Key takeaways
- China’s AI regulatory regime is rapidly evolving
- Comprehensive AI regulations have been adopted for AI products and services
- Compliance actions are crucial for risk management
Authors: Barbara Li Sarah Xiong Amaya Zhou
Today, innovations in AI are reshaping the future of every industry. AI has already become the main driver of emerging technologies, and generative AI like ChatGPT has further expanded the popularity of AI. As AI continues to transform industries, legislation and law enforcement to regulate AI have become increasingly important.
Apart from the global development of AI laws (e.g ground-breaking EU AI Act effective as of 1 August 2024), the regulatory landscape governing AI is also rapidly developing in China. This alert will try to analyse recent developments in the AI industry and their implications for business organisations.
Regulatory regime in China
China is leading the way in rolling out regulations on AI. Significant legal developments over the last few years are spreading across various policies and regulations, including the Interim Measures for Administration of Generative AI Services (Generative AI Measures), the Administrative Provisions on Deep Synthesis of Internet-based Information Services (Deep Synthesis Provisions), the Trial Measures for Ethical Review of Science and Technology Activities (Ethical Review Measures) and the Administrative Provisions on Algorithm Recommendation for Internet Information Services (Algorithm Recommendation Provisions).
Generative AI Measures
On 10 July 2023, China issued the final version of the Generative AI Measures, becoming one of the first countries in the world to regulate generative AI technology. The Generative AI Measures were jointly adopted by seven Chinese central governmental agencies and took effect on 15 August 2023. Compared to the first draft of the Generative AI Measures released for public consultation in April 2023, the Generative AI Measures sent a very positive signal by encouraging the development of and investment in generative AI technology and services.
The Generative AI Measures apply to generative AI services offered to the public in China, regardless of whether the generative AI service provider is based within or outside of China. To that extent, the Generative AI Measures have extraterritorial effect. International AI companies are strongly advised to keep a close watch on legal developments in relation to generative AI in order to implement effective strategies for their business activities in China.
Among others, the Generative AI Measures aim to strike a balance between the innovation and development of generative AI technologies and their security. Regulators will adopt an inclusive and prudent approach to supervising the application of generative AI technologies. China will support independent innovation in key generative AI technologies, including algorithms, frameworks, chips and software platforms, engage in international cooperation and exchange on an equal and mutually beneficial basis, and contribute to the formulation of international rules relating to generative AI.
The Generative AI Measures also lay down a range of legal requirements for providing generative AI services, with a focus on the privacy of pre-training and optimised data, content screening and other related areas.
As set by the Generative AI Measures, international investors have the opportunity to establish foreign-invested enterprises to develop and offer generative AI services in China, provided they adhere to the applicable laws and regulations on foreign investment. However, before doing so, the investors must clearly understand and properly address the applicable regulatory requirements.
Transparency requirements in the provision and use of generative AI services are highlighted in the Generative AI Measures. Regulators are tasked with formulating the guidelines and rules for classifying the different levels of supervision. This is in line with international practice in the EU and the U.S.
Deep Synthesis Provisions
The Deep Synthesis Provisions, which were issued on 25 November 2022 and came into force in 10 January 2023, are designed to implement the Outline for the Construction of a Rule of Law-governed Society (2020-2025) formulated by the Chinese central government. The goal is to improve the standardised management of new technologies such as algorithmic recommendations and deep fakes, define the "bottom line" and "red line" for deep synthesis services, and maintain a healthy cyberspace ecosystem.
The use of algorithms to synthetically generate or alter content online, including video, voices, text and images, is highlighted by the Deep Synthesis Provisions. Deep synthesis service providers must refrain from using deep synthesis services to produce or disseminate illegal information. They are also required to establish and improve management systems for user registration, algorithm mechanism review, technology ethics review, information release review, data security, personal information protection, anti-telecom fraud, emergency response, etc.
Among others, deep synthesis service providers must ensure that appropriate labels are added to content generated by deep synthesis technology. Notably, in August 2023, China released guidance on labelling for generative AI services. A “Generated by AI” label must now be added to screens displaying AI generated content. The form, location and pixel specifications of the label must conform to the relevant requirements.
Ethical Review Measures
The Ethics Review Measures were jointly released by China's Ministry of Science and Technology and other government departments on 8 October 2023, effective from 1 December 2023. The Ethics Review Measures aim to address the social and ethical challenges arising from the development of science and technology, boost innovation, and improve the regulatory frameworks and legal landscape for ethical review.
The measures set out detailed requirements for the procedures and standards of ethics reviews in the areas of science and technology. Activities that are subject to these reviews include scientific and technological activities (e.g., AI development) which involve humans or experimental animals, or may otherwise pose ethical challenges related to life and health, the environment, public order and sustainable development.
Companies engaging in scientific and technological activities like AI development must establish a review committee if the research subjects are deemed "ethically sensitive”. In addition to obtaining approval from the internal review committee, seven types of research activities are subject to verification by external experts, including the development of algorithm models, applications and systems which could influence public opinion and shape social consciousness.
As public awareness of ethical risks grows, ethical reviews will play a key role in regulating and mitigating the risks arising from the misuse of scientific achievements.
