China - Generative AI Services Management

Overview

The Interim Measures for the Administration of Generative Artificial Intelligence Services are binding rules jointly promulgated as Order No. 15. They were approved at the Cyberspace Administration of China’s twelfth office meeting of 2023 on 23 May 2023, with agreement from six other national authorities, and promulgated on 10 July 2023. Article 24 establishes entry into force on 15 August 2023. Their purposes are to promote healthy development and regulated application, safeguard national security and the public interest, and protect the lawful rights of citizens, legal persons, and other organizations. The official government publication of Order No. 15 contains five chapters and 24 articles.

Article 2 covers services using generative AI technology to generate text, images, audio, video, and other content for the public within China. Research, development, or application by enterprises, educational and research institutions, industry organizations, public cultural institutions, and relevant professional institutions falls outside the Measures where no generative AI service is offered to the domestic public. The exclusion depends on public service provision, not institutional identity alone. Separate state rules governing news publishing, film and television production, artistic creation, and other regulated activities continue to apply. Article 3 combines development and security with innovation, lawful governance, and inclusive, prudent, classified and graded supervision.

Definitions

Article 22 defines generative artificial intelligence technology as models and related technologies capable of generating text, images, audio, video, and other content. This capability-based definition does not depend on a particular model architecture, parameter count, or computational threshold. A generative AI service provider is an organization or individual using that technology to provide generative AI services, expressly including provision through programmable interfaces. Providers therefore include more than operators of consumer-facing websites and applications, while Article 2’s domestic public-service scope determines applicability.

A generative AI service user is an organization or individual using a generative AI service to generate content. Article 9 requires providers to conclude service agreements with registered users; it does not impose registration for every interaction. Article 17 identifies services possessing public-opinion attributes or social-mobilization capabilities as subject to security assessment and applicable algorithm filing procedures. These obligations operate under the state provisions incorporated by that article, rather than applying identically to every generative AI service.

Governance and Institutional Framework

The seven issuing authorities are the Cyberspace Administration of China, National Development and Reform Commission, Ministry of Education, Ministry of Science and Technology, Ministry of Industry and Information Technology, Ministry of Public Security, and National Radio and Television Administration. Article 16 assigns management responsibilities to cyberspace, development and reform, education, science and technology, industry and information technology, public security, radio and television, and news publishing departments according to their statutory functions. The institutional framework uses multiple existing authorities rather than establishing a new independent AI regulator or consolidating all functions in one department.

Relevant national authorities must improve scientific regulatory methods suited to generative AI’s technical characteristics and its applications in particular industries and fields. Article 16 requires corresponding classified and graded regulatory rules or guidance compatible with innovative development. Article 19 authorizes competent authorities to conduct inspections within their responsibilities and requires lawful provider cooperation. Under Article 20, the national cyberspace authority must notify relevant institutions to take technical and other necessary measures when overseas-origin services supplied within China fail to comply with applicable laws, administrative regulations, or the Measures.

Key Focus Areas

Article 4 governs both provision and use of generative AI services. Services must uphold socialist core values and must not generate legally prohibited content, including incitement to subvert state power or overthrow the socialist system, threats to national security and interests, harm to the national image, separatism, terrorism, extremism, ethnic hatred or discrimination, violence, obscene pornography, and false harmful information. Effective measures must prevent discrimination during algorithm design, training-data selection, model generation and optimization, and service delivery. Providers and users must respect intellectual property, commercial ethics, trade secrets, and lawful personal rights, and must not exploit algorithmic, data, or platform advantages for monopoly or unfair competition.

Article 7 requires lawfully sourced training data and foundational models, avoidance of intellectual property infringement, and consent or another legally permitted basis when personal information is involved. Providers must improve training-data truthfulness, accuracy, objectivity, and diversity. Article 4 requires measures appropriate to the service type to enhance transparency and generated-content accuracy and reliability. Articles 10–13 address disclosure of intended users and uses, prevention of minors’ excessive dependence or addiction, protection of user inputs and usage records, labeling under deep-synthesis rules, and safe, stable, continuous services supporting normal user access.

Implementation Framework

Article 7 applies to pre-training, optimization training, and other training-data processing. Where providers undertake data annotation during technology development, Article 8 requires clear, specific, operational annotation rules consistent with the Measures. Providers must assess annotation quality, verify accuracy through sampling, train annotation personnel as necessary, and supervise and guide standardized annotation work. Article 9 assigns providers the responsibilities of online information-content producers, network information security obligations, and, where personal information is involved, personal information processor responsibilities. Service agreements with registered users must clarify both parties’ rights and obligations.

