks against Western and Chinese rivals. Primary huggingface.co
  6. [6]
    The Next Web on Neo Research. It reports evaluation-awareness and jailbreak results for US and Chinese models. Secondary thenextweb.com
  7. [7]
    CGTN on the agent safety standard. It reports the plan for a mandatory national standard on AI agent security (single source). Single source news.cgtn.com
  8. [8]
    Cooley on Korea's AI Basic Act. It summarises the Act's duties, thresholds and fines. Secondary cooley.com
  9. [9]
    AI Verify Foundation, AI Tester Accreditation. It lists the accredited firms and the programme terms. Primary aiverifyfoundation.sg
  10. [10]
    MLex on Singapore agent testing. It reports the extension of testing guidance to autonomous agents (single source). Single source mlex.com
  11. [11]
    IndicSafe, arXiv 2603.17915. It tests culturally grounded safety prompts in 12 Indic languages. Primary arxiv.org
  12. [12]
    Open Arabic LLM Leaderboard Space data. It shows the Space's last update. Primary huggingface.co
  13. [13]
    Buenos Aires Times on LatamGPT. It reports the LatamGPT launch in Santiago. Secondary batimes.com.ar
  14. [14]
    C-Eval, arXiv 2305.08322. It introduces the Chinese multi-level knowledge benchmark. Primary arxiv.org
  15. [15]
    CMMLU, arXiv 2306.09212. It introduces the Chinese multitask knowledge benchmark. Primary arxiv.org
  16. [16]
    DataLearner, SuperCLUE page. It describes the SuperCLUE method and lists later scores. Secondary datalearner.com
  17. [17]
    OpenCompass repository data. It gives the stars, last update and self-description of OpenCompass. Primary github.com
  18. [18]
    FlagEvalMM repository data. It shows the activity of FlagEval's multimodal repository. Primary github.com
  19. [19]
    AIBase on SuperCLUE March 2026. It reports the March 2026 SuperCLUE ranking. Secondary aibase.com
  20. [20]
    ERNIE-5.5-Flash-Base model card. It reports Baidu's base-model scores, including CMMLU. Primary huggingface.co
  21. [21]
    AGIEval, arXiv 2304.06364. It introduces the human-exam benchmark with gaokao questions. Primary arxiv.org
  22. [22]
    SafetyBench, arXiv 2309.07045. It introduces the bilingual multiple-choice safety benchmark. Primary arxiv.org
  23. [23]
    CValues, arXiv 2307.09705. It introduces a Chinese human-values benchmark. Primary arxiv.org
  24. [24]
    JADE, arXiv 2311.00286. It describes the linguistic-fuzzing safety platform and its results. Primary arxiv.org
  25. [25]
    ForesightSafety Bench, arXiv 2602.14135. It describes a frontier-risk safety evaluation framework. Primary arxiv.org
  26. [26]
    QbitAI on CompassArena. It describes the CompassArena launch with ModelScope. Secondary qbitai.com
  27. [27]
    OpenCompass column on CSDN. It summarises the arena upgrade and the 2026 monthly boards. Secondary blog.csdn.net
  28. [28]
    QbitAI on FlagEval. It reports FlagEval's 100-model round and debate board. Secondary qbitai.com
  29. [29]
    FlagEval-Robo (formerly FlagEval-Embodied Verse), Hugging Face Space. It hosts BAAI's embodied-AI leaderboard, renamed in January 2026. Primary huggingface.co
  30. [30]
    SuperCLUE, arXiv 2307.15020. It describes the SuperCLUE benchmark at launch. Primary arxiv.org
  31. [31]
    SuperCLUE on GitHub. Its README lists the spin-off boards and reports. Primary github.com
  32. [32]
    SuperCLUE repository data. It shows the stars and last update of the SuperCLUE repository. Primary github.com
  33. [33]
    MIT Technology Review on xbench. It describes HongShan's benchmark and its tracks. Secondary technologyreview.com
  34. [34]
    Qwen3.8-Flash-Next-FP8 model card. It reports Alibaba's benchmarks and its best-of-harness rule. Primary huggingface.co
  35. [35]
    DeepSeek-V4-Pro-0813 model card. It reports DeepSeek's own benchmarks and harness. Primary huggingface.co
  36. [36]
