China - Generative AI Services Management

Overview

The "Interim Measures for the Administration of Generative AI Services" ("Measures") were promulgated on July 10, 2023 by the Cyberspace Administration of China together with six other ministries and came into force on August 15, 2023. The Measures apply to services that use models and related technologies to generate text, images, audio, video and other content for the public within the territory of the People's Republic of China. They adopt a principles-based approach (development and security balanced) and impose specific operational obligations on providers relating to lawful training data usage, personal information protection, content governance, transparency and labeling, and risk mitigation. The Measures also require filing/registration for certain services and empower internet information authorities to conduct inspections and enforcement actions. The authoritative published text is available via the State Council Gazette and the national internet information office; see the full text and official announcements at State Council Gazette: Interim Measures and official CAC notices at Cyberspace Administration of China announcement.

Definitions

The Measures define "generative artificial intelligence services" as services that use algorithms, models and related technologies to provide the public with generated content such as text, images, audio and video. The Measures also clarify that the rules apply specifically to offerings to the public within PRC territory; R&D activities that do not provide public-facing services are outside the scope. Providers are defined broadly to include entities that develop, train, deploy or operate generative models and make generated content available to the public. The Measures reference other statutory definitions in the Cybersecurity Law, the Data Security Law and the Personal Information Protection Law for terms such as "personal information processor" and "internet information service".

Governance and Institutional Framework

The Measures establish a cross-ministerial governance model: the CAC leads administration, coordinated with the NDRC, MOE, MOST, MIIT, MPS and NRTA. This multi-agency approach aligns technical, security, content and broadcast supervision. Providers must establish internal governance systems including algorithm governance, scientific and ethical review mechanisms, content review and emergency response capabilities. Authorities maintain recording and filing systems for generative AI services and periodically publish lists of recorded models and services; local internet information offices handle filings for services with territorial "public opinion" attributes. The Measures also require cooperation with technical standard-setting and testing bodies — for example, national standards and technical guidelines issued by committees such as TC260 and related agencies — to operationalize obligations. For official promulgation and ongoing supervisory notices see the CAC portals and government gazette entries at Cyberspace Administration of China and Chinese Government (State Council).

Key Focus Areas

The Measures concentrate regulatory attention on several interlocking areas: (1) Data legality and provenance — models must be trained on lawful data that respect IP and privacy rights; (2) Personal information protection — providers are treated as personal information processors and must comply with PIPL; (3) Content safety and management — providers must prevent and remove content that endangers national security, undermines social stability, propagates terrorism, ethnic hatred, obscenity or misinformation; (4) Labeling — AI-generated and deep-synthesized content must be marked so users can identify synthetic material; (5) Risk mitigation — providers must take measures to avoid bias, discrimination, and harmful use, including in algorithm design and model training; (6) Transparency and user rights — providers must publish basic principles, service descriptions, and provide complaint and redress channels; (7) Registration and oversight — services with public opinion attributes must undergo security assessments and filing with CAC or local internet authorities; (8) Accountability — record-keeping, audit trails and designated responsible personnel are required to enable supervision and incident investigation. These focus areas are reinforced by follow-on technical standards and guidance documents issued by relevant national standardization and security bodies that help translate obligations into operational controls.

Implementation Framework

Implementation is a combination of provider obligations, technical standards and administrative oversight: providers must set up organizational structures (compliance officers, safety and ethics review panels), adopt data governance (data sourcing audits, IP clearance, consent management), perform security and risk assessments (particularly for services with social mobilization potential), and implement technical mitigations (watermarking, content filters, safety-aligned model tuning). The Measures call for filing/record-keeping with CAC for models made available as services; local filings are required for services with localized public-opinion impact. Government agencies (CAC and cooperating ministries) publish guidance and maintain registries; standards bodies publish technical specifications (e.g., content-marking methods, data-security practices) to support consistent compliance. Providers are expected to integrate compliance across the model lifecycle—pre-training, fine-tuning, deployment, and update management—and to maintain logs and complaint handling mechanisms to support inspections and audits.

Monitoring and Evaluation

The Measures authorize internet information authorities to inspect providers, demand rectification, and require reports on compliance measures. Authorities publish periodic registries of recorded generative AI services and may require providers to self-report incidents, security assessments or material changes (e.g., model updates that affect capabilities). Monitoring is both proactive (record/filing systems, technical testing, standards conformance) and reactive (complaint channels, takedown and incident reporting). Authorities coordinate cross-agency review where content, public security or broadcasting concerns intersect and may commission conformity assessment or certifications aligned to national technical standards to evaluate safety and reliability.

Penalties, Liability, and Appeals

The Measures tie enforcement to the broader PRC legal framework: violations may trigger administrative penalties under the Cybersecurity Law, Data Security Law, and PIPL, including fines, suspension of services, revocation of permits, public announcements of violations, and, where criminal conduct is involved, referral for criminal investigation. Providers are recognized as producers of online content and personal information processors for statutory liability purposes. The Measures foresee administrative orders for rectification, requirement to suspend provision of services, and other administrative sanctions. Appeals and administrative reconsideration follow applicable administrative procedure laws; affected entities can seek review through the administrative review and litigation channels prescribed by PRC law.

Relationship to Other Instruments

The Measures operate alongside and reference multiple existing instruments: the Cybersecurity Law, Data Security Law, Personal Information Protection Law, the "Deep Synthesis" rules for synthesized media, algorithm recommendation provisions, and sector-specific rules (e.g., publication or broadcasting regulations). They are supplemented by national standards, technical guidelines and subsequent ministerial measures addressing content labeling, pre-training data security, safety baseline requirements, and ethical review procedures — together forming a layered governance regime. Where sectoral laws (e.g., for news publishing or film production) contain special rules for content produced using generative AI, those sectoral rules take precedence as provided in the Measures.

International Alignment

China’s Measures emphasize development-security balance, national security and social stability, and align with international trends toward transparency, labeling and risk management for AI while reflecting China’s domestic legal priorities (data localization/controls, content management, and swift administrative oversight). The Measures have been discussed in multilateral AI governance fora and are complemented by standards and technical guidance intended to operationalize obligations. While sharing common themes with approaches in other jurisdictions (transparency, safety, data protection), the Measures are implemented within China’s administrative enforcement architecture and are coordinated across multiple ministries to address national-level public order, security and broadcasting concerns. Providers offering services internationally must consider extraterritorial compliance where services target or serve users within China.

Implementation Timeline

Date	Event
2023-05-23	Measures reviewed and approved at CAC meeting (12th meeting, 2023). Source: CAC meeting records.
2023-07-10	Measures promulgated jointly by CAC, NDRC, MOE, MOST, MIIT, MPS and NRTA. Source: State Council Gazette.
2023-08-15	Measures came into effect.
2023-08 to 2024	Follow-on technical standards, guidance and filing systems developed by standards bodies and CAC; filing of numerous generative AI services began.

Sources and References

Source	Type
State Council Gazette: "Interim Measures for the Administration of Generative AI Services" (Promulgation and full text)	Primary Source
Cyberspace Administration of China: Announcement and Q&A	Primary Source