China AI Regulations: Comprehensive Compliance Guide

China has taken a sector-specific, rapid-iteration approach to AI regulation, enacting some of the world's most detailed and enforceable AI rules. Through a series of regulations covering algorithm recommendations (2022), deep synthesis/deepfakes (2023), and generative AI (2023), the Cyberspace Administration of China (CAC) has established a comprehensive regulatory framework that applies to all AI service providers operating within China.

What the Regulations Cover and Who Issues Them

China's AI regulatory framework is primarily administered by the Cyberspace Administration of China (CAC), a powerful government body responsible for internet content governance and cybersecurity. Other agencies involved include the Ministry of Industry and Information Technology (MIIT), the Ministry of Science and Technology (MOST), the National Development and Reform Commission (NDRC), and public security authorities. Regulations are issued jointly or individually by these agencies and are enforceable under China's Cybersecurity Law, Data Security Law, and Personal Information Protection Law as foundational legislation.

Unlike the EU AI Act's single comprehensive regulation, China has used a rolling series of targeted regulations, each addressing a specific AI application type. This approach enables fast regulatory response to emerging technology but creates compliance complexity for organizations operating multiple AI services in China. The CAC has signaled continued regulatory development, including work on foundation model regulations and AI safety standards under the National AI Standardization Body.

The Three Primary Regulations

Algorithm Recommendation Management Provisions (effective March 2022)

The Algorithm Recommendation Management Provisions regulate providers of algorithm-based recommendation services — systems that use AI to select and rank content, products, or services for individual users. This encompasses social media feeds, e-commerce product recommendations, content delivery systems, search ranking algorithms, and news aggregation. Requirements include:

• Filing algorithms with the CAC through the Internet Information Service Algorithm Filing System (mandatory for services with more than one million daily users or significant public opinion influence)
• Providing users with meaningful transparency about algorithmic recommendations and the right to opt out of personalized recommendations
• Prohibiting discriminatory pricing or service differentiation based on user characteristics such as transaction history, predicted purchasing behavior, or inferred socioeconomic status
• Protecting the rights of delivery workers and gig economy workers from algorithmic management practices that create unsafe working conditions
• Prohibiting algorithm-driven addiction-inducing practices, particularly targeting minors

Deep Synthesis Provisions (effective January 2023)

The Deep Synthesis Provisions address AI-generated synthetic media — deepfake videos, AI-generated voice cloning, face swapping, text-to-image generation, and similar technologies. Requirements include:

• Mandatory labeling of all AI-generated or AI-modified content, with visible watermarks or metadata identifying the content as synthetic
• User real-name verification for services enabling creation of synthetic media
• Prohibition on creating deepfake content that could disrupt social order, defame individuals, or spread disinformation
• Content moderation and review obligations for platforms hosting synthetic media
• Maintaining records of synthetic media creation sufficient to enable regulatory investigation

Interim Measures for Generative AI Services (effective August 2023)

These measures regulate providers of publicly available generative AI services in China — including large language model chatbots, image generators, code assistants, and similar services. This is currently the most compliance-intensive regulation for international technology companies. Requirements include:

• Lawful training data: Only data obtained through lawful means may be used for training AI services in China. This requires careful documentation of data sources, licensing, and data quality management
• Content safety aligned with core socialist values: Generated content must not undermine state authority, social stability, or socialist core values. This is enforced through content moderation systems and regular testing
• Security assessment: Services with significant public opinion influence must complete a security assessment filed with the CAC before public launch
• Filing before deployment: Generative AI services must be registered with the CAC's filing system before becoming publicly available in China
• User real-name registration: Users must register with verified identities
• Handling user data in compliance with China's Personal Information Protection Law (PIPL)
• Maintaining complaint and reporting mechanisms for users to flag harmful outputs

Who Needs Compliance

These regulations apply to any entity providing AI services to users in China, including both domestic Chinese companies and foreign companies with Chinese operations or users. The algorithm filing requirement affects any service using algorithmic decision-making with public-facing impact at scale. Generative AI regulations apply to any service making generative AI capabilities available to users in China, whether hosted domestically or accessed from abroad.

Foreign companies typically comply through Chinese subsidiaries or joint venture partners that hold the required licenses and are responsible for regulatory filings. Operating without a Chinese legal entity while providing services to Chinese users creates significant regulatory and enforcement risk.

The Security Assessment Process

Certain AI services require pre-deployment security assessments filed with the CAC. The assessment process covers:

• Review of the AI service's technical architecture and data flows
• Evaluation of content safety mechanisms and how the system is prevented from generating prohibited content
• Assessment of data security and personal information protection practices
• Evaluation of cybersecurity measures protecting the service infrastructure
• Review of emergency response plans for service incidents

Security assessments are conducted by the CAC and typically require substantial documentation. For services with limited public opinion influence, the filing process is simpler but still mandatory for generative AI services before public launch.

