Overview

China has established itself as a global leader in AI development and implementation, with a regulatory approach that balances technological advancement with strict content controls, data security measures, and national security priorities. Unlike the EU’s horizontal approach with the AI Act, China has adopted a more vertical, sector-specific regulatory strategy, addressing different facets of AI through discrete laws and regulations.

Timeline

• January 10, 2023: Deep Synthesis Provisions (regulating deepfakes) came into force
• July 13, 2023: Draft Measures for the Management of Generative Artificial Intelligence Services released for public comment
• August 15, 2023: Interim Measures for the Management of Generative Artificial Intelligence Services became effective
• November 1, 2023: Mandatory filing of generative AI services with the Cyberspace Administration of China (CAC) began
• December 2023: Start of compliance audits for generative AI services
• February 29, 2024: Release of Basic Security Requirements for Generative Artificial Intelligence Services (TC260-003) by the National Information Security Standardization Technical Committee
• May 23, 2024: New draft regulations titled “Cybersecurity Technology – Basic Security Requirements for Generative Artificial Intelligence Service” released for public comment
• 2025: Mandatory data management audits scheduled to begin

Key Regulatory Components

Content Regulation

The Chinese approach places significant emphasis on content control for AI systems:

• Prohibition of AI-generated content that “endangers national security,” “undermines social stability,” or “subverts state power”
• Requirements for robust content moderation and filtering mechanisms in real-time
• Mandatory watermarking or other identifiable markers for AI-generated content
• Legal responsibility for providers of generative AI services for the content their systems produce
• Requirement for service providers to submit security assessments for their AI models

Data Security and Localization

China applies strict data governance requirements to AI systems:

• Stringent data localization mandates requiring data to be stored on servers within China’s borders
• Mandatory security assessments for cross-border data transfers
• Integration with China’s broader data regulatory framework (Personal Information Protection Law, Data Security Law, and Cybersecurity Law)
• Comprehensive data minimization requirements with detailed documentation
• Heightened cybersecurity responsibilities for operators of critical information infrastructure

Registration and Security Assessment

The regulatory framework includes official oversight mechanisms:

• Mandatory filing of generative AI services with the Cyberspace Administration of China
• Pre-release security assessments for generative AI models
• Potential license requirements for certain high-risk AI applications
• Regular compliance audits by regulatory authorities
• Starting in 2025, mandatory data management audits requiring organizations to maintain detailed records of all data transactions for at least 10 years

Algorithmic Governance

China’s approach also addresses the operation of AI systems:

• Requirements for explainability of AI decisions in certain applications
• Mandates for human oversight and intervention capabilities
• Obligations to disclose the use of AI in certain contexts
• Restrictions on algorithmic discrimination and unfair practices
• Rules preventing algorithmic manipulation of user choices and behavior

Compliance Requirements for Medium-Sized Enterprises

Filing with CAC Requirements in Detail

The filing requirement with the Cyberspace Administration of China (CAC) is a critical first step for AI compliance. According to the regulations:

1. Providers must submit filing materials to the CAC within 10 working days of offering generative AI services to the public
2. Required filing materials include:
   • Basic information about the service provider
   • Information about the service’s technical framework, data sources, and training methods
   • Self-assessment report on security risks and countermeasures
   • Commitment to adhere to ethics requirements and social responsibilities
3. Any significant updates to the service architecture or capabilities require a new filing
4. The CAC will conduct reviews of filings and may request additional information
5. Non-compliance can result in service suspension, fines, or other administrative penalties

Medium-sized enterprises should prepare these materials well in advance of service launch and maintain up-to-date documentation of all service features and capabilities.

