China's AI Labs Disclosed Safety Tests for Just 3.6% of Model Releases — Now the West Has a Number to Cite

China's binding AI rules live at the application layer, not the model layer. The September 2024 Interim Measures on Generative AI and the subsequent AI Safety Governance Framework (now at version 3.0, released at the 2026 Cybersecurity Week in Jinan) impose no capability-triggered disclosure duty on the frontier developer; they govern what deployers do with the model after release. CAICT's AI Safety Benchmark 2.0, published in February 2026, adds deception, loss-of-control, dangerous-domain misuse, and agent-risk axes — but again as a benchmark, not a release gate (SemiAnalysis, Oct 8, 2026; Concordia AI, State of AI Safety in China 2026).

The empirical signature of that design choice is now visible. Across all 9 labs combined, the median delay between a model launch and a published safety result is 42 days; the worst case — DeepSeek-R1 — waited 349 days, with its verified safety appendix only dated January 2026. None of the four hyperscalers — Alibaba, Tencent, Baidu, and ByteDance — produced a single document touching cyber-offence or biological risk; the only three releases that did (GLM-5.2 and GLM-5.3 from Zhipu, Kimi K2's technical report from Moonshot) came from smaller labs (SemiAnalysis, Oct 8, 2026).

On the U.S. side, the disclosure baseline is moving in the opposite direction. Anthropic's draft S-1, leaked on September 29, devotes roughly 80 of its 261 pages to AI risk factors and explicitly tells prospective investors that advanced AI could pose \"catastrophic or existential risks to humanity\"; the prospectus envisions a $2 trillion-plus Nasdaq IPO in November 2026 (Reuters, Sep 29, 2026; Anthropic news, Jun 1, 2026). OpenAI publishes a system card for every model it ships — GPT-5, GPT-5.5, GPT-5.6, and the September 2026 Astra release are all on the company's Deployment Safety Hub (OpenAI Safety Hub). And Anthropic publishes system cards on the same cadence — Claude Mythos Preview's 244-page document was released April 8, 2026 (Claude Mythos Preview System Card).

The Future of Life Institute's AI Safety Index Summer 2026 scores Anthropic at 34% and OpenAI at 33% on a framework that audits governance, robustness, and transparency; G42 scores 24%, Meta 21%, and DeepSeek, xAI, and Mistral each receive a failing grade (AI Safety Index Summer 2026, FLI). The numbers are imperfect — even the leaders top out in the 30s — but they exist; the Chinese labs' disclosures, with one exception per lab at best, largely do not.

On September 8, 2026, the NSA, FBI, and CISA published Cybersecurity Advisory AA26-251A accusing six China-based AI companies — DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI — of running industrial-scale distillation campaigns against U.S. frontier models since late 2024, extracting \"billions of tokens across millions of exchanges/requests\" from Claude, Gemini, GPT-4o/4-Mini/Nano/GPT-5, Grok 4, and others (CISA, AA26-251A, Sep 8, 2026; NSA press release, Sep 8, 2026). The mechanism named — routing through native APIs, remote cloud providers, third-party aggregators, and gray-market \"transfer stations\" — is exactly the kind of evidence a procurement officer, an export-control drafter, or an EU AI Act auditor can act on. A lab that distills Anthropic's Opus 4.5 and ships the result as its own model, without publishing how the system was tested, has now also failed the baseline safety check.

That dual failure — undisclosed distillation plus undisclosed safety evaluation — is the chain the SemiAnalysis dataset arms. Six of the nine labs in the disclosure study overlap with the CISA distillation named-list. Four of the nine (ByteDance, Tencent, Baidu, Zhipu) sit outside that six, but the dataset's central comparator — 3.6% disclosed — applies to all nine uniformly. The headline statistic is therefore not \"six labs are doing something wrong\"; it is \"nine labs collectively disclosed 3.6% of their models, full stop.\"

The statistic reframes three policy tracks already in motion. First, the EU AI Act's Article 55 obliges frontier-model providers to perform state-of-the-art model evaluations, assess and mitigate systemic risk, and report serious incidents — penalties can reach 3% of global revenue, and the named Chinese labs' EU subsidiaries (Alibaba Cloud, ByteDance) are the practical enforcement point (The Parliament Magazine, Jul 31, 2026; SSRN working paper, Frontier AI Safety Laws and Chinese AI Companies). Second, the U.S. Commerce Department's October 2025 framework is the foundation; the September 8 CISA advisory is the foundation's expansion. Third, Anthropic's S-1 tells the capital market that frontier AI risk is now a balance-sheet item — if Anthropic can be marked down 1–2% over \"existential risk\" language, a Chinese peer with 3.6% disclosure can be marked down by multiples of that.

Of the nine labs in the dataset, only three trade on liquid markets: Alibaba, Tencent, and Baidu. That matters because the policy response will be priced through their ADRs even when the actual models (Qwen, Hunyuan, ERNIE) ship from private or affiliated entities. The earnings trajectory of all three is increasingly hostage to AI capex that policy can suddenly render unrecoverable.

The valuation gap is widening: Baidu trades at 0.71x book and a trailing P/E that is negative on a TTM basis, while Alibaba trades at 1.62x book on a forward P/E of 17.9x and Tencent at 2.91x book on 14.1x TTM earnings. The SemiAnalysis disclosure metric lands as a new explanatory variable for that dispersion: of the three listed labs, Alibaba had 7 of 238 releases with any safety disclosure, Tencent had 1 of 133, and Baidu had 1 of 49. None of them publish a disclosure rate anywhere close to a U.S. frontier lab — and that is now the only fact a regulator, a procurement officer, or an underwriter needs (SemiAnalysis, Oct 8, 2026; company data from BABA, BIDU, TCEHY Q2 2026 disclosures).

The market reaction window opens immediately. Reuters reported the SemiAnalysis findings on October 9; the same week, Alibaba shares remain near the lower end of their 52-week range ($91.99–$180.84), Baidu is testing its $82.86 52-week low, and Tencent sits at $54.60, well below its $86 52-week high. Any of three near-term catalysts can move the stocks in the next 30–90 days.

The structural implication is straightforward: a 3.6% disclosure rate is not a transient compliance miss; it is the equilibrium of a voluntary framework applied to labs racing to ship frontier models every quarter. China's AI Safety Governance Framework 3.0 added misaligned-model-behavior language and named operational loss-of-control risk in May 2026 — but as application-layer rules, not model-layer gates. Without a CAICT-mandated safety-result disclosure at launch, the 94.9% non-disclosure rate is unlikely to fall below 80% over the next two years (Concordia AI, State of AI Safety in China 2026; Concordia AI bulletin).

For the listed names, that means two parallel pressures compound. Capital cost: Alibaba's free cash flow has flipped negative on AI capex (FY2026 free cash outflow RMB 46.6B per the May 13, 2026 release), Tencent is running capex at ~26% of revenue (RMB 52.78B vs. RMB 204.8B), and Baidu has a trailing free cash flow yield of −8.4%. Revenue ceiling: AI products now drive the marginal revenue dollar at all three, but the same AI products are also the surface the EU AI Act, the CISA distillation advisory, and any future U.S. procurement rule attach to. The 3.6% statistic gives those rules a numerator. The 857 releases give them a denominator. The next 1–3 years will be the period in which the ratio gets translated into revenue lost, multiples compressed, and chip-export licensed — with Alibaba, Tencent, and Baidu as the priced expression of that translation.