Article 10 requires providers to publish intended user groups, contexts, and purposes, guide lawful use, and take effective measures against minors’ excessive dependence or addiction. Article 11 protects user inputs and usage records: providers must avoid unnecessary personal information collection, unlawful retention of identifiable inputs and records, and unlawful disclosure to others. They must lawfully and promptly handle requests to access, copy, correct, supplement, or delete personal information. Articles 12 and 13 require applicable content labeling and safe, stable, continuous service.

Article 14 requires providers discovering unlawful content to promptly stop its generation and transmission, remove it, undertake rectification through measures such as model optimization training, and report to competent authorities. Reporting is not restricted to serious cases. When providers discover users conducting unlawful activities through a service, they must take lawful and contractual measures such as warnings, feature restrictions, suspension, or termination, preserve relevant records, and report to competent authorities. Article 15 requires accessible complaint and reporting channels, published handling procedures and feedback time limits, timely processing, and communication of outcomes; it sets no uniform numerical response deadline.

Monitoring and Evaluation

Monitoring includes training-data quality improvement, annotation quality assessment and sampling under Article 8, and service-level measures to improve transparency, accuracy, and reliability under Article 4. Article 17 requires providers of services with public-opinion attributes or social-mobilization capabilities to conduct security assessments under relevant state provisions. Those providers must also complete algorithm filing, amendment, and cancellation procedures under the Internet Information Service Algorithm Recommendation Management Provisions. These requirements are linked to the specified service characteristics, rather than a universal recurring audit schedule or quantitative model benchmark.

Under Article 19, providers must explain training-data sources, scale, types, annotation rules, and algorithmic mechanisms when requested during lawful inspections, and provide necessary technical and data support and assistance. Institutions and personnel participating in security assessments or inspections must protect state secrets, trade secrets, personal privacy, and personal information learned in their duties, and must not disclose or unlawfully supply such information to others. Article 15’s public complaint channels and Article 18’s right to complain or report noncompliant services to competent authorities complement Article 14’s immediate remediation and reporting obligations.

Penalties, Liability, and Complaints

Article 21 directs competent authorities to punish provider violations under applicable laws and administrative regulations, including the Cybersecurity Law, Data Security Law, Personal Information Protection Law, and Scientific and Technological Progress Law. Where laws and administrative regulations do not provide a penalty, authorities may issue warnings, circulate criticism, and order correction within a specified period. Refusal to correct or serious circumstances can result in an order suspending the relevant service. Public-security administration violations attract the applicable public-security punishment, while criminal conduct gives rise to criminal responsibility. The Measures do not establish their own monetary fine schedule or fixed maximum fine.

Article 9 separately allocates online-content production, network information security, and personal information processing responsibilities to providers. Article 11 requires lawful, timely handling of individuals’ personal information requests. Articles 15 and 18 establish complaint and reporting mechanisms, rather than a dedicated appeal procedure against administrative sanctions or a separate compensation scheme. The serious-circumstances threshold relates to service suspension under Article 21; it does not limit Article 14’s duty to report discovered unlawful content.

Relationship to Other Instruments

Article 1 identifies the Cybersecurity Law, Data Security Law, Personal Information Protection Law, Scientific and Technological Progress Law, and other laws and administrative regulations as the legal basis for the Measures. Article 7 incorporates relevant obligations and regulatory requirements into training-data processing, while Article 21 relies on applicable legislation for sanctions. The Measures operate within a broader framework of intellectual property, personal information, network security, and sector-specific obligations rather than replacing those requirements.

Article 12 requires labeling of generated images, videos, and other relevant content under the Internet Information Service Deep Synthesis Management Provisions. Article 17 incorporates security assessments under relevant state provisions and algorithm filing procedures under the algorithm recommendation provisions. Article 2 preserves separate state rules for activities including news publishing, film and television production, and artistic creation. Article 23 requires administrative licenses where laws or administrative regulations make them necessary and subjects foreign investment in generative AI services to foreign-investment legislation; it does not impose blanket licensing on every service.

International Cooperation and Development

Article 6 encourages equal and mutually beneficial international exchanges and cooperation and participation in developing international rules relating to generative AI. It also encourages independent innovation in foundational technologies, including algorithms, frameworks, chips, and supporting software platforms. The article promotes infrastructure and public training-data resource platforms, coordinated sharing of computing resources, improved computing efficiency, orderly classified and graded opening of public data, and expanded high-quality public training resources. Adoption of safe and trustworthy chips, software, tools, computing power, and data resources is encouraged.

These development provisions promote cooperation without establishing mutual recognition, equivalence with another jurisdiction’s AI regime, recognition of foreign conformity assessments, or incorporation of a named international AI standard. Domestic compliance continues to govern overseas-origin services supplied within China: Article 20 requires notification to relevant institutions for technical and other necessary action against noncompliant services. Article 23 subjects foreign investment to applicable legislation. These provisions do not provide a general overseas-provider exemption or a separate cross-border personal-information transfer procedure.

Implementation Timeline

Sources and References