Just 3.6% of Chinese AI releases came with safety results

If you build on a Chinese open-weight model, assume nobody published a safety test for it.

That is the practical reading of a SemiAnalysis count that is now spreading through the press.

857 releases, 31 safety results

SemiAnalysis published the analysis on Oct. 8 under the title "Beijing Will Not Pace the Frontier." The authors, including Dylan Patel, looked at nine developers: ByteDance, Alibaba, Tencent and Baidu, plus DeepSeek, Moonshot, Zhipu (Z.ai), MiniMax and StepFun.

They counted 857 model releases from 2021 through Sept. 15, 2026: 741 products and 116 research releases. For each, they searched the developer's own documentation for a published, model-specific safety result. A vague line about "safety training" did not count.

The result:

31 of 857 releases, or 3.6%, ever came with a published safety result.

Only 9, or 1.1%, had one at or before launch. Sixteen were documented later, after a median of 42 days and as long as 349 days. SemiAnalysis says 813 releases, 94.9%, have no disclosure at all, and about 93% of reasoning models have no published results.

DeepSeek documented V3 at launch. SemiAnalysis found nothing published for V3.1 or the V4 family.

The full report sits behind SemiAnalysis's paywall after its opening sections. The numbers here come from the free part.

Speed is the policy

The authors' argument is that Beijing regulates AI applications and outputs heavily but puts no frontier-risk duties on labs tied to compute or capability. In their words, "China's real approach to AI safety is speed-based, not safety-based."

You can push back. Western labs do not publish everything either, and a system card is not proof of safety.

Fair. But a published evaluation is at least something you can read, question and rerun. For 94.9% of these releases there is nothing to question.

That gap does not stay in China. Open weights travel. Cloudflare's new Clef-omni decision model, in today's edition, is built on Alibaba's Qwen3-Omni, for example. When a base model ships without a safety result, every product built on top inherits the blank.

Your evals are the evals

None of this means a Chinese open-weight model is unsafe. It means you do not know, and the developer has not told you.

So do the work the developer skipped:

• Run a red teaming pass on the exact model and version you deploy, with prompts from your own domain.
• Check refusals and failure cases on the tasks your users will actually send.
• Put AI guardrails around inputs and outputs, and log what they catch.
• Re-test when you upgrade. A new version is a new model.

If a customer or regulator asks how you checked the model, "the lab said so" is not an answer you will have.

Watch the next big launches

Watch whether the next DeepSeek, Qwen or Kimi release ships with a safety result on day one. Watch whether Beijing's rules ever reach compute or capability.

Until then, test it yourself.