China AI Regulation Overview

Overview

China's regulatory framework for artificial intelligence represents a highly structured, state-led approach that balances technological development with national security, public order, and ethical compliance. Governed by top-level strategic directives such as the State Council's New Generation Artificial Intelligence Development Plan (2017), the national strategy has progressed through defined milestones aimed at building a world-leading AI innovation ecosystem by 2030. The legal foundation rests upon three major statutory acts enacted by the Standing Committee of the National People's Congress: the Cybersecurity Law (2016, amended 2025), the Data Security Law (2021), and the Personal Information Protection Law (2021).

Building upon these foundational statutes, Chinese administrative bodies have established a comprehensive set of scenario-specific binding regulations and technical guidelines. The regulatory regime directly targets specific AI functional mechanisms, including algorithmic recommendation engines, deep synthesis and deepfake technologies, generative AI services, synthetic content labeling and identification, anthropomorphic emotional interaction, and digital virtual humans. These regulations enforce mandatory filing procedures, real-name user authentication, pre-service security assessments, and continuous logging across the technology lifecycle.

In recent years, China's governance strategy has increasingly emphasized quality enhancement, system interoperability, and standardized technical metrics. National instruments such as the 2024 Regulations on Network Data Security Management, the 2025 AI Content Labeling and Identification Measures (alongside companion national standard GB 45438-2025), the 2026 Ethics-Safety Guidelines 1.0 (TC260), the 2026 AI Measurement Guidelines (SAMR/NDRC), and the GB/Z 185-2026 AI Agent Interconnection standard reflect a mature regulatory apparatus designed to tackle algorithmic black boxes, ensure multi-agent interoperability, and embed measurable, traceable safety controls into the real economy.

Regulatory Approach

China employs a combined horizontal and vertical regulatory architecture that blends binding statutory acts, targeted departmental administrative measures, and non-binding technical guidance standards. At the horizontal level, broad data and cybersecurity laws establish overarching duties for network data processing, cross-border data flows, personal data rights, and critical infrastructure protection. Vertically, targeted departmental regulations address discrete application scenarios and technological modalities, imposing granular compliance duties on service providers, technical supporters, and application distribution platforms.

The regime operates through a risk-based and prescriptive supervisory model. Services possessing 'public opinion attributes or social mobilization capabilities' are classified as higher risk and subjected to strict ex-ante oversight, including mandatory algorithm filings (algorithm 备案), pre-deployment security assessments, and explicit content filtering requirements. Lower-risk or internal R&D activities face fewer administrative filing demands, adhering to the national principle of balancing development and security through classified and graded oversight.

To support formal administrative rules, regulatory authorities rely heavily on soft law instruments, guidance documents, and guidance technical standards (GB/Z). Guidelines issued by technical standardization bodies—such as TC260's Ethics-Safety Guidelines for AI Applications 1.0 and SAMR/SAC's GB/Z 185-2026 Agent Interconnection series—provide reference technical blueprints, ethical principles, and testing methodologies. This approach enables regulators to maintain flexible oversight that adapts rapidly to emerging AI innovations like intelligent agents and synthetic media.