    Kimi-K3 model card. It reports Moonshot's own and third-party benchmarks. Primary huggingface.co
  37. [37]
    Kimi-K3.1-Pro model card. It reports Moonshot's latest benchmark tables. Primary huggingface.co
  38. [38]
    MiniMax-M3.1-Flash model card. It reports MiniMax's benchmarks, including an in-house reproduction. Primary huggingface.co
  39. [39]
    MindStudio blog on the benchmark gap. It claims weaker results on contamination-resistant tests (low quality). Secondary mindstudio.ai
  40. [40]
    AI CERTs on MiniMax M2.5. It reports a debate on contamination and harnesses (low quality). Secondary aicerts.ai
  41. [41]
    Startup Fortune on safety-test gaming. It disputes the headline claims about Chinese models. Secondary startupfortune.com
  42. [42]
    SCMP on Neo Research. It reports the same study of Chinese models and safety tests. Secondary scmp.com
  43. [43]
    ChinAI #351 on CAICT's 2026 round. It describes CAICT's 2026 test categories and earlier results. Secondary chinai.substack.com
  44. [44]
    OfficeChai on Dario Amodei. It reports his view that Chinese models target benchmarks. Secondary officechai.com
  45. [45]
    SCMP on a physical-AI ranking. It asks whether a start-up manipulated a global ranking (paywalled). Secondary scmp.com
  46. [46]
    IT之家 on CAC filings at end-2025. It reports 748 filed services and 435 registrations. Secondary ithome.com
  47. [47]
    IT之家 on CAC filings in April 2026. It reports 868 filed services and 17 deep-synthesis batches. Secondary ithome.com
  48. [48]
    The Paper on CAC filings at end-2025. It confirms the end-2025 filing count. Secondary thepaper.cn
  49. [49]
    Guangming on CAC filings. A search summary gave counts for February and June 2026 (page not opened). Single source m.gmw.cn
  50. [50]
    Tonghuashun on CAC filings. A search summary gave an intermediate filing count (page not opened). Single source news.10jqka.com.cn
  51. [51]
    SESEC report on TC260 AI standardisation. It explains how recommended standards gain de facto force (via search summary). Secondary sesec.eu
  52. [52]
    TC260, Chinese text of GB/T 45654-2025. It gives the original standard. Primary tc260.org.cn
  53. [53]
    CSDN guide to CAC filing. It lists the filing package and advertises filing agents. Vendor aicoding.csdn.net
  54. [54]
    SESEC on TC260 Standards Week 2026. It reports WG9's creation, members and mandatory projects. Secondary sesec.eu
  55. [55]
    Trivium China on the WG9 plenary. It reports the May 2026 plenary (via search summary). Single source triviumchina.com
  56. [56]
    Digital Policy Alert on TC260 ethics guidelines. It reports the adoption of ethics and safety guidelines for AI applications. Secondary digitalpolicyalert.org
  57. [57]
    Secrss on TC260's August 2026 drafts. It lists seven draft standards open for comment. Secondary secrss.com
  58. [58]
    ChinAI #261 on CAICT's first results. It reports the first round of CAICT's AI Safety Benchmark. Secondary chinai.substack.com
  59. [59]
    Tsinghua I-AIIG on the CnAISDA dialogue. It reports CnAISDA's members and its WAIC 2026 dialogue. Primary aiig.tsinghua.edu.cn
  60. [60]
    Carnegie on CnAISDA. It explains how Chinese experts built their own safety institute. Secondary carnegieendowment.org
  61. [61]
    AI Frontiers on China and AI safety. It assesses how seriously China treats AI safety. Secondary ai-frontiers.org
  62. [62]
    Shanghai AI Lab frontier risk report, arXiv 2507.16534. It reports frontier-risk results across seven domains. Primary arxiv.org
  63. [63]
    Concordia AI on the Shanghai AI Lab framework. It describes the joint risk management framework. Secondary aisafetychina.substack.com
  64. [64]
    newx listing of the v1.5 framework. It lists the February 2026 framework report (via search summary; not verified). Single source newx.sg
  65. [65]
