Verification moves to a third party: YD/T 7173

From 1 November 2026, an AI project review inside a Chinese state-owned enterprise will include one more question. The vendor hands over a compliance report, and its last page says the record is complete. The person across the table does not ask what the report says. They ask who wrote it, because the answer decides whether the document counts as evidence or as a statement about itself. If the system under review produced the verdict, the buyer is holding a self-description.

That question now has a date attached to it. China published a standard numbered YD/T 7173-2026, titled Artificial Intelligence, Safety Governance, System Risk Management Capability Requirements. MIIT approved it under announcement No. 18 of 2026 and published it on 15 July 2026, with an effective date of 1 November 2026. The China Communications Standards Association administers it, and CAICT drafted it with 22 universities, institutes and companies. The national standards registry shows the same 2 dates, so this is not a rumour with a number.

Here is the claim up front. The standard turns the identity of the verifier into a requirement, and the verifier has to sit outside the system that runs. That means a vendor’s self-attested compliance report loses its standing as a conclusion, though it keeps a use as a source of evidence. Put differently, our own report can show what happened, but it cannot settle the case for the buyer of 2026.

Of 3 capability blocks, accountability carries the weight

The standard splits capability into 3 blocks: organisational capacity, process management and risk protection. Organisational capacity covers layered authority, where leadership decides, management approves and execution delivers, and each of the 3 layers carries its own duty. It also requires documentation across the full lifecycle, traceability of the risk chain, and an external channel for reporting material risk. Writing that document takes a week. Keeping the record takes every working day.

Process management describes a loop of 4 stages: identification, assessment, treatment and improvement. Risk is graded at 4 levels, treatment is classified into 4 types, and the paperwork is summarised as 1 method table plus 3 registers. This block serves the management system rather than the runtime. So it checks whether a process was followed, and it says nothing about whether a system left a trace at 2am.

Risk protection lists 8 dimensions: reliability, controllability, security, fairness, transparency, explainability, privacy protection and accountability. Most enterprises already map 7 of the 8 to something they own, such as disaster recovery, access control or data masking. Accountability is the 1 that resists a document, because it needs an outside party to take part. In practice, 1 of 8 dimensions therefore decides whether the other 7 can be defended.

According to Yicai’s report on CAICT’s briefing on 11 August 2026, the standard puts 3 things behind that dimension: a model audit mechanism, independent verification of the operating process and its results, and an external oversight channel. Read together, the 3 clauses ask for logs that another party can recompute. A log kept only for internal eyes does not satisfy them, which means the test is whether 1 outside team can redo the check.

Take the 3 apart and the logic holds. Model audit means someone audits. Independent verification means the auditor cannot be the party running the system. External oversight means the path leads outside the organisation, and removing any 1 clause collapses the requirement. Which is why they cannot be met separately. In other words, the standard wants a ledger that travels and survives a recount, not a report that impresses for 20 minutes.

Why self-attestation carries no information

Most enterprises are not lying, and their problem is more basic than that. The report comes out of the system under audit, the checking rules come from the same system, and the conclusion naturally finds the system compliant. Mechanically, such a conclusion carries no information, because it cannot separate a good system from a bad one. A bad one prints the same 4 words, so the four words carry a weight of zero.

Audit earns its value from disagreement between 2 parties. One hands over the ledger, the other recomputes it, and the account holds when both arrive at the same place. Remove the second party and audit degrades into a self-description, but the mechanism fails quietly rather than loudly. So what has to be added is an outside entry point for pulling data, and a thicker report does not replace it.

Vendors push back with a familiar line about complete logs, present fields, continuous timestamps and working replay. That argument mixes 2 different things. Complete logs prove the system recorded honestly what it did, but they do not prove the recorded actions were right, and they do not prove the record was not trimmed by the system itself. The first is engineering, the second is authority, and whoever decides which actions enter the log decides the boundary of the ledger.