Content Moderation Implementation Guide

Content moderation is one of the most resource-intensive requirements for AI systems in China. Effective implementation requires:

1. Establishing a multi-layered content review system combining:
   • Automated technical measures to filter prohibited content in real-time
   • Human review teams for content that automated systems flag or that users report
   • Special review processes for sensitive topics (politics, health, finance, etc.)
2. Developing comprehensive prohibited content catalogs based on:
   • National security considerations
   • Public order and morality standards
   • Intellectual property protection
   • Personal privacy protection
3. Implementing content filtering across multiple modalities:
   • Text-based content filtering using keyword and context analysis
   • Image recognition for detecting prohibited visual content
   • Audio transcription and analysis for voice-based AI services
4. Creating response protocols for detected violations:
   • Immediate content removal capabilities
   • User notification procedures
   • Record-keeping systems for compliance audits
5. Regular updates to filtering systems based on regulatory changes and emerging issues

Companies must document both their content moderation systems and their ongoing effectiveness, maintaining records of all content reviews and interventions.

Human Oversight Requirements in Detail

The human oversight requirement is particularly significant for AI systems in China. According to Article 19 of the Interim Measures, providers of generative AI services must:

1. Establish robust safety and security management systems including technical measures to ensure service safety
2. Implement human review measures for AI-generated content
3. Immediately intervene when discovering generated content that violates laws or regulations
4. Establish mechanisms for users to report problematic content
5. Maintain records of implementation and intervention for at least 3 months

This requirement applies to all forms of generative AI, including text, images, audio, and video content. The human oversight function must include both technical monitoring systems and actual human reviewers capable of evaluating and intervening when needed.

Security Assessment Framework

The security assessment requirement involves a comprehensive evaluation of AI systems before deployment and periodically thereafter. Key components include:

1. Algorithm Security Assessment:

   • Technical evaluation of the AI model’s mechanisms and limitations
   • Testing for known vulnerabilities in AI systems (prompt injection, hallucinations, etc.)
   • Evaluation of how algorithms process and respond to potentially harmful inputs
   • Documentation of model parameters and decision-making processes

2. Data Security Assessment:

   • Inventory of all data sources used for training and operation
   • Verification of data quality, accuracy, and authorization status
   • Documentation of data cleaning and preprocessing procedures
   • Evaluation of potential biases in training data

3. Operational Security Assessment:

   • Review of access controls and authentication mechanisms
   • Evaluation of system monitoring and logging capabilities
   • Assessment of disaster recovery and business continuity plans
   • Documentation of incident response procedures

4. Compliance Documentation:

   • Mapping of security measures to specific regulatory requirements
   • Evidence of regular testing and validation of security controls
   • Records of all security incidents and remediation actions
   • Certification of assessment by qualified security professionals

Security assessments must be updated whenever significant changes are made to the AI system or when new security threats emerge.

Data Localization Implementation Guidance

China’s data localization requirements for AI systems are particularly stringent. According to the cross-border data transfer framework, companies must:

1. Store all data collected and generated within China on servers physically located within China’s borders
2. Undergo security assessments for any cross-border data transfers
3. Implement technical measures to prevent unauthorized access or transfer of data outside approved channels
4. Maintain detailed records of all data storage locations and transfer activities
5. Designate specific personnel responsible for data localization compliance

Medium-sized enterprises should begin implementation by conducting a comprehensive data mapping exercise to identify all AI-related data and its current storage locations.

User Verification Implementation Details

The real-name verification requirement applies to generative AI services that are accessible to the public. Implementation requires:

1. Collection of user identity information:
   • For individual users: Name, ID number, phone number, and potentially biometric verification
   • For organizational users: Business license information, official contact details, and authorized representative information
2. Verification processes:
   • Cross-checking provided information against authorized databases
   • SMS or other second-factor authentication methods
   • Biometric verification for high-risk applications
3. Access controls based on verification status:
   • Restricting certain functionalities until verification is complete
   • Age-appropriate content filtering based on verified age
   • Limitation of usage scope for unverified or partially verified users
4. Data security measures:
   • Encryption of all identity information
   • Strict access controls for identity verification systems
   • Compliant retention and deletion policies for identity data
5. Ongoing verification:
   • Periodic re-verification of user information
   • Monitoring for suspicious account activities
   • Mechanisms to detect and prevent identity fraud

Medium-sized enterprises must balance compliant verification with user experience considerations, implementing verification processes that minimize friction while meeting regulatory requirements.

