In mainland China, a generative AI service aimed at the public cannot simply be switched on. Two separate administrative steps sit between a working product and a lawful public launch, and they are governed by two different instruments that are routinely conflated.
The instrument and its date
The Interim Measures for the Management of Generative AI Services (生成式人工智能服务管理暂行办法) were issued on 13 July 2023 by the Cyberspace Administration of China together with six other central departments, and took effect on 15 August 2023. The official text is published by the CAC: the Interim Measures as promulgated. The word “interim” (暂行) in the title is doing real work: this is expressly a provisional instrument, and the surrounding rules have already changed around it, notably with the 2025 content-labelling measures.
This page describes the published text of the Measures. It is not legal advice, and Chinese regulatory practice is substantially shaped by how the CAC and its provincial offices apply the text in a given review cycle, which no summary can convey. Take Chinese advice on your own service before relying on any of it.
Who is caught, and who is not
Article 2 sets the scope: the Measures apply to the use of generative AI technology to provide services generating text, pictures, audio, video and similar content to the public within mainland China. Two exclusions follow directly from that wording and both matter commercially.
- Research and internal development. Where an organisation develops or applies generative AI without offering the service to the domestic public, Article 2 states the Measures do not apply. An internal tool is not a public service.
- Services not offered to the domestic public. The trigger is provision to the public in mainland China, not the location of the developer. A service that does not target or serve mainland users is outside the Measures, though it is not thereby outside every other Chinese rule.
The filing duty itself is narrower than the Measures as a whole. Article 17 requires a security assessment and algorithm filing only from providers of generative AI services with public opinion attributes or social mobilisation capability (舆论属性或者社会动员能力). That phrase is a term of art carried over from earlier Chinese internet regulation and it is broad in practice: a service that lets members of the public generate and see content, or that can be used to organise, is generally treated as within it. A narrow business-to-business tool with no public-facing content surface may not be, but that determination is a judgement call and not a self-evident one.
The launch sequence
The order is not optional, and the commonest planning error is budgeting for one step where there are two with a dependency between them.
- Determine whether the service has public opinion attributes or social mobilisation capability. If it does not, Article 17 does not bite, and the remaining obligations of the Measures still do.
- Complete the security assessment required under the 2018 Provisions on the Security Assessment of Internet Information Services with Public Opinion Attributes or Social Mobilisation Capability. This is a self-assessment prepared to a prescribed structure and submitted to the competent cyberspace and public security authorities, covering lawfulness of the service, content controls, personal information handling, technical measures and emergency response.
- Complete the algorithm filing under the algorithmic recommendation provisions, through the CAC’s filing system. This is the step described in the algorithm registration requirement, which exists independently of generative AI.
- Launch publicly, and keep the filing current. Material changes to the algorithm, and cessation of the service, both trigger further filing obligations within short deadlines.
Article 17 is a precondition, not a formality to be completed in parallel with a soft launch. The practical effect visible from outside China is that the CAC periodically publishes lists of generative AI services that have completed filing, and a domestic consumer launch by a name absent from those lists is unusual.
What the filing actually asks for
The filing is a description of the algorithm and the accountability around it rather than a technical audit. It asks who the provider is, what form the service takes, what domain it applies to, what type of algorithm it is, and—the substantive part—an algorithm self-assessment report, plus the material to be publicised.
The obligations the assessment has to demonstrate compliance with are elsewhere in the Measures, and these are the ones with ongoing engineering consequences:
- Content requirements (Article 4). Generated content must adhere to core socialist values and must not contain content prohibited by law; the Measures also address discrimination, respect for intellectual property and commercial ethics, and measures to improve accuracy and reliability of generated content.
- Training data (Article 7). Providers must use data and foundation models from lawful sources, must not infringe intellectual property, must obtain consent where personal information is involved, and must take measures to improve the quality, authenticity, accuracy, objectivity and diversity of training data.
- Provider responsibility (Article 9). The provider bears responsibility as the producer of network information content, and as the personal information handler where personal information is processed. There is no intermediary shelter here: the output is treated as the provider’s content.
- Labelling (Article 12). Generated content must be labelled in accordance with the deep synthesis provisions—see what those labelling duties require.
- Complaints and correction (Articles 14–15). Providers must handle user complaints, stop generation and stop transmission of unlawful content when discovered, take remedial measures such as model optimisation training, and report to the authorities.
Where foreign providers go wrong
The first mistake is assuming the algorithm filing satisfies Article 17 on its own. It does not; the security assessment is a separate step under a separate instrument with a separate submission, and completing the filing while skipping the assessment leaves the launch precondition unmet.
The second is assuming the Measures are the whole of the applicable law. They sit on top of the Cybersecurity Law, the Data Security Law and the Personal Information Protection Law, and a generative AI service handling Chinese personal information faces PIPL obligations including the cross-border transfer regime, which is frequently the harder problem.
The third is architectural. A service that reaches mainland users through an endpoint outside China is not automatically outside the Measures, and a service that has been filed is filed for the algorithm described in the filing—swapping the underlying model for a different one is the kind of change the filing regime expects to be told about.
If one product serves several regions from one codebase, the filing question is really a routing question: which upstream endpoint does a given user’s request actually reach, and is that endpoint the one covered by whatever registration exists. A gateway that lets you pin routes per region and keeps a per-request record of which upstream served it makes that answerable from logs rather than from architecture diagrams; Multigrid records the resolved upstream on every request for exactly this class of question.
Top comments (0)