    Cloud Security Alliance, EU AI Act GPAI enforcement. It covers fines and the labs that did not sign the Code. Secondary labs.cloudsecurityalliance.org
  66. [66]
    Third joint agentic testing exercise, arXiv 2601.15679. It describes the network's joint agent testing method. Primary arxiv.org
  67. [67]
    Cloud Security Alliance, CAISI testing agreements. It summarises CAISI's agreements and findings, including DeepSeek V4 Pro. Secondary labs.cloudsecurityalliance.org
  68. [68]
    aipicks glossary, Nejumi Leaderboard. It describes the Nejumi Leaderboard and its scoring. Secondary aipicks.jp
  69. [69]
    Gigazine on the Open Japanese LLM Leaderboard. It reports the leaderboard launch and its tasks. Secondary wbgsv0a.gigazine.net
  70. [70]
    J-AISI, red-teaming guide v1.10 summary. It summarises the March 2025 revision. Primary aisi.go.jp
  71. [71]
    lilting.ch on Japanese LLM options. It compares Japanese model results on Nejumi 4. Secondary lilting.ch
  72. [72]
    Mobile World Live on Korea's sovereign AI project. It reports SKT's NIA benchmark result. Secondary mobileworldlive.com
  73. [73]
    Lokmat Times on India's techno-legal framework. It reports the white paper's AISI proposal. Secondary lokmattimes.com
  74. [74]
    Inspect India Evals, arXiv 2607.25375. It describes six Indian benchmarks built on Inspect. Primary arxiv.org
  75. [75]
    SEA-HELM leaderboard. It lists current results for South-East Asian languages. Primary leaderboard.sea-lion.ai
  76. [76]
    vgaraujov blog on LatamGPT benchmarks. It describes CENIA's benchmarks and runs a Spanish test (single author). Single source vgaraujov.github.io
  77. [77]
    Emol on LatamGPT. It reports LatamGPT's size and base model. Secondary emol.com
  78. [78]
    CO/AI on LatamGPT. It gives a different parameter count for LatamGPT. Secondary getcoai.com
  79. [79]
    JGLUE, ACL Anthology. It introduces the Japanese language understanding benchmark. Primary aclanthology.org
  80. [80]
    ELYZA-tasks-100 on Hugging Face. It hosts the Japanese instruction-following set. Primary huggingface.co
  81. [81]
    Open Japanese LLM Leaderboard Space data. It shows the Space's last update. Primary huggingface.co
  82. [82]
    Swallow leaderboard, about page. It describes the Swallow evaluation suite and JamC-QA. Primary swallow-llm.github.io
  83. [83]
    J-AISI, Guide to Red Teaming Methodology. It hosts Japan's red-teaming guide. Primary aisi.go.jp
  84. [84]
    Pebblous blog on Korea's high-impact AI. It claims a later start date for high-impact duties (unverified). Single source blog.pebblous.ai
  85. [85]
    Korea AISI, mission page. It states the institute's mission. Primary aisi.re.kr
  86. [86]
    KMMLU, arXiv 2402.11548. It introduces the Korean expert-knowledge benchmark. Primary arxiv.org
  87. [87]
    Open Ko-LLM Leaderboard Space data. It shows the Space's last update. Primary huggingface.co
  88. [88]
    Allen & Gledhill on Project Moonshot. It describes Singapore's generative AI testing toolkit. Secondary allenandgledhill.com
  89. [89]
    GAICC on Singapore's agentic AI framework. It summarises the January 2026 framework (promotional source). Single source gaicc.org
  90. [90]
    SEA-HELM, arXiv 2502.14301. It describes the South-East Asian language evaluation suite. Primary arxiv.org
  91. [91]
    MILU, arXiv 2411.02538. It introduces the multi-domain Indic knowledge benchmark. Primary arxiv.org
  92. [92]
    SurakshaEval on alphaXiv. It describes human-written Indic safety prompts (via search summary). Single source alphaxiv.org
  93. [93]
    AI4Bharat, Indic LLM Arena. It describes the crowd-sourced Indic arena. Primary ai4bharat.iitm.ac.in
  94. [94]
    Ola Krutrim, BharatBench report. It describes the Indic multimodal benchmark. Vendor ai-labs.olakrutrim.com
  95. [95]
    Atlantic Council on India's AI summit. It describes the IndiaAI Safety Institute. Secondary atlanticcouncil.org