China's Interim Measures for the Management of Generative Artificial Intelligence Services

Applies To

Overview

The Interim Measures for the Management of Generative Artificial Intelligence Services (生成式人工智能服务管理暂行办法) were jointly issued by seven Chinese government authorities and came into force on 15 August 2023. They represent China's first comprehensive regulatory framework specifically targeting generative AI. They follow earlier sector-specific measures on algorithmic recommendations (2022) and deep synthesis technology (2022), meaning AI that creates or alters images, audio, and video, such as deepfakes. Together these form a layered AI regulatory architecture. The Measures apply to organisations and individuals that provide generative AI services to the public within China, including text, image, audio, video, and code generation. Providers must ensure that training data is lawfully obtained and that generated content does not violate Chinese law or undermine socialist core values. They must also have effective mechanisms in place to prevent the generation of prohibited content categories. These include content that subverts state power, endangers national security, spreads disinformation, infringes intellectual property, or discriminates against individuals. Services with public opinion attributes or social mobilization capability must complete a security assessment and file their algorithms with the Cyberspace Administration of China (CAC). Providers must sign service agreements with registered users, and must not unlawfully keep input data or usage records that identify users. Labelling requirements apply to AI-generated content to enable identification. Providers must establish complaint and reporting mechanisms and cooperate with regulatory investigations. Organizations that develop or use generative AI without offering services to the public in China fall outside the Measures entirely. The CAC has signalled that the Interim Measures will be revised and potentially elevated to a permanent administrative regulation as experience accumulates.

Key Requirements

• •Services with public opinion attributes or social mobilisation capability must complete a security assessment (Article 17).
• •Those same services must file their algorithms through the CAC's algorithm filing system (Article 17).
• •Ensure all training data is lawfully obtained and does not infringe intellectual property rights; document data sourcing and processing methods.
• •Implement content moderation mechanisms to prevent generation of content prohibited under Chinese law, including content endangering national security, spreading disinformation, or violating personal privacy.
• •Sign service agreements with registered users that set out each side's rights and duties (Article 9).
• •Protect users' input data and usage records, and do not unlawfully keep records that identify users (Article 11).
• •Label AI-generated content in a manner that enables users and regulators to identify it as machine-generated.
• •Establish accessible user complaint and reporting channels; respond to user reports within required timeframes.
• •Provide users with clear service agreements disclosing the nature and limitations of the generative AI service.
• •Cooperate fully with CAC and co-issuing authority inspections, data requests, and investigations.
• •Protect the lawful rights of users, including data subject rights under the Personal Information Protection Law (PIPL).

What Your Organization Must Do

• →Map which of your generative AI services are offered to the public in China.
• →Assess whether any service has public opinion attributes or social mobilisation capability, triggering security assessment and algorithm filing.
• →Document how training data was lawfully obtained and screened for intellectual property problems.
• →Build content moderation that blocks categories prohibited under Chinese law, and label AI-generated outputs.
• →Review retention practices so you do not unlawfully keep input data or records identifying users.
• →Set up complaint and reporting channels, and prepare to cooperate with CAC inspections and investigations.

Playbook Guidance

Step-by-step implementation guidance for compliance teams.

Governance Controls

Operational controls that implement requirements from this regulation.

Frequently Asked Questions

Do foreign companies offering AI services accessible in China need to comply with the China Generative AI Regulations?

The Measures cover generative AI services provided to the public in China. For services from outside China that break the rules, the CAC can have other bodies take technical and other measures against them (Article 20).

What is the security assessment requirement before launching a generative AI service in China?

Only services with public opinion attributes or social mobilisation capability need a security assessment, under Article 17. The Measures set no review period, so plan timing with local advisers.

How long must providers retain logs of user inputs and AI-generated outputs under the China Generative AI Regulations?

The Measures set no log retention period. Article 11 points the other way: providers must protect users' inputs and usage records and must not unlawfully keep records that identify users.

What are the algorithm registration obligations under China's Generative AI Measures?

Only services with public opinion attributes or social mobilisation capability must file their algorithms, under Article 17. Keep a list of filed algorithms so new model versions trigger a check on refiling.

How do the China Generative AI Regulations relate to the earlier Algorithm Recommendation Regulations and Deep Synthesis Measures?

The Generative AI Measures build on and sit alongside the 2022 Algorithm Recommendation Regulations and the 2022 Deep Synthesis Measures, forming a layered regulatory architecture. Providers subject to the Generative AI Measures may also have overlapping obligations under the earlier instruments depending on the features of their service.

Are enterprise or closed-network generative AI deployments subject to the same compliance burden as public-facing services?

The Measures do not apply at all where organizations develop or use generative AI without offering services to the public in China. Any service offered to the public in China brings the full Measures into play.