Trump and Xi set up an AI hotline and no AI limits. Here’s what that means for CIOs

Xi Jinping left Washington on September 25 with an agreement to keep talking, a phone line and on generated text, images, audio and video. The White House fact sheet lists three AI items: the leaders agreed to call the technology “super intelligence,” established a dialogue with the next exchange due by November 2026, and agreed to set up a bilateral channel for incidents. Trump wrote that morning that he wanted to leave super intelligence exactly where it is and that the guardrail is the Department of Justice. Xi said at the arrival ceremony that AI must stay under human control. Neither position will reach a model training run, and neither leader asked the other to slow AI development. Beijing had no reason to want more: a pause would freeze it behind Anthropic’s Mythos, a model its officials see as a potential offensive cyber weapon, and the chip access it wanted stayed off the table.

Details are scarce, but the phone line is unlikely to be answered in real time. RAND found that the two militaries’ hotline, running since 2008, handles routine traffic but apparently sat unused when the PLA seized a U.S. underwater drone in 2016, because PLA officers cannot speak in a crisis until Party leaders approve their talking points. Beijing also declined a call from the defense secretary after the U.S. shot down a Chinese surveillance balloon in 2023. Built on the same bureaucracy, the AI channel will work as asynchronous notification.

Talk without limits was the result I said to expect on the AI:AM podcast before the visit, and it’s structural rather than diplomatic. Beijing’s binding AI rules trigger when a model becomes a public service, and once triggered, they reach back into the data and the model behind it. The government has run that machinery for four years, longer than any federal AI regime or comprehensive state AI law has existed. None of it gates training: a lab needs no permission to build a model, only to offer one to the public. Beneath the bargaining sits distrust: ChinaTalk’s Irene Zhang reports that state media and many Chinese AI researchers read American safety warnings as a coordinated effort to keep China behind, and hold up open, cheap models as the fair alternative.

For a CIO that split matters more than the summit did. Enterprises deploy services, and Beijing’s regime puts AI obligations primarily on the party operating the service rather than the party that trained the model. Set the political content review aside, and what remains is a record any regulator, customer or plaintiff could ask a U.S. company to produce: every AI service it runs, the model under it and who answers for it.

China’s rules start when the service does

Algorithmic recommendation services in China judged capable of shaping public opinion or mobilizing society have had to file with the Cyberspace Administration of China (CAC) since March 2022, within ten working days of launch and with a security self-assessment attached. Public generative AI services face a stricter track: a security assessment and a filing that in practice precede launch. As of August 31, the CAC counted 1,112 generative AI services with a completed national filing, plus 731 applications that call a filed model through an API and register with a provincial or municipal office. A launched application must disclose the filed model it uses. Since September 1, 2025, four agencies require labels, visible or embedded, on generated text, images, audio and video, and the amended Cybersecurity Law, in force since January 1, 2026, gave regulators a statutory mandate for AI risk monitoring, assessment and security supervision.

One service, several owners

A single deployed service can fall under several regulators at once. The CAC oversees content and algorithms; the Ministry of Industry and Information Technology oversees the cloud and computing stack beneath it; under the Multi-Level Protection System, the Ministry of Public Security inspects data security; and the State Administration for Market Regulation enforces the 2022 rules against algorithmic price discrimination.

Beneath all four sit two 2021 laws that never mention AI. The Personal Information Protection Law lets an individual demand an explanation of an automated decision that significantly affects their rights, and it reaches companies abroad that serve people in China or analyze their behavior. The Data Security Law classifies data by sensitivity. Read China’s AI regime as an org chart, not a rulebook. The same deployed service touches legal, security, infrastructure, data and product, and Beijing has named an owner for each vertical. The enterprise running it should be able to name, before launch, who answers to each regulator.

Enforcement runs locally. The CAC publishes the national lists; provincial and municipal offices issue the summonses. This year’s Qinglang campaign against AI misuse put failure to file or register a large model first among its seven targets, and by July 6 the CAC reported action against more than 14,000 AI products. Responsibility follows the service provider even when the model comes from a third party, a rule that reaches every CIO who buys AI rather than builds it.

The subsidiary already keeps the file

A foreign-owned company providing an in-scope service in China files on the same terms as a domestic one, and one word decides which services qualify: public. Article 2 of the 2023 Interim Measures exempts generative AI not offered to the public, so internal on-premises systems sit outside the track, and a subsidiary’s customer-facing assistant sits inside it. Tesla’s China in-car voice service completed a generative AI filing in Shanghai on April 20; Chinese press reports name ByteDance’s Doubao and DeepSeek among the models behind it. Tesla also offers xAI’s Grok in its U.S. vehicles, with no federal filing regime to match. One company, two jurisdictions and only one of them asks for the file.

Both governments can reach a hosted provider. A June Commerce Department directive took Anthropic’s two most capable models offline for every user for nearly three weeks, and Reuters reported in July that China’s Ministry of Commerce had spent a month consulting Alibaba, ByteDance and Z.ai on limiting overseas access to top models. Hosted access has a switch; self-hosted weights have none. Self-hosting does not by itself put an enterprise inside China’s filing track, because an internal system the public never uses stays outside it. What it does is remove the upstream party. The company that runs the weights holds the inventory, the assessment record and the answer for the output, whether or not a regulator ever asks for them.

Four questions a CIOs

None of this is a case for importing China’s content controls. Beneath the content layer sits recognizable compliance architecture: a service inventory, a pre-launch security assessment, output labeling and an accountable provider. A U.S. multinational’s Shanghai subsidiary maintains all four because a regulator asked. The parent must be able to answer four questions before anyone does:

1. Which AI services are in front of customers or employees today, and which model and version sit under each one?
2. What was assessed before each service went live, and where does that record live now?
3. Which outputs reach a person who cannot tell they came from a model?
4. Who signs for the output when the model came from someone else?

Beijing built the file because it wanted to read it. A CIO who cannot produce one has not avoided the question, only the regulator.