A company planning a chatbot for users in China asks which AI law applies. The answer: china AI regulation is a layered set of rules rather than a single statute, with several agencies sharing oversight.
For the wider context, see ai regulation explained. This page narrows to what the Chinese rules mean for companies, sorting common misreadings from what the evidence supports.
Misreading: China has a single AI law
China had not enacted a law directly targeting AI as of December 2025, according to the International Bar Association’s review of China’s AI regulation. The same review says the cybersecurity, data security and personal information laws provide legal support for AI regulation. That is where the Personal Information Protection Law (PIPL) enters the picture. The AI-specific duties sit in administrative rules: the Algorithm Recommendation Provisions, the Deep Synthesis Provisions and the Generative AI Interim Measures.
At their introduction in July 2023, the Interim Measures were the first legally binding instrument in the world specifically aimed at generative AI, according to an academic analysis in the Cambridge Forum on AI Law and Governance. A company should therefore not wait for a statute before starting compliance work, because binding rules already apply to particular kinds of service. A better habit is to list each product and note which instrument it touches.
| Common assumption | What the rules show | Planning use |
|---|---|---|
| There is one AI statute | No law directly targeting AI had been enacted as of December 2025; cybersecurity, data security and personal information laws supply the legal base | Map each product against several instruments, not a single act |
| Every AI system is covered | The Interim Measures apply to services that provide generated text, images, audio or video to the public within China’s territory; R&D and enterprise applications that do not directly serve the public are outside them | Decide scope product by product, based on who the service reaches |
| One agency controls enforcement | Cyberspace, development, education, public security and other departments can oversee generative AI services according to their respective responsibilities | Expect the relevant regulator to vary with the service and sector |
| Obligations are a short checklist | The Interim Measures set a multi-tiered system of obligations on providers of generative AI services | Treat compliance as a layered programme, not a one-off filing |
Scope, enforcement and obligation points in the table come from the International Bar Association review and the Cambridge Forum analysis.
The table works best as a triage tool. If your product falls in the second row, the scope question comes before everything else, and the next sections take the instruments in the order they appeared.
Timeline of the main rules
The instruments arrived in layers rather than as one package, and each addresses a different kind of AI service.
- 2021: the Administrative Provisions on Algorithm Recommendation for Internet Information Services, listed in the IBA review.
- 2023: the Administrative Provisions on Deep Synthesis of Internet-based Information Services, which cover text, speech, face, image generation and editing.
- July 2023: the Generative AI Interim Measures, issued by several ministries and departments under the State Council, as described in the Cambridge Forum article.
- 2025: the Measures for Labelling of AI-generated Synthetic Content, alongside the national standard GB 45438-2025, which sets a labelling method for AI-generated content.
A single product can touch more than one of these. A generative image service that edits faces, for example, may fall under both the Interim Measures and the Deep Synthesis Provisions, because the first covers generated images offered to the public and the second covers face and image generation and editing. Run the scope test for each instrument separately.
Misreading: every AI tool is covered
The Interim Measures define their reach by who receives the service. They apply to services that provide generated text, images, audio or video to the public within China’s territory. They do not cover research and development, or enterprise applications that do not directly provide services to the public, as the Cambridge Forum analysis explains.
In practice, a lab prototype or an internal tool sits outside this instrument, while the same model offered to public users in China moves inside it. That exclusion is stated for the Interim Measures. It should not be assumed to carry over to the Deep Synthesis Provisions or other rules, so check each instrument’s own scope before treating an internal deployment as exempt.
Misreading: one regulator decides everything
The Cyberspace Administration of China (CAC) is the regulator most readers associate with these rules, and a regulatory comparison describes the Interim Measures as a regulation issued by the CAC. The Cambridge Forum account adds that several ministries and departments under the State Council issued them in July 2023. The two descriptions fit together: the CAC is a central regulator, but it does not act alone.
The IBA review says cyberspace, development, education, public security and other departments can all oversee generative AI services according to their respective responsibilities. Which department you deal with depends on the service and its sector. Because education departments appear among the overseers, tools built for classrooms deserve a closer look; the use cases are covered in How AI Is Transforming Learning: 7 Key Benefits For Students And Educators In 2026 – Technopolicy.
What companies must do
Duties are easier to manage when grouped by task than by instrument, because one task, such as handling personal data, can be governed by more than one rule.
Data and consent
The Interim Measures require providers to obtain user consent for personal data used in training. This sits alongside the personal information law that the IBA review identifies as part of the legal base for AI regulation. Teams that train or fine-tune models for Chinese users should be able to show where training data came from and what consent supports it. That evidence trail is a joint job for engineering and legal teams, not something to reconstruct after a regulator asks.
Labels, identity and biometrics
The Deep Synthesis Provisions ask providers to add prominent content labels to AI-generated or altered media and to require real-name registration and identity verification for users. They also call for explicit consent before editing an individual’s biometric information. The Measures for Labelling of AI-generated Synthetic Content (2025) and the GB 45438-2025 standard add a defined labelling method for AI-generated content. Product teams should treat labelling and identity checks as built-in features designed with the interface, because retrofitting them across a live service is harder than planning them from the start.
A working order for a compliance team
- Scope first. Decide, per product, whether it serves the public in China, since that determines whether the Interim Measures apply at all.
- Consent next. Confirm that personal data in training sets has user consent behind it, and keep the record.
- Labels and verification. Where a product generates or alters media, plan prominent labels, user identity checks and biometric consent flows.
- Regulator mapping. Identify which of the overseeing departments is relevant to the service and its sector, rather than assuming the CAC is the only contact.
Selling into China from other markets
The territorial wording of the Interim Measures, services provided to the public within China, is the practical test for companies based elsewhere. A generative service that is offered to public users in China should be assessed against the rules, whatever the company’s home market. An internal tool used only by staff outside the public-facing perimeter raises a different question, as the scope section above explains.
Companies that operate in several jurisdictions will find the structure differs from the United States, where the approach is set out in How The U.S. Is Regulating AI In 2026: What Businesses And Citizens Need To Know – Technopolicy. China’s rules attach duties to specific service types and are overseen by several departments, so a single global policy document will rarely be enough. Keep a China-specific record of scope decisions, consent evidence and labelling design alongside the group-wide policy.
Frequently asked questions
| Question | Answer |
|---|---|
| What principles do the Interim Measures set? | The IBA review says they set five principles for generative AI, including socialist core values, anti-discrimination, intellectual property and transparency. |
| Does the anti-discrimination duty reach beyond the finished model? | Yes. The IBA review describes effective measures against discrimination across algorithm design, data selection, model generation and service provision. |
| Do commercial and non-commercial services face the same requirement? | No. The IBA review says a 2025 rule divides internet-based information services into commercial services, which need a licence, and non-commercial services, which need filing. |
| Which standard covers sensitive personal data in training? | According to the IBA review, GB/T 45654-2025 mandates source vetting and explicit separate consent for sensitive personal data used in training. |
