China Generative AI Regulations
Cyberspace Administration of China (CAC), Ministry of Industry and Information Technology (MIIT), National Data Administration
August 2023 - In Force
Status
In Force
Risk Level
High
Jurisdiction
China
Enforcement
August 2023 - In Force
high risk framework
Organizations providing generative AI services to users in China. Foreign organizations must comply if serving Chinese users.
Overview
China has the world's most active AI regulatory environment, with multiple overlapping rules: Interim Measures for Generative AI (Aug 2023), Algorithm Recommendation Regulations (Mar 2022), Deep Synthesis (Deepfake) Regulations (Jan 2023), and Cross-Border Data Transfer Rules. Enforced by CAC (Cyberspace Administration of China).
Scope
Organizations providing generative AI services, algorithmic recommendation systems, or deep synthesis services to users within China. Foreign organizations must comply if serving Chinese users - requires China-based legal entity.
Applicability
Who Is Affected
- Chinese AI companies providing AIGC services (Baidu, Alibaba, ByteDance, etc.)
- Foreign AI services accessible to Chinese users (effectively blocked unless compliant)
- Social media platforms with AI recommendation algorithms serving Chinese users
- Any entity using AI-generated content in China's information ecosystem
Who Is Exempt
- AI used for R&D, education, or industrial applications (partial exemption)
- AI not deployed publicly - internal enterprise tools with no public-facing component
Key Prohibitions
- AI content undermining national security, sovereignty, or territorial integrity
- AI content subverting state power or promoting terrorism/extremism
- AI-generated disinformation or content that disrupts social order
- Deepfake content without consent and clear labeling
- AI training on data that violates Chinese data protection or security laws
- Providing services to users without completing security assessment (CAC filing)
Key Requirements
- Security assessment before deploying generative AI services (CAC filing)
- Content moderation: AI content must align with socialist core values and not threaten national security
- Real-name user registration (real-name identity verification required for AI service access)
- Labeling requirements: AI-generated content (text, images, video, audio) must be clearly labeled
- Training data provenance documentation and regulatory inspection readiness
- Prohibition on AI content threatening national unity, social order, or public morality
- Data localization: personal data of Chinese users must remain in China
- User complaint mechanisms and government cooperation requirements
Guardrails & Operational Controls
- Security assessment: mandatory CAC filing and approval before public deployment
- Content filtering: real-time moderation for prohibited content categories (defined by CAC)
- User identity: KYC/real-name registration for all AI service users
- Data sovereignty: personal data must be stored in China; cross-border transfer requires approval
- Algorithm transparency: major algorithm recommendation systems must register with CAC
- Labeling: all AI-generated content must carry machine-readable and human-visible labels
Implementation Guidance
- 1Conduct security assessment and CAC filing before public launch
- 2Implement real-name user registration systems with identity verification
- 3Deploy content moderation for all prohibited content categories
- 4Establish data localization architecture for Chinese user data
- 5Set up user reporting and complaint mechanisms
Industry Impact
Technology / AI Labs
All Chinese AI companies must complete CAC security assessment. Directly shapes what AI can do.
Social Media & Platforms
Algorithm recommendation systems must register with CAC. Content moderation obligations are extensive.
Media & Entertainment
AI-generated media must be labeled. Deepfakes without consent are prohibited.
Foreign AI Companies
Effectively excluded unless operating through Chinese entity with local compliance infrastructure.
Healthcare
AI medical devices follow NMPA regulations, additional security requirements under MIIT.
Regulatory Timeline
Mar 2022
Algorithm Recommendation Regulations enter force
Jan 2023
Deep Synthesis (Deepfake) Regulations enter force
Aug 2023
Generative AI Interim Measures enter force
2024
AI labeling standards being finalized; cross-border data rules tightened
2025
Comprehensive AI law expected - consolidating existing regulations
Notable Enforcement Cases
- 1ByteDance (TikTok/Douyin) required extensive algorithm disclosure to CAC for content recommendation compliance
- 2ChatGPT blocked entirely in China - OpenAI has no China presence and did not complete CAC assessment
- 3Baidu Ernie Bot, Alibaba Tongyi Qianwen: completed security assessment and received approval to operate
Penalties for Non-Compliance
Service suspension (immediate enforcement tool); fines up to ¥1M per violation; criminal liability for serious violations including threats to national security
Framework Details
Short Name
China AI Rules
Jurisdiction
China
Enforcement Date
August 2023 - In Force
Enforcing Authority
Cyberspace Administration of China (CAC), Ministry of Industry and Information Technology (MIIT), National Data Administration
Status
Risk Level
Affected Organizations
Organizations providing generative AI services to users in China. Foreign organizations must comply if serving Chinese users.
Tags
This is educational guidance only. Always consult qualified legal counsel for compliance decisions affecting your organization.