Blur those 2 things and the conclusion becomes circular: the record is complete, therefore the system is compliant. That sentence sounds airtight, yet it answers a question the buyer never put. It says whether an action left a trace, not whether the action should have been approved, and the second answer does not live with the party under audit.

We ran into this in our own product, in the least flattering form. For a stretch of time, the compliance report we shipped always concluded that the record was complete and the check passed. Technically that was true, because the check confirmed each action left a record and never asked whether the approval came from someone with authority to give it. We were player and referee at once, and our only question was whether we had shown up. That means the cleaner the report looked, the better it hid the gap.

We changed the output after that. The conclusion no longer returns a pass or fail, and it lists action-level records instead: which step, who approved, which rule allowed it, what came back. The judgment moves to the customer and their auditor, so our report became a source rather than a verdict. That change removed the easiest sentence we had to sell, and it points exactly where the standard points. The reason is simple: buyers want a ledger they can recompute, not our verdict on ourselves.

Layered authority lands on a table you renegotiate

Layered governance sounds abstract, but in engineering it becomes 3 questions about every class of action. Which task does this belong to, who is the single owner, and which attempt is this. The real difference between the 3 layers is not seniority but permission, meaning which actions may run unattended, which need a signature, and what the signer relies on at that moment.

Trouble starts when the model gets copied to a second site. A group proves an agent on 1 production line and negotiates the boundary in detail: reading data runs free, changing parameters needs a supervisor, and touching production configuration goes to the change board. That boundary is correct for that line, because the line’s risk profile justifies each of the 3 rules, but it holds for 1 line only.

Move to a second line and the risk profile differs, so the same action may belong to the security team rather than the supervisor. Move again to a finance shared-service centre and the boundary is redrawn for a third time. Every new business unit forces the same negotiation about what acts alone, who signs and on what basis, and that repetition is where scale stops.

The stop is not model capability, and it is not licence cost either, since both scale reasonably well across sites. What does not scale is the cost of copying an authorisation boundary through 3 layers of approval. The standard’s demand for full-lifecycle documentation and end-to-end traceability is a demand that this table be inspectable, editable and versioned, and meeting it with meeting minutes guarantees that documentation trails reality by weeks.

Reverse the arrangement and it works. If the boundary lives as configuration inside the runtime, every change leaves a trace, and traceability stops being a slogan on page 4. There is no shortcut here, because the table comes first and copying comes second. Whether the table lives as configuration or as minutes decides how many business units a group can add in 2026, and it decides whether anyone can name the approving layer after an incident.

The 4 assessment dimensions add an evidence list

CAICT is turning the standard into a service, and its release states that it has served leading Chinese manufacturers. It runs a dedicated risk assessment for agent services across 4 dimensions: tool supply chain security, memory security, inference execution security and platform operations security. The same release says it has helped more than 10 domestic AI companies build risk management capability, and that it launched a 2026 maturity assessment with finance and healthcare as the first 2 pilot sectors.

Those 4 dimensions deserve a separate look, because they work as an evidence checklist rather than as theory. Tool supply chain security asks whose tools you call, when a version changed, and how a failure traces back to 1 specific call. Memory security asks where remembered context sits, who can read it, and how it gets deleted when it expires.

Inference execution security asks what actions a model may take inside 1 run, and which layer blocks the ones that cross the line. Platform operations security asks who operates the system, who is on call at 2am, and how fast a failure surfaces. All 4 ask for records rather than promises, so they function as screening questions today, without waiting for an industry ranking to appear.

So the questions you can ask this week are concrete. Is there a version history for the tool inventory. Can memory be read under separate permissions. Is an unauthorised action rejected, or logged and allowed to continue. Who is on call for the runtime. Ask those 4 and a share of vendors drop out, especially the ones strong on demo dialogue and thin on records. We therefore treat the 4 dimensions as a procurement tool rather than a certification, because certification requires waiting and questions do not.

