China AI Regulation

China already operates the world’s most prescriptive AI rulebook. Instead of one omnibus act, binding vertical regulations stack per technology: recommendation algorithms, deep synthesis, generative AI, and content labelling.

The Algorithmic Recommendation Provisions (effective March 2022) require filing significant algorithms with the Cyberspace Administration of China, publishing algorithm summaries, honoring opt-outs from personalization, and protecting gig-worker scheduling rights.

The Deep Synthesis Provisions (effective January 2023) mandate consent for manipulating biometric features and conspicuous labels on AI-generated media.

The Interim Measures for Generative AI Services (effective August 2023) require a security assessment plus algorithm filing before any public-facing generative service launches, along with lawful training data, IP respect, content controls, and minors protection.

Content labelling went national on September 1, 2025: Measures for Labeling AI-Generated Content force explicit visible marks and implicit metadata labels across generation, upload, and dissemination platforms, backed by the GB 45438-2025 standard.

Security assessments follow the TC260 generative AI security requirements, including corpus contamination limits and multi-thousand-question red-team test sets, making evaluation infrastructure a launch dependency rather than an afterthought.

Network Data Security Regulations (effective January 2025) extend training-data compliance duties, and a horizontal Artificial Intelligence Law sits in the legislative pipeline to consolidate the stack.

Enforcement is real: the CAC suspends and removes non-compliant apps, so filing status and labelling fidelity are availability issues, not paperwork.

AI Safety Governance Framework 3.0 (released September 14, 2026 per CAC notice, cover dated September 2026, by TC260 under CAC guidance) sits alongside binding verticals as a non-binding governance preview with no effective date or penalties. Built on Framework 1.0 (2024) and 2.0 (2025), it keeps the risk classification, technical response, and comprehensive governance logic and adds an agent layer for autonomous agents that execute tasks, alongside frontier, embodied-AI, and broader updates.

Framework 3.0 treats agent safety as a lifecycle concern, with Section 2.2.1 naming four categories in the framework wording: identity and permission misuse, reasoning and planning, tool invocation and execution, and memory storage. Annex 2 expands this to nine stages for reference: design and development, installation and deployment, instruction input, reasoning and planning, invocation and execution, memory storage, outputs, decommissioning, and residual risks. Listed failure modes include prompt injection in documents, emails, web pages, logs or messages, context overflow, goal hijacking, tool poisoning, tool privilege creep, tool selection bias, memory pollution, memory theft, leftover permissions and credentials, and escape from security constraints. Embodied AI is a separate new application-risk category in Section 2.2.2 covering perception, actuation, interaction, and multi-agent coordination.

Annex 1 application classification and risk grading by scenario, intelligence level, and scale with five tiers (low, general, relatively major, major, especially major), registration language for AI systems in critical information infrastructure, and open-source prohibited-use wording are carried over from Framework 2.0 and revised in 3.0, not newly introduced. Structurally new in 3.0 is Section 4.3 sandbox direction: industry-plus-risk rules to be written, sector-specific entry and testing for finance, education, broadcasting and television, and health, dynamic testing with monitoring and staged evaluation, a test-data sharing platform to be built, and cross-department recognition of results to be established. Section 4.3.3 only explores a liability-exemption mechanism for no-fault, controllable-risk sandbox conduct with four exclusions (national security harm, personal-rights infringement, major damage, intentional unlawful conduct) and names no body, procedure, or date, so no exemption is claimable. Explicit plus implicit content-ID traceability is binding labelling law from the 2025 measures and GB 45438-2025, referenced by the framework, not created by it.