Authored articles and expert commentary on cybersecurity operations, AI governance, supply-chain security, and compliance engineering, across the trade and general press.
Television, podcast, and on-camera analysis of the executive actions, rules, and evidence standards that decide how software reaches the market.
Conference sessions that carry the book's findings to the people who build and regulate AI systems.
How China turned AI governance into operating procedure, and what it offers European practitioners. Drawn from the same Chinese-language primary sources as the book: the intersection of regulation, security, and deployment.
Conference details →Practical patterns for moving compliance, auditability, and policy requirements upstream into product development and release workflows, so governance runs as operational infrastructure instead of a bottleneck. Part of a three-speaker panel on copyright, licensing, and enterprise AI governance risk.
Conference details →Long-form essays in trade publications on the same questions the book takes up: operating models, supply-chain risk, and the governance plumbing that sits underneath AI deployment.
"His clear writing style, well-organized timeline, and well-focused thesis make this briefing accessible to laypersons."★ Starred Review · BlueInk Review
"[Hogue-Spears] also makes a convincing case that Western misunderstandings about Chinese AI have led to flawed policies and decisions."Kirkus Reviews
"From Lab to Life: How AI Works in China takes a deep dive into history, cause and consequence, government and business interactions, and AI's evolutionary process as it impacts human vision and achievement."D. Donovan, Senior Reviewer · Midwest Book Review
"The analysis is assured, sophisticated, and savvy, as when explaining how Chinese super-apps consolidate several services that are offered independently in the United States and gather the data of daily life."4 out of 5 Stars · Foreword Clarion Reviews
"Washington's pause does not pause anyone else. State regulators, foreign governments and corporate boards will write the rules federal hesitation declines to write. The result is a more fragmented compliance perimeter, not a freer one."
"The agents ran the intrusion end to end and invented nothing new to run it with. Familiar identity and API failures opened every confirmed path into Taiwan's systems... No zero-day appears anywhere in the report, but a nuclear safety regulator does."
"The primary harvesting hubs sit inside sovereign adversarial territory, principally China, and no enforceable international legal mechanism exists to compel deletion."
"AI agents execute tasks. They don't produce the evidence trail that stands between your company and a regulatory enforcement action. The pattern repeats across every vertical: AI compresses commodity features and expands governance obligations."
"An embodied system is sold like software and behaves like a fleet of networked machinery on your floor... A spoofed sensor does not announce itself. It shows up as a machine acting incorrectly with confidence."
"Data residency means your data physically sits in Germany. Data localization means German law requires it to stay there. Data sovereignty means no foreign government can compel access to it, and that's where everything breaks down."
"Accountability is the difference. A closed model through an API is a service: a vendor holds the contract, the uptime commitment and the patch pipeline. An open-weight model reverses that. You do not buy it; you adopt it."
"Voluntary slowdowns by U.S. AI companies address future development, but they do not reach the open-weight models already deployed inside companies, including models developed in China... China will not sign a pause it does not enforce, and it has no reason to want one... A pause verified in one capital and ignored in the other does not slow the race. It moves the starting line."
"The origin protection that normally keeps the browser out does not hold on this path... DNS rebinding does the rest, carrying a web page into the unauthenticated model API. The technique is older than the AI stack it targets."
"Security leaders must treat a KEV listing for an unauthenticated, internet-facing firewall RCE as the ransomware warning itself... If we wait for the ransomware flag before we prioritize an edge-appliance CVE, we will read about our own intrusion in the catalog nine months after it started."
A mechanism-level operational manual for the world's second-largest AI ecosystem. August 4, 2026.
Built from primary Chinese-language regulatory texts, company filings, and technical documentation, drawing on the CAC algorithm filing registry, MIIT licensing publications, MPS cybersecurity grading standards, SAMR enforcement decisions, and corporate disclosures from Baidu, Alibaba, ByteDance, Tencent, and DeepSeek.
