Regulationsby GlyphJurisdiction
China: data, AI and cyber laws
Part of APAC.
Regulations
Add to calendar
China AI Content Labeling MeasuresRequires generative AI service providers to add explicit (visible) labels to AI-generated text, images, audio, video and virtual scenes, and implicit labels (metadata) to generated files. Content distribution platforms must detect and label AI-generated content, and app stores must check labeling functions when apps are listed. A mandatory national standard (GB 45438-2025) takes effect on the same date.In effect since Sep 1, 2025China Algorithmic Recommendation ProvisionsRegulates recommendation, ranking, personalization, generation and dispatch algorithms used in internet services in China. Users must be able to switch off personalized recommendations and manage tags, and providers may not use algorithms for price discrimination or to induce addiction. Providers with public opinion attributes or social mobilization capacity must file their algorithms with the CAC within 10 working days of launching a service.In effect since Mar 1, 2022China Anthropomorphic AI MeasuresRegulates AI companion and emotional interaction services that simulate human personality. Providers must tell users they are talking to AI, remind users after every 2 hours of use, intervene in crises such as self-harm, offer easy exit, and may not offer virtual partner or relative services to minors. Users' interaction data may not be shared or used for training on sensitive data without consent, and services with 1 million registered or 100,000 monthly active users need a security assessment filed with the provincial CAC.In effect since Jul 15, 2026China Cross-Border Data Flow ProvisionsRelaxes China's data export regime by exempting common transfers (contracts with the individual, cross-border HR, emergencies, and non-CII transfers of PI of fewer than 100,000 people a year) and setting volume thresholds for when a CAC security assessment, standard contract or certification is needed. Data is not 'important data' unless regulators have notified or published it as such.In effect since Mar 22, 2024China Cyber Incident Reporting MeasuresRequires network operators in China to grade cybersecurity incidents using an annexed grading guide and report incidents rated relatively major or above. CII operators must report within 1 hour, central government bodies within 2 hours, and other operators to the provincial CAC within 4 hours. A full post-incident report is due within 30 days after handling ends, and ransom demands must be disclosed.In effect since Nov 1, 2025China Cybersecurity LawChina's base cybersecurity statute: multi-level protection scheme duties for network operators, localization and security review duties for critical information infrastructure (CII) operators, and content controls. The 2025 amendment, in force from 1 January 2026, adds AI governance support, ties PI processing to PIPL, allows fines on first violations and sharply raises maximum fines.In effect since Jun 1, 2017China Data Export Security Assessment MeasuresSets the CAC security assessment that must be passed before certain data leaves China, including exports of important data and large-scale personal information exports. Data handlers must run a self-assessment, then apply through the provincial CAC for a national CAC review. Transfers already under way had six months to come into compliance.In effect since Sep 1, 2022China Data Security LawSets up China's data classification and grading system, with heightened protection for 'important data' and 'core data'. Requires data processors to run data security management systems, risk monitoring and incident handling, and restricts giving data stored in China to foreign judicial or law-enforcement bodies without approval.In effect since Sep 1, 2021China Data Security Risk Assessment MeasuresImplements the annual risk assessment duty for important data handlers under the DSL and Network Data Security Regulations. Important data handlers must assess risk every year and submit the report to their regulator within 20 working days of finishing; general data handlers are encouraged to assess at least every 3 years. Regulators can order an assessment by a certified third party after serious risks or large leaks.In effect since Aug 20, 2026China Deep Synthesis ProvisionsRegulates deepfakes and other deep synthesis services such as synthetic text, voice cloning, face swapping and immersive scenes. Providers must verify user identity, review content, add technical marks to generated content, and add prominent labels where content could confuse the public. Providers with public opinion attributes must file algorithms, and app stores must check filings and security assessments.In effect since Jan 10, 2023China Facial Recognition MeasuresSets rules for using facial recognition to process face data in China. Handlers need a specific purpose and necessity, separate consent (guardian consent under 14), a prior impact assessment, local storage on the device unless consent or law allows otherwise, and a non-face alternative. Handlers storing face data of 100,000 people or more must file with the provincial CAC within 30 working days.In effect since Jun 1, 2025China Generative AI MeasuresChina's main rule for generative AI services offered to the public in China. Providers must use lawfully sourced training data, respect IP and personal information rights, label generated content, handle illegal content, and protect minors. Services with public opinion attributes or social mobilization capacity need a security assessment and algorithm filing.In effect since Aug 15, 2023China Minors Online Protection RegulationsChina's State Council regulation on online protection of minors. Platforms with huge numbers of minor users or significant influence on minors must run impact assessments, offer minor modes, set up independent oversight and publish annual reports. Handlers of minors' personal information must run annual compliance audits, and online services must have anti-addiction systems.In effect since Jan 1, 2024China Network Data Security RegulationsImplementing regulations under the CSL, DSL and PIPL covering personal information, important data, cross-border data and platform duties. Processors of PI of 10 million+ people must also meet important-data processor duties, such as naming a security lead and filing annual risk assessments. Platforms