Key AI Legislation

• Cybersecurity Law of the PRC (2016, amended 2025): The foundational national statute setting network security graded protection, critical information infrastructure safeguards, real-identity verification, data localization, and explicit state support and risk monitoring for artificial intelligence technology.
• Data Security Law of the PRC (2021): Primary data governance act establishing a national classification and graded protection scheme for general data, important data, and core state data, alongside national security reviews and data processor risk reporting obligations.
• Personal Information Protection Law of the PRC (PIPL) (2021): Comprehensive personal data protection statute setting lawful processing bases, heightened protections and separate consent for sensitive data, individual rights, and strict cross-border transfer pathways.
• Provisions on the Administration of Algorithmic Recommendation in Internet Information Services (2021): Joint departmental regulation governing recommendation algorithms, prohibiting price discrimination and addictive designs, guaranteeing user opt-out rights, and instituting an algorithm filing registry for public-opinion services.
• Provisions on the Administration of Deep Synthesis of Internet-based Information Services (2022): Sectoral rule regulating generative and synthetic technologies, mandating clear output marking, real-name user verification, biometric editing consent, and security assessments.
• Interim Measures for the Administration of Generative AI Services (2023): Cross-sectoral administrative framework governing public-facing generative AI services, requiring lawful training data sourcing, content moderation, risk mitigation, labeling, and algorithm registration.
• Regulations on Network Data Security Management (2024): Administrative regulation under State Council Decree No. 790 harmonizing network data safety, important data catalogues, gatekeeper obligations for large network platforms, and cross-border transfer controls.
• Administrative Measures for the Labeling of AI-Generated Content / Measures for Identification (2025): Mandatory rules operating alongside national standard GB 45438-2025 requiring explicit human-perceptible labels and implicit machine-readable metadata in synthetic media outputs.
• Interim Measures for the Administration of Anthropomorphic AI Interaction Services (2025/2026): Interim regulation governing AI simulating human personality and emotion, mandating AI identification prompts, anti-addiction controls, minor and elderly protections, and safety assessments.
• Artificial Intelligence - Agent Interconnection (GB/Z 185-2026): National standardization technical document establishing a unified technical blueprint across seven parts for multi-agent identity, capability description, discovery, interaction, and tool invocation.
• Guidelines for AI Measurement System and Capability Building (2026 Edition): Joint SAMR/NDRC directive shifting focus from AI scale to quality, establishing traceable performance standards, proprietary measurement devices, and R&D centers to address algorithmic uncertainty and black-box models.
• Ethics-Safety Guidelines for Artificial Intelligence Applications 1.0 (2026): TC260 technical guideline articulating nine ethics-safety principles, operational risk controls, audit logging, continuous model reviews, and multidisciplinary safety boards.
• Administrative Measures for Digital Virtual Human Information Services (Draft 2026): Proposed regulation setting supervisory rules for digital virtual humans, mandating separate data consent, prominent "Digital Human" labeling, minor protection bans on virtual intimacy, and algorithm filing.

Governance & Enforcement Bodies

China's AI governance architecture operates through a centralized, multi-agency model led primarily by the Cyberspace Administration of China (CAC). As the primary coordinating and regulatory authority for internet content, data protection, and cybersecurity, the CAC leads rulemaking, manages algorithm filings, conducts security assessments, enforces cross-border data transfer controls, and coordinates joint supervisory actions across government ministries.

Complementing the central role of the CAC, sectoral ministries exercise specialized supervisory and enforcement functions within their statutory domains. The Ministry of Industry and Information Technology (MIIT) oversees industrial AI applications, telecommunications, software development, technical standards, and app store compliance. The Ministry of Public Security (MPS) executes public security oversight, investigates cybercrime and data breaches, and enforces criminal sanctions. The State Administration for Market Regulation (SAMR), alongside the Standardization Administration of China (SAC), regulates market fairness, consumer protection, national product quality, and standard publication.

Strategic policy development and scientific oversight involve additional state organs. The Ministry of Science and Technology (MOST) manages national AI planning, open innovation platforms, and ethical governance through expert bodies such as the National New Generation AI Governance Expert Committee. The National Development and Reform Commission (NDRC) guides macroeconomic strategy, industrial infrastructure, and measurement integration, while specialized technical bodies like TC260 and the China Electronics Standardization Institute (CESI) draft national technical standards and verification specifications.

Penalties & Enforcement

Enforcement mechanisms in China combine administrative sanctions, operational restrictions, corporate fines, and potential criminal liability. Statutory authority is anchored in primary legislation, where penalties are scaled based on the severity of the violation, harm to national security, or impact on public interest. Under the Cybersecurity Law (as amended in 2025), Data Security Law, and Personal Information Protection Law, regulators possess statutory powers to issue formal warnings, compel compliance rectifications, confiscate illegal gains, and impose significant financial penalties.

For severe violations of statutory provisions, financial penalties under the Personal Information Protection Law can reach up to RMB 50 million or 5% of a company's previous year turnover. The Data Security Law prescribes administrative fines up to RMB 2 million for important data processing violations and up to RMB 5 million for core state data breaches, accompanied by operational suspensions or business license revocations. Under sectoral departmental regulations (such as the Provisions on Algorithmic Recommendation or the draft Digital Virtual Human Measures), administrative fines generally range up to RMB 100,000 or RMB 200,000, alongside mandatory service suspension, algorithm filing revocation, app store removal, and referral for public security or criminal prosecution where acts constitute a crime.