Where this argument stops holding

Boundaries first, or the argument becomes a scare tactic. One, we have not obtained the full text of the standard, and every clause here traces to the national registry entry, CAICT’s release or Yicai’s report on the briefing. Where the text differs from those 3 sources, the text wins. That means each clause has a public source behind it, and no clause here comes from the original document.

Two, it is not true that nobody in the industry does independent verification, and the claim is neither accurate nor necessary. The narrower statement holds: no vendor has turned it into an external ledger that a third party can recompute. Those 2 sentences sit far apart, because the first is mood and the second is a judgment. We write the second one, on all 4 platforms.

Three, no vendor including us may claim compliance with YD/T 7173, since conformity is a judgment for a qualified party. A vendor’s self-assessment is exactly what the standard removes, and we should not criticise the practice while using it. A vendor can describe which record a publicly reported clause maps to, and that limit applies to every competitor too.

There is a 4th boundary, aimed at consultancies. McKinsey’s 13 October 2026 article claims the enterprise AI operating system as its own framing, and it reports that 40% of large enterprises have deployed agents at scale while only 6% attribute more than 5% of EBIT to AI. Zero One Infinity shipped decision-centre products for executives and signed a memorandum with Deloitte China in August 2026. All of them move faster than most incumbents.

They produce judgments and recommendations, and those are useful. But when the party writing the report is also the party being validated, the recommendation does not become the record the standard asks for, because advice answers whether to act and verification answers who approved the act. Advice does not verify, and financial results do not verify either, for the same 1 reason.

So the standard does not mainly change the length of a procurement checklist, though the checklist will grow by a few rows. What it changes is who carries the burden of proof. Vendors used to prove they were good, and buyers now ask for a ledger someone else can recompute. A vendor whose books only it can open loses its place in that conversation, regardless of size.

Our judgment

Our judgment is that by writing independent verification into accountability, the standard announces in official language that self-attestation no longer holds. Most enterprise compliance material still sits at that level, so the gap is not theoretical. The dividing line is whether a third party can pull the same data and reproduce the result, not whether a report exists. A buyer-verifiable run ledger is the hardest ticket in this procurement cycle.

Three things follow, and all 3 fit in a week. First, open your compliance report to the conclusion page and ask who wrote it. If the answer is the system under review, replace the verdict with records and fill in 3 action-level fields: who approved, which rule allowed it, what came back. That step needs no procurement and no budget.

Second, draw the authorisation boundary as 1 table. Per business unit, list what acts alone, what needs a signature and who signs. Then redraw it for a second unit, and the copying cost appears within 20 minutes, along with the answer to whether the table is configuration or memory. If the table cannot be drawn at all, the boundary still lives in someone’s head.

Third, take the 4 assessment dimensions and produce 1 record for each. The dimension with no record is next quarter’s gap, . After 3 steps like these, you answer one more question in the review and get stuck on one fewer, while the preparation costs a few days and the payoff covers the whole conversation.

One testable question closes this. Hand your report to a third party that does not operate the system, and ask them to recompute it from the same data. If they reach the same conclusion, the material carries weight of its own. If they cannot, it proves only that the system once checked itself, which is where most vendors stand in October 2026.

Sources

National Digital Standards Registry: YD/T 7173-2026 registration entry (published 2026-07-15, effective 2026-11-01, administered by the China Communications Standards Association)

CAICT release (full text via CWW): three capability blocks, the one-table-three-registers paperwork, the four agent risk dimensions, more than ten companies supported, 2026 maturity assessment launched

Yicai, 11 August 2026, reporting CAICT’s briefing: eight risk dimensions, four-level risk grading, accountability defined as model audit plus independent verification plus an external oversight channel

McKinsey, 13 October 2026, The AI operating system: A new way for CEOs to run the enterprise (40% at scale, 6% attributing 5% or more of EBIT)