China - Generative AI Services Management

Key points

• •Applies to public-facing generative AI services within China.
• •Covers text, images, audio, video, and other generated content.
• •Balances AI development with security and public interest.
• •R&D activities not offered to the public are excluded.

What you need to do

1. 1.Determine if your AI service is public-facing and operates within China.
2. 2.Understand the broad definition of "generative AI services" to assess applicability.
3. 3.Ensure your internal R&D is clearly separated from public offerings if you wish to remain out of scope.

Key points

• •Multi-agency regulatory oversight led by CAC.
• •Providers must establish internal governance systems.
• •Required internal systems include algorithm governance, ethical review, content review, and emergency response.
• •Services may be subject to official recording and filing.

What you need to do

1. 1.Implement an internal AI governance framework, including a dedicated compliance team or officer.
2. 2.Develop and document policies for algorithm design, ethical considerations, and content moderation.
3. 3.Establish clear procedures for incident response and reporting.
4. 4.Monitor for technical standards and guidelines to ensure operational compliance.

Key points

• •Training data must be legally sourced.
• •Respect intellectual property rights (IPR).
• •Obtain necessary consents for data use.
• •Ensure data legitimacy, accuracy, objectivity, and diversity.
• •Prevent discrimination through data quality.

What you need to do

1. 1.Conduct thorough due diligence on all training datasets to verify legal provenance and IP clearance.
2. 2.Implement a robust consent management system for personal data used in training.
3. 3.Establish processes for handling IP infringement claims related to training data or generated content.
4. 4.Regularly audit training data for bias and representativeness.

Key points

• •Providers are considered "personal information processors."
• •Strict compliance with China's PIPL is mandatory.
• •Requires individual consent for personal information processing.
• •Implement data minimization and robust security measures.
• •Uphold individuals' rights over their personal information.

What you need to do

1. 1.Review and update privacy policies to reflect PIPL and generative AI service specifics.
2. 2.Implement PIPL-compliant consent mechanisms for data collection and processing.
3. 3.Establish secure data handling protocols and data breach response plans.
4. 4.Develop procedures for users to exercise their rights (e.g., data access, deletion).

Key points

• •Providers are responsible for generated content.
• •Must prevent and remove illegal/harmful content.
• •Prohibits content endangering national security, social stability, terrorism, hatred, obscenity, misinformation.
• •Requires content management aligned with socialist core values.

What you need to do

1. 1.Develop and implement robust content moderation systems, including pre-generation filtering and post-generation review.
2. 2.Establish clear content policies and guidelines for AI model training and deployment.
3. 3.Implement rapid response and takedown procedures for prohibited content.
4. 4.Continuously monitor and update models to minimize the generation of undesirable content.

Key points

• •Publish basic principles and service descriptions.
• •Clearly label all AI-generated content.
• •Deep-synthesized content must also be marked.
• •Aims to prevent user confusion or deception.

What you need to do

1. 1.Integrate technical solutions for watermarking or embedding metadata in AI-generated content.
2. 2.Ensure user interfaces clearly indicate when AI is used to generate or modify content.
3. 3.Update terms of service and user guides to explain labeling practices.
4. 4.Educate users on how to identify AI-generated content.

Key points

• •Proactively mitigate risks from generative AI.
• •Prevent algorithmic bias and discrimination.
• •Avoid other harmful uses of AI.
• •Integrate safety and ethics into algorithm design and model training.

What you need to do

1. 1.Conduct regular bias audits and fairness testing on models and datasets.
2. 2.Implement safety-aligned model tuning and red-teaming exercises.
3. 3.Develop and adhere to internal ethical guidelines for AI development.
4. 4.Establish mechanisms for identifying and addressing algorithmic harms post-deployment.

Key points

• •Mandatory security assessments for services with "public opinion attributes."
• •Required filing/registration with CAC or local internet authorities.
• •Authorities publish lists of recorded services.
• •Applies to services with "social mobilization capabilities."

What you need to do

1. 1.Evaluate if your service's nature or scale triggers "public opinion attributes" or "social mobilization capabilities."
2. 2.Prepare for and undergo required security assessments.
3. 3.Complete the necessary filing and registration procedures with the appropriate authorities.
4. 4.Monitor official announcements and lists of recorded services.

Key points

• •Maintain comprehensive records and audit trails.
• •Enable regulatory supervision and incident investigation.
• •Provide clear channels for user complaints.
• •Establish mechanisms for user redress.
• •Ensure accountability for service operation.

What you need to do

1. 1.Implement robust logging and data retention policies for model inputs, outputs, and user interactions.
2. 2.Develop a user-friendly complaint system and a clear process for handling grievances.
3. 3.Designate responsible personnel for managing accountability and user redress.
4. 4.Regularly review and update record-keeping and complaint handling procedures.

Key points

• •Authorities can inspect, demand rectification, and require reports.
• •Violations lead to administrative penalties under existing laws.
• •Penalties include fines, service suspension, and permit revocation.
• •Criminal conduct may result in criminal investigation.
• •Emphasizes coordination across multiple ministries for enforcement.

What you need to do

1. 1.Be prepared for potential inspections and audits by regulatory authorities.
2. 2.Establish internal processes for responding to official inquiries and rectification orders.
3. 3.Understand the potential legal and financial liabilities for non-compliance.
4. 4.Ensure robust internal compliance to avoid enforcement actions.