Algorithm Recommendation Provisions
Among other measures, algorithm filing has been implemented to regulate AI technology in China. The most recent announcement on algorithm filings was released by the Cyber Administration of China (CAC) on 12 June 2024.
Scope of algorithm filing
The regime governing algorithm filings in China dates back to 2020 with policies issued by the central government. The Algorithm Recommendation Provisions came into force on 1 March 2022, becoming the primary regulations governing algorithm filing. According to the Algorithm Recommendation Provisions, an algorithm recommendation service provider that is capable of influencing public opinion or driving social engagement must file the algorithm with the CAC within 10 working days after the provision of services.
According to the regulations, algorithms with public opinion or social engagement capabilities are those used in information services, such as BBS, blogs, microblogs, chat rooms, communication groups, public accounts, short videos, online streaming, information sharing and mini programs, or in other online information services that facilitate public engagement or enable users to express their opinions.
In light of the above, algorithms providing information content or platforms to the public must be filed with the CAC. However, the definition is not entirely clear, leaving room for ambiguities that may need to be addressed in practice. For example, determining whether an algorithm is capable of influencing the public opinion or driving social engagement can be contentious.
In addition, the Deep Synthesis Provisions provide that both the service provider and technical supporter of deep synthesis technology must file the algorithm with the CAC separately. In other words, the algorithm filing by the deep synthesis service provider is distinct from that by the technical supporter. Therefore, even if the deep synthesis service provider has filed the algorithm, the technology supporter is still required to make their own algorithm filing.
Process of algorithm filing
The algorithm filing requires a wide range of documents and other information, including:
- Basic information about the filing entity, such as business licence, legal representative, person in charge of the algorithm, and a letter of undertaking.
- Algorithm security-related documents, such as the algorithm self-assessment report, algorithm security monitoring policy and emergency response plan.
- Algorithm-related data, such as the model, a brief description, its primary functions and the classification of the algorithm.
The information will be submitted to the CAC for review, which should be completed within 30 working days provided that there are no issues. Once a filing number is granted, it must be displayed on the relevant company’s website. The CAC periodically publishes a list of filed algorithms, but the announcement includes only limited details, including the name of the algorithm, its intended area of use and primary function, the filing number and the filing entity.
Companies should consider several factors. For example, they should avoid disclosing commercial secrets during the filing process. In addition, the algorithm security-related documents should be prepared in advance to avoid any delay in the filing process. Furthermore, it could be challenging for companies to determine if an algorithm requires filing in practice.
According to information published by the CAC, as of 30 June 2024, over 1,400 AI algorithms developed by more than 450 companies have been successfully filed. This large number of filings highlights the rapid development of AI technologies in China.
Law enforcement
Violations of the algorithm filing requirements can result in fines of up to RMB 100,000. Criminal liability may be pursued if applicable. Although the monetary penalties may not be significant, non-compliance could result in reputational damage and disrupt business operations.
Algorithm filings are not a one-off task. If amendments are made to the algorithm filing information, the filing entity must update the filing within 10 working days. In addition, if the algorithm servicer provider ceases algorithm-related services, it must cancel the algorithm filing within 20 working days.
In first and second quarters of 2024, some companies have been caught by Chinese regulators for failing to monitor AI-generated content or neglecting the filing requirements for AI algorithms. Non-compliance has resulted in the suspension of their apps pending rectification.
Compliance suggestions
The enforcement is as important as the law enactment. Globally, further to the AI Act’s entry into force in August in the EU, the regulators are in process of preparing for the enforcement and implementation of the EU AI Act at EU level and member state level. China also attaches great importance on the law enforcement of AI laws and regulations to ensure a trustworthy AI landscape. With the rapid growth of AI in China, it is crucial to ensure the fair, unbiased and transparent development of AI applications. Algorithm filing will play a key role in promoting and regulating the AI industry. To navigate this landscape effectively and with confidence, we suggest that companies consider the following compliance measures:
- Companies should safeguard against their commercial secrets being disclosed to the CAC during the algorithm filing process. To that end, they should carefully consider what information is disclosed in the brief description, as well as in the details of the algorithm’s primary function, classification and model. With that in mind, they should seek external legal support that can help strike a balance between meeting the CAC’s requirements and protecting commercial secrets.
- Algorithms that are considered to have public opinion or social engagement capabilities may be vaguely defined in practice. To mitigate the risk of non-compliance, companies should first assess whether the algorithm meets these criteria and is subject to filing with the CAC.
- Well-prepared documents on algorithm security will facilitate the algorithm filing process. Therefore, it is important to prepare these documents in advance. MNCs operating in China should also retain a Chinese version of, among others, the algorithm self-assessment report, algorithm security monitoring policy and emergency response plan.
- Companies providing technical services for deep synthesis technology service providers must comply with algorithm filing requirements, regardless of whether the service provider has itself filed the algorithm. If a company serves as both the deep synthesis technology service provider and the technical supporter, it must file algorithms in both capacities.
- The regulatory landscape governing data in China is rapidly evolving. Business organisations are strongly advised to closely monitor developments in legislation and enforcement related to data protection and security in China. Preparing for compliance measures in advance will be critical to staying aligned with the evolving regulations.
In-depth 2024-166