Content Watermarking Technical Guide

The watermarking requirement for AI-generated content involves both visible and invisible marking mechanisms:

1. Technical implementation options:
   • Digital watermarking embedded in the file metadata
   • Perceptual hashing techniques for content identification
   • Forensic watermarking resistant to editing or manipulation
   • Text-based indicators for AI-generated text content
2. Required watermark information:
   • Clear indication that content is AI-generated
   • Service provider identification
   • Generation timestamp
   • Unique content identifier for traceability
3. Implementation across content types:
   • Text: Special character patterns or metadata tags
   • Images: Invisible pixel-level watermarks or metadata
   • Audio: Spectral watermarking techniques
   • Video: Frame-embedded watermarks resistant to compression
4. Verification mechanisms:
   • Tools to detect the presence of watermarks
   • Methods to verify watermark authenticity
   • Processes to recover watermark information after content modification
5. Documentation requirements:
   • Technical specifications of watermarking methods
   • Testing results demonstrating watermark persistence
   • Procedures for watermark implementation and verification

The watermarking must be difficult to remove while not significantly degrading content quality or user experience.

Regular Auditing Procedures

The regular auditing requirement ensures ongoing compliance with AI regulations through systematic reviews:

1. Audit scope requirements:
   • Algorithm functionality and performance
   • Data usage and protection measures
   • Content moderation effectiveness
   • Security control implementation
   • Incident response capabilities
2. Audit frequency and triggers:
   • Quarterly internal reviews recommended
   • Mandatory reviews after significant system changes
   • Post-incident reviews following any compliance failures
   • Annual comprehensive audits of the entire AI system
3. Documentation requirements:
   • Detailed audit methodology and procedures
   • Complete records of audit findings and observations
   • Evidence of testing and verification activities
   • Management responses to audit recommendations
4. Reporting obligations:
   • Internal reporting to senior management and governance bodies
   • Required reporting to regulatory authorities for certain findings
   • Documentation retention for potential regulatory inspections
5. Remediation processes:
   • Clear timelines for addressing identified issues
   • Verification procedures for implemented fixes
   • Root cause analysis for systemic problems
   • Follow-up audits to confirm remediation effectiveness

Beginning in 2025, formal data management audits will become mandatory, with potential requirements for third-party auditors for certain high-risk AI applications.

Impact by Industry Vertical

Interaction with Other Regulatory Frameworks

China’s approach to AI regulation differs significantly from Western frameworks:

Comparison with EU AI Act

Comparison with US Approach

Comparison with UK Approach

Practical Implementation Example

A medium-sized enterprise in China developing an AI-powered customer service solution might utilize these resources by:

1. Testing their system in the Shanghai AI Regulatory Sandbox while still in development
2. Accessing government-approved training datasets for natural language processing
3. Utilizing the Security Assessment Platform to prepare for formal compliance review
4. Receiving guidance from the TC260 framework on implementation best practices
5. Applying for matching funds from a municipal AI development fund
6. Partnering with regional AI innovation centers for technical support

By leveraging these resources, medium-sized enterprises can navigate China’s complex AI regulatory landscape more effectively while continuing to innovate and grow.

Resources for Medium-Sized Enterprises in China’s AI Landscape

As China implements its comprehensive AI regulatory framework, the government and various organizations have established extensive resources to help medium-sized enterprises navigate compliance requirements and develop AI technologies. Below are key resources available as of early 2025:

Regulatory Sandboxes

China has established regulatory sandboxes in key technology hubs to allow companies to test AI applications in controlled environments without immediate regulatory penalties:

Shanghai AI Regulation Sandbox

• Description: Established under the Shanghai AI Regulation (effective October 1, 2022), this sandbox implements a graded management system allowing companies to test and explore AI technologies in designated spaces.
• Benefits: Provides a protected environment where minor infractions don’t immediately result in administrative penalties, enabling innovation while maintaining oversight.
• Contact: Shanghai Municipal Commission of Economy and Information Technology
• Eligibility: Companies registered in Shanghai with innovative AI applications seeking regulatory flexibility for testing.