Costs and Timeline

Comparison with International Frameworks

China's AI regulations differ from Western frameworks in several important ways:

EU AI Act (30% overlap): Both frameworks address transparency, data governance, and certain prohibited applications. The EU Act focuses on fundamental rights and safety; China's framework emphasizes content safety, social stability, and state security. The EU Act has a more systematic risk-tier approach; China's framework is more service-category-specific. Companies with both EU and Chinese operations must manage genuinely distinct compliance programs with different underlying values and requirements. See the EU AI Act guide for comparison.

NIST AI RMF (25% overlap): The RMF's governance and risk management principles are broadly applicable but its voluntary, US-centric framing has limited direct relevance to Chinese regulatory compliance. The substantive overlap includes risk assessment practices, monitoring obligations, and transparency concepts, but the NIST framework does not address China's content safety or political compliance requirements. See the NIST AI RMF guide.

Singapore AI Governance (limited direct overlap): Singapore's voluntary, innovation-friendly model contrasts sharply with China's prescriptive, enforcement-intensive approach, but organizations operating across the Asia-Pacific region will encounter both frameworks and benefit from understanding their different orientations. See the Singapore AI Governance guide.

Practical Compliance Considerations

Organizations navigating China's AI regulatory landscape should keep several practical considerations in mind.

Regulatory velocity: China's AI regulations evolve rapidly. New regulations, guidance documents, and enforcement actions appear frequently. Maintaining a compliance monitoring function that tracks CAC and MIIT announcements is essential.

Enforcement approach: China's enforcement includes public naming of non-compliant services in CAC enforcement notices, service suspensions, fines, and in serious cases criminal prosecution. Enforcement has been active since 2022, with major platforms receiving compliance orders and fines.

Data localization: Many AI compliance obligations intersect with data localization requirements under the Cybersecurity Law and the Data Security Law. Training data obtained from Chinese users, model outputs processed in China, and security assessment materials may trigger data localization obligations.

Local legal counsel: Given the complexity and political sensitivity of China's AI regulatory landscape, organizations should engage Chinese legal counsel with specific AI regulatory expertise rather than relying solely on international compliance frameworks.

How Automation Helps

Managing China AI regulatory compliance requires tracking multiple regulatory instruments, maintaining filing records, monitoring content moderation performance, and staying current with regulatory updates. LowerPlane supports multi-framework AI governance programs across 50+ frameworks, with evidence management and monitoring features that support organizations managing China compliance alongside global AI governance programs. Starting at $4,000 per year with a free tier, it is rated 9.4/10 by AuditXYZ users. Compare options at best compliance automation platforms.

Frequently Asked Questions

Does China's generative AI regulation apply to services accessed from outside China by Chinese users? The Interim Measures' jurisdictional scope covers services "provided to the public within the territory of the People's Republic of China." Providing generative AI services accessible to users in China without going through the filing and security assessment process creates significant regulatory exposure, even for foreign-headquartered companies.

What happens if an AI service generates content that violates Chinese content requirements? The CAC may issue a compliance notice, require service suspension during remediation, impose fines, and publicly name the non-compliant service. Platforms hosting the content may also face liability. Repeated or serious violations can lead to permanent service suspension. Content safety systems must be comprehensive and regularly tested.

Is there a separate regulation for AI used in financial services in China? China's financial regulators (PBOC, CBIRC, CSRC) have issued their own AI governance guidance for financial services, separate from the CAC's AI regulations. Financial institutions deploying AI must comply with both the CAC's regulations and their sector-specific financial regulatory requirements. This creates a layered compliance obligation for fintech companies.

How does algorithm filing work in practice? Algorithm filing is completed through the CAC's Internet Information Service Algorithm Filing System (beian.cac.gov.cn). The filing requires information about the algorithm's purpose, technical characteristics, training data sources, and how content safety and user rights obligations are satisfied. Filed algorithms are assigned a filing number that must be disclosed publicly. Major updates to filed algorithms typically trigger a re-filing requirement.

Are there equivalents to China's regulations in other Asian jurisdictions? Several Asian jurisdictions are developing similar regulations. Singapore has voluntary AI governance frameworks. South Korea has sector-specific AI requirements and is developing broader regulation. Japan has issued AI governance guidance under its Cabinet AI Strategy Council. China's regulatory model is the most prescriptive in the region, but the trajectory across Asia-Pacific is toward more formal AI governance requirements.