Beijing Institute of AI Safety and Governance (Beijing-AISI)

Theory of Change

Beijing-AISI's stated theory of change emerges from its director Yi Zeng's writings and speeches:

AI poses both near-term and long-term existential risks to humanity. "In the long-term, we haven't given superintelligence any practical reasons why they should protect humankind." Current AI "has no real ability to understand and is not truly intelligent" but "will make mistakes that humans would not make in ways that are difficult to anticipate."
Current alignment approaches are insufficient: "The current approach for making AI models ethical is to bind them with rule-based ethical principles and align such intelligent information processing systems with human values and behaviors. This is like building a castle in the air."
The solution requires brain-inspired moral AI -- giving AI genuine understanding, cognitive empathy, and moral intuition rather than enforcing rules from outside. This "Super Co-alignment" framework envisions humans and AI co-evolving their values together.
International cooperation is "the only way to ensure that AI remains globally safe, reliable, and controllable." No country can manage AI safety in isolation.
Beijing-AISI exists to provide a municipal-level safety and governance institution, analogous to UK/US AISIs, for Beijing.

The institutional theory of change is: create a formal AI safety body that can (a) conduct safety evaluations, (b) produce technical benchmarks and tools, (c) engage internationally with AISI counterparts, and (d) influence Chinese domestic policy toward taking frontier AI risks seriously.

What They Do

Technical outputs: 5 GitHub repositories -- PandaGuard (jailbreak attack/defense framework evaluating 49 LLMs), ForesightSafety-Bench (94-dimension safety benchmark covering catastrophic and existential risks, evaluating 20+ models), CogToM (theory of mind benchmark), plus Foresight ClawAudit (security tool for AI agent frameworks, March 2026). Several arXiv papers on brain-inspired moral AI and "Super Co-alignment."

International engagement: Yi Zeng has briefed the UN Security Council, contributed to the International AI Safety Report 2025, served on the UN High-Level Advisory Body on AI and UNESCO expert groups, co-signed the IDAIS-Beijing statement proposing 5 AI red lines, and signed both the CAIS extinction risk statement and the Pause Giant AI Experiments letter. Beijing-AISI hosted UK AISI for a bilateral meeting in October 2024.

Domestic positioning: Beijing-AISI is one of two municipal AI safety bodies (the other is Shanghai's, established July 2024). It is part of a network of Yi Zeng-led entities including the Center for Long-term AI, the Beijing Key Laboratory of Safe AI and Superalignment, and the Chinese AI Safety Network.

What it does not do (as far as publicly known): Conduct or publish safety evaluations of Chinese frontier AI models. Exercise any regulatory authority over AI developers.

Key People

Yi Zeng (Founding Dean/Director): Professor at CAS Institute of Automation. TIME100 AI 2023. Signed CAIS extinction risk statement and Pause letter. Briefed UN Security Council. Led drafting of Beijing AI Principles (2019). His career began when he saw Spielberg's A.I. as a student and resolved to "build a robot that can love the human species." He holds views on AI existential risk closely aligned with the Western x-risk community -- a rare position for a Chinese government-affiliated scientist. Recommended by Jaan Tallinn as having "good ideas about AGI and governance."

Wei Kai (Deputy Director): Director of CAICT AI Research Institute (under MIIT). CAICT is a major player in China's AI evaluation ecosystem and a CnAISDA member institution.

Team size: Unknown. Appears to leverage existing CAS researchers rather than having dedicated staff.

Money and Incentives

Funding: Entirely from Beijing municipal government via Chinese Academy of Sciences infrastructure. Zero Western philanthropic funding. Zero Coefficient Giving grants.

Budget: Unknown. No dedicated budget, staff, or separate funding appears to exist. For comparison, UK AISI operates on approximately $68M/year with 100+ FTE. CnAISDA (the national network) similarly has no dedicated resources.

Business model: Government research institute. No independent revenue, no product sales, no grants from international funders.

Incentive structure: Beijing-AISI operates within a system where the CCP's primary AI objective is economic growth and technological self-sufficiency. The mantra "failing to develop is the greatest threat to security" dominates Chinese AI policy. The CCP's support for AI safety bodies likely stems primarily from aspirations for global participation and diplomatic positioning rather than deeply held safety concerns. There is a fundamental tension between Yi Zeng's genuine concern about catastrophic AI risk and the CCP's primary interest in political content control and economic development.

Who pays for safety in China: The CAC (Cyberspace Administration of China) controls the binding AI standards. The March 2025 standards require testing AI models for threats to "core socialist values" and "national unity" -- political security is the top priority, not frontier AI risk. The same companies that signed voluntary safety commitments also had input into these political security standards. No Chinese frontier AI company has fulfilled its Seoul safety commitments.

What Others Say

China Media Project (strongest critic): "China's first priority is control for political ends." Testing chatbots on sensitive topics (Uyghur cultural preservation, Taiwan democratization) reveals CCP-aligned censorship built into every approved model. "Are we really on the same page as China when it comes to AI safety?" The answer, they argue, is no -- Chinese "AI safety" primarily means CCP information control.

Carnegie Endowment (most thorough analyst): "China is hoping it can have its cake and eat it too." Real evolution on catastrophic risks in Framework 2.0 (CBRN, loss of control), but "control over politically sensitive content has been the core driver of China's binding AI regulations." CnAISDA is "a pivotal moment" but "has yet to translate engagement into substantive AI safety-oriented domestic policies."

AI Frontiers (balanced assessment): CnAISDA "has so far taken little substantive action to address potentially global-scale risks. The truest test will be whether it can anchor a system-wide shift inside China toward not just speaking about frontier AI risks, but taking action to reduce them."

FLI AI Safety Index (Dec 2025): Chinese firms DeepSeek and Alibaba Cloud scored worst among all tested companies (D grades). No Chinese company had a publicly available safety framework.

Jack Clark (Anthropic co-founder): Argued "China cares about the same safety risks as us." China Media Project's response: "This belief deserves caution -- and context."

What's Absent

No published safety evaluation results from Beijing-AISI on any Chinese frontier model
No concrete budget, headcount, or staffing information
No Chinese-language website (English only) -- institution is outward-facing
No evidence of regulatory authority over any AI company
No explanation for Beijing-AISI's exclusion from CnAISDA membership
No evidence of formal relationships with Chinese frontier AI labs
No public criticism of CCP AI policy from Yi Zeng, despite his privately held x-risk views
No forum discussion in Western AI safety communities (zero LessWrong/EA Forum posts)
No non-Yi Zeng researcher publishing under Beijing-AISI affiliation