Shenzhen AI Regulation Sandbox

• Description: Similar to Shanghai’s approach, the Shenzhen sandbox allows low-risk AI services and products to continue testing even without local norms if international standards are being complied with.
• Key Feature: Particularly valuable for medium-sized enterprises developing innovative applications, with a focus on risk-based management.
• Effective Date: November 1, 2022
• Contact: Shenzhen Municipal Government

Beijing AI Industry Zone

• Description: Offers specialized regulatory guidance and testing facilities for AI companies operating within designated zones, with streamlined compliance processes.
• Focus Areas: Natural language processing, computer vision, and autonomous systems.
• More Information: Beijing Municipal Bureau of Economy and Information Technology

Government Funding Programs

Several robust funding mechanisms are available to medium-sized enterprises developing compliant AI systems:

State-backed AI Investment Fund

• Amount: ¥60 billion ($8.2 billion)
• Purpose: A national AI investment fund established to accelerate AI innovations and drive breakthroughs.
• Co-financiers: Third Phase of the National Integrated Circuit Industry Investment Fund and Shanghai Guozhitou Equity Investment Management Co.
• Application Process: Competitive application process requiring detailed business plans and demonstration of technological innovation.
• Contact: Ministry of Industry and Information Technology

Shanghai Municipal AI Development Fund

• Amount: Multiple funding tiers available based on project scope and potential impact.
• Purpose: Provides grants and low-interest loans to medium-sized enterprises developing AI technologies that align with national strategic priorities.
• Focus Areas: Priority given to AI applications in manufacturing, healthcare, and smart city development.
• Application Deadlines: Quarterly application cycles with deadlines in March, June, September, and December.
• More Information: Shanghai Municipal Government Financial Support Programs

Zhejiang Province AI Computing Support

• Amount: Up to $300,000 per company through computing vouchers
• Purpose: To offset the rising costs of cloud computing and data processing for AI startups
• Eligibility: AI startups operating in Zhejiang Province
• Application Process: Companies need to apply through provincial government initiatives
• Website: Zhejiang Provincial Government

Provincial and Municipal AI Funding Initiatives

• Hangzhou’s AI Development Initiative: Focused on supporting AI startups in e-commerce and fintech sectors.
• Shenzhen’s AI Industry Support Program: Provides subsidies for R&D expenses and talent acquisition.
• Beijing’s AI Chip Subsidy Program: Offers financial support to companies investing in domestically produced AI chips.
• More Information: Regional AI Development Initiatives Guide

Datasets and Data Resources

China has recognized the importance of data access for AI development and has established several data initiatives:

Common Data Resource Databases

• Description: As outlined in the December 2023 three-year action plan on data factors, China is encouraging the development of common data resource databases by research institutions, leading enterprises, and technical service providers.
• Access Process: Application-based access with data usage agreements and security protocols.
• More Information: Asia Society Policy Institute Report

National Data Administration Resources

• Overview: The National Data Administration coordinates data-related policies, promotes the construction of data infrastructure, and enhances data governance across the country.
• Data Strategy: Comprehensive data strategy that positions data as a cornerstone for national development and technological innovation.
• Implementation: Includes guidelines for data standardization and ethical use across industries.
• Contact: While specific contact information is not available, resources can be accessed through official Chinese government websites.