Data Protection Framework

China's personal data protection and data security architecture is established by three main laws: the Personal Information Protection Law (PIPL), the Data Security Law (DSL), and the Cybersecurity Law (CSL), supplemented by the State Council's Regulations on Network Data Security Management. The PIPL acts as the comprehensive statute governing personal data handling, codifying principles of lawfulness, purpose limitation, necessity, transparency, and accuracy. It establishes robust individual rights—including access, correction, deletion, data portability, and restriction of automated decision-making—and requires separate, specific consent for processing sensitive personal information such as biometrics, medical data, financial records, and data of minors under 14.

Data governance is enforced through a strict classification and graded protection system that categorizes data into general network data, personal information, important data, and core state data. Processors handling important data or personal information of 10 million or more individuals face heightened duties, including appointing dedicated data security officers, establishing internal security bodies, and conducting annual risk assessments. Cross-border transfers of important data or large-scale personal data are restricted and require passing a mandatory CAC security assessment, securing accredited certification, or executing standardized cross-border contracts, alongside strict localized storage rules for Critical Information Infrastructure operators.

Sector-Specific Rules

In addition to cross-cutting data laws, China enforces detailed scenario-specific rules for specialized AI applications. In the generative AI and deep synthesis domains, regulations target services capable of synthesizing text, images, audio, video, or virtual scenes. Providers offering biometric editing (such as facial or voice modification) must obtain explicit prior consent from data subjects, establish feature libraries to detect illegal content, and apply mandatory explicit labels and machine-readable metadata headers under the AI Content Identification Measures and GB 45438-2025 technical standard.

Specialized protections govern anthropomorphic interaction services and digital virtual humans. Under the Interim Measures for Anthropomorphic AI Interaction Services and the draft Digital Virtual Human Measures, providers are forbidden from offering virtual intimacy services (such as romantic partners or virtual relatives) to minors, must enforce "minor mode" settings, and must implement anti-addiction mechanisms like pop-up reminders after two hours of continuous use. In industrial AI and multi-agent systems, the 2026 AI Measurement Guidelines target 14 priority sectors—including smart manufacturing, healthcare, and transportation—by mandating full-chain measurement metrics, while the GB/Z 185-2026 standard defines unified interoperability protocols for enterprise multi-agent deployment.

International Alignment

The provided corpus holds no record of formal adoption of or alignment with the European Union's EU AI Act or OECD AI principles specifically. China's AI regulatory architecture is formulated through domestic legislative channels, State Council strategic plans, departmental measures, and technical standards established by national standardization committees such as SAC, TC260, and TC28/SC42.

However, China's official policy instruments explicitly encourage engagement in international standardization and multilateral cooperation. Directives such as the Guidance on Building the National New Generation AI Standardization System (2020) call for active Chinese participation in international standards organizations, such as ISO/IEC technical committees, to foster technical interoperability. Similarly, the 2019 Governance Principles for the New Generation AI advocate international collaboration, shared technical norms, and cross-border exchanges, emphasizing mutual respect for national governance frameworks while seeking global consensus on safe, trustworthy, and responsible AI development.

Future Developments

China's AI regulatory landscape continues to evolve through ongoing legislative drafts, technical standard rollouts, and strategic national planning. A key pending regulatory instrument is the Administrative Measures for Digital Virtual Human Information Services (Exposure Draft), which concluded its public comment period in May 2026 and remains in proposed status awaiting formal promulgation and implementation by the CAC and partner ministries.

Furthermore, recently adopted guidelines establish multi-year implementation and review horizons. The implementation roadmap for TC260's Ethics-Safety Guidelines for AI Applications 1.0 extends through 2027, featuring initial industry policy integration in 2026, formal incorporation into national AI standards by January 2027, and a comprehensive effectiveness review in May 2027. Concurrently, the 2026 AI Measurement System Guidelines tie directly into China's 15th Five-Year Plan (2026–2030) to deploy national R&D application centers, build high-quality reference datasets, and continuously refine transparency and fairness metrics across emerging AI agent ecosystems.

Enforcement Bodies