must offer an easy opt-out from personalized recommendations.In effect since Jan 1, 2025China PI Compliance Audit MeasuresImplements PIPL Arts. 54 and 64: PI processors must audit their own PIPL compliance regularly, and regulators can order an audit by a professional firm when they find high risk or an incident. Processors of PI of more than 10 million people must audit at least once every two years.In effect since May 1, 2025China PI Export Certification MeasuresSets the third route for exporting personal information from China: certification by an accredited certification body. Available to non-CII handlers exporting personal information of 100,000 to under 1 million people (non-sensitive) or under 10,000 people's sensitive data in a year. Certificates last three years; overseas handlers apply through a local entity or representative.In effect since Jan 1, 2026China PI Export Standard Contract MeasuresLets personal information handlers export personal information by signing China's standard contract with the overseas recipient instead of a security assessment, if volume limits are met. Handlers must do a personal information protection impact assessment and file the signed contract with the provincial CAC. Transfers already under way had six months to comply.In effect since Jun 1, 2023China PIPLChina's comprehensive personal information law: requires a legal basis (usually consent) for processing, separate consent for sensitive data and cross-border transfers, PI impact assessments, and data subject rights. Applies extraterritorially to processing of data of people in China to provide products/services or analyze their behavior. Cross-border transfers need a CAC security assessment, standard contract, or certification.In effect since Nov 1, 2021China Small PI Handler Simplified MeasuresEases PIPL compliance for handlers processing personal information of fewer than 100,000 people. They can use short notices, rely on platform privacy rules, run simplified compliance audits at least every five years using a self-check form, and use simplified impact assessments. It also exempts common cross-border transfers from the assessment, contract and certification routes and limits penalties for minor first violations.In effect since Sep 1, 2026
Past deadlines
China Small PI Handler Simplified MeasuresSimplified measures for small handlers take effectSmall handlers may use simplified notice, audit and assessment methods.ChinaChina Data Security Risk Assessment MeasuresRisk assessment measures take effectAnnual risk assessment and reporting duties for important data handlers apply.ChinaChina Anthropomorphic AI MeasuresAnthropomorphic AI measures take effectAI disclosure, usage reminders, minor protection, data and security assessment duties apply.ChinaChina Minors Online Protection RegulationsMeasures identifying large or influential platforms for minors take effectPlatforms meeting the thresholds (for example 10 million registered or 1 million monthly active minor users) must apply to be designated.ChinaChina Minors Online Protection RegulationsClassification measures for content harmful to minors take effectImplementing measures classify online information that may affect minors' physical and mental health.ChinaChina PI Export Certification MeasuresPI export certification measures take effectThe certification route for personal information exports applies.ChinaChina Cybersecurity Law2025 amendments take effectHigher fines, first-violation fines, AI governance provisions and PIPL-alignment duties apply under the 28 Oct 2025 NPCSC Decision.ChinaChina Cyber Incident Reporting MeasuresIncident reporting measures take effect1, 2 and 4 hour reporting windows apply to relatively major and higher incidents.ChinaChina AI Content Labeling MeasuresAI content labeling measures and GB 45438-2025 take effectExplicit and implicit labeling duties for AI-generated content and platform detection duties apply.ChinaChina Facial Recognition MeasuresFacial recognition measures take effectConsent, impact assessment, storage and filing duties apply.ChinaChina PI Compliance Audit MeasuresPI compliance audit measures take effectSelf-audit and regulator-ordered audit regime applies; 10M+ processors must audit at least every two years.ChinaChina Network Data Security RegulationsNetwork Data Regulations take effectAll provisions, including the 10-million-person threshold duties and annual important-data risk assessments, apply.ChinaChina Cross-Border Data Flow ProvisionsCross-border data flow provisions take effectExemptions and volume thresholds apply from publication (Art. 14); security assessment results are valid for 3 years (Art. 9).ChinaChina Minors Online Protection RegulationsMinors online protection regulations take effectPlatform, content, personal information and anti-addiction duties apply.ChinaChina PI Export Standard Contract MeasuresRemediation window for existing transfers endsExisting exports had to comply within six months of 2023-06-01. The exact end date is computed, not stated.ChinaChina Generative AI MeasuresGenerative AI measures take effectTraining data, labeling, content and user protection duties apply to public generative AI services.ChinaChina PI Export Standard Contract MeasuresStandard contract measures take effectThe standard contract route and filing duty apply.ChinaChina Data Export Security Assessment MeasuresRemediation window for existing transfers endsExisting exports had to be remediated within six months of 2022-09-01. The exact end date is computed, not stated.ChinaChina Deep Synthesis ProvisionsDeep synthesis provisions take effectLabeling, identity verification and filing duties apply to deep synthesis services.ChinaChina Data Export Security Assessment MeasuresSecurity assessment measures take effectCovered data exports require a CAC security assessment.ChinaChina Algorithmic Recommendation ProvisionsAlgorithmic recommendation provisions take effectUser opt-out, transparency and algorithm filing duties apply.ChinaChina PIPLPIPL takes effectAll PIPL obligations (legal bases, consent, cross-border rules, data subject rights) apply (Art. 74).ChinaChina Data Security LawData Security Law takes effectData classification, important-data protection and data export restrictions apply (Art. 55).ChinaChina Cybersecurity LawCybersecurity Law takes effectOriginal CSL obligations for network operators and CII operators apply.China