High-Quality Training Datasets

• Description: Government-sponsored initiatives creating curated, high-quality datasets specifically for AI model training, with clear labeling guidelines and quality checks.
• Examples: China’s National Platform for Common Language Resources provides extensive language data resources for NLP applications.
• Access Requirements: Formal application process with data security assessment and usage agreements.
• More Information: National Information Security Standardization Technical Committee

Industry-Specific Data Resources

• Healthcare Data Platform: Anonymized medical imaging and clinical data for AI development in healthcare diagnostics.
• Manufacturing Data Resources: Sensor and operational data for industrial AI applications and predictive maintenance.
• Financial Services Data: Standardized financial transaction patterns for risk assessment and fraud detection systems.
• Smart City Data: Urban infrastructure and traffic flow information for AI-powered city management solutions.
• More Information: Industry-Specific AI Resources Overview

Humanoid Robot Data Sharing Initiative

• Overview: China’s National Local Joint Humanoid Robot Innovation Center has launched an initiative to promote data sharing among domestic humanoid companies.
• Purpose: To accelerate innovation in humanoid robotics by addressing the challenge of generating training data.
• Eligibility: Open to domestic humanoid companies.
• More Information: China’s Humanoid Robot Data Sharing Initiative

Compliance Testing Tools

Several tools have been developed to help companies ensure their AI systems meet regulatory requirements:

Security Assessment Platform

• Description: A standardized platform for conducting the mandatory security assessments required for AI models with potential for widespread impact.
• Key Functions: Evaluates algorithm security, data security, and operational security aspects of AI systems.
• Documentation Requirements: Detailed reports on assessment methodologies, findings, and remediation plans.
• Support Resources: Securiti.ai Guide to Security Assessment

Algorithm Filing Portal

• Description: Centralized system for providers to submit required algorithm details to the government, streamlining the compliance process.
• Required Information: Technical framework, data sources, training methods, and self-assessment reports.
• Filing Timeline: Submissions required within 10 working days of offering services to the public.
• Access Point: Cyberspace Administration of China

Content Moderation Tools

• Description: Government-approved tools for monitoring and moderating AI-generated content to ensure compliance with content regulations.
• Features: Real-time content filtering, prohibited content detection, and multi-modal analysis capabilities.
• Implementation Guide: Content Moderation Best Practices
• AI-Powered Solutions: Automated systems using natural language processing and image recognition for real-time content monitoring.

Draft Regulations for Generative AI Security

• Overview: The National Information Security Standardization Technical Committee (NISSTC) has issued draft regulations outlining security measures for generative AI service providers.
• Key Requirements: Specifies essential security measures to be implemented, including securing training data, safeguarding AI models, and conducting security assessments.
• More Information: China’s Draft Regulations on Generative AI

Guidance and Education Programs

Educational and guidance resources to help companies understand and implement regulatory requirements:

AI Ethics Councils

• Description: Bodies like the Shanghai AI Ethics Council provide guidance on ethical practices and considerations in AI development.
• Services: Ethical assessment frameworks, consultation services, and best practice recommendations.
• Contact Process: Inquiries can be directed through the Shanghai Municipal Government website.
• More Information: AI Ethics Guidelines Overview

TC260 Governance Framework

• Description: Released in September 2024 by the National Information Security Standardization Technical Committee (TC260), this AI Safety Governance Framework provides essential guidance for businesses developing and deploying AI systems.
• Key Components: Risk assessment methodologies, governance structures, and implementation strategies.
• Implementation Timeline: Phased approach with full compliance expected by early 2026.
• Overview Resources: OneTrust Blog on TC260 Framework

China Academy of Information and Communications Technology (CAICT)

• Description: The CAICT provides technical guidance, best practices, and implementation support.
• Resources: White papers on AI safety, ethics, and technical standards published regularly.
• Training Programs: Certification courses for AI compliance officers and technical specialists.
• Contact Information: CAICT Official Website

Regional AI Innovation Centers

• Beijing AI Innovation Center: Specializes in natural language processing and autonomous systems.
• Shanghai AI Technology Center: Focuses on computer vision and intelligent manufacturing applications.
• Shenzhen Intelligent Computing Center: Provides high-performance computing resources and technical consultation.
• Services Offered: Training programs, consultation services, and technical resources for medium-sized enterprises.
• More Information: China’s Regional AI Hubs Guide

