China Finalizes Its First Administrative Measures