Public-Private Partnerships

Collaborative initiatives between government entities and private sector organizations:

Compliance Certification Programs

• Description: Joint initiatives to develop certification standards and processes for AI systems that meet regulatory requirements.
• Certifying Bodies: Include the China National Certification and Accreditation Administration and industry associations.
• Certification Process: Involves documentation review, on-site assessment, and periodic re-evaluation.
• More Information: Certification Requirements Guide

Technology Transfer Platforms

• Description: Mechanisms to facilitate the transfer of compliant AI technologies from research institutions to medium-sized enterprises.
• Key Platforms: Include the China Technology Exchange and regional technology transfer centers.
• Application Process: Open to registered businesses with demonstrated technical capability and market potential.
• More Information: China Technology Exchange Portal

Industry Alliances

• Description: Sector-specific alliances that share best practices, common tools, and coordination on compliance approaches.
• Major Alliances: Include the China Artificial Intelligence Industry Alliance and the Smart City Industrial Alliance.
• Membership Benefits: Access to shared resources, regulatory updates, and collaborative problem-solving networks.
• Contact Information: China Technology Innovation Alliance

International Collaboration Resources

Despite China’s distinct regulatory approach, there are resources for companies operating internationally:

Cross-Border Data Transfer Mechanisms

• Description: Standardized procedures and protocols for companies that need to transfer data across borders while maintaining compliance.
• Key Mechanisms: Include CAC Security Assessment, Personal Information Protection Certification, and Chinese Standard Contractual Clauses.
• Exceptions: The Cyberspace Administration of China has published rules that relax requirements for certain types of data transfers.
• Guidance Resources: Orrick’s Guide to Cross-Border Data Transfers

International Standards Alignment Guidance

• Description: Resources to help companies understand how Chinese standards align with or differ from international frameworks.
• Comparison Tools: Documentation mapping Chinese requirements to EU AI Act, US standards, and ISO frameworks.
• Implementation Support: Guidance on building systems that can adapt to multiple regulatory environments.
• More Information: Reed Smith’s Regulatory Comparison Guide

Dual Compliance Frameworks

• Description: Templates and guidance for developing systems that can meet both Chinese and international regulatory requirements simultaneously.
• Framework Components: Include data governance models, content moderation approaches, and documentation standards.
• Implementation Tools: Compliance checklists, gap analysis templates, and regulatory tracking systems.
• Resource Center: China AI Regulatory Updates

AI Capacity Building Programs

• Description: China is conducting AI capacity building programs to enhance AI knowledge and expertise globally.
• Activities: Ten AI workshops and seminars planned by the end of 2025, primarily for developing countries.
• Format: Both online and offline training available.
• More Information: Ministry of Foreign Affairs of China

Practical Implementation Example

A medium-sized enterprise in China developing an AI-powered customer service solution might utilize these resources by:

1. Testing Phase: Begin by testing the system in the Shanghai AI Regulatory Sandbox while still in development, benefiting from regulatory flexibility during innovation.
2. Data Resources: Access government-approved training datasets for natural language processing through the Common Data Resource Databases initiative.
3. Security Compliance: Utilize the Security Assessment Platform to prepare for formal compliance review, following the TC260 Governance Framework guidelines.
4. Funding Support: Apply for matching funds from the Shanghai Municipal AI Development Fund to accelerate development and implementation.
5. Technical Assistance: Partner with the Shanghai AI Technology Center for specialized technical support and training on content moderation requirements.
6. International Expansion: Implement cross-border data transfer mechanisms and dual compliance frameworks if planning to offer services internationally.

By leveraging these resources, medium-sized enterprises can navigate China’s complex AI regulatory landscape more effectively while continuing to innovate and grow in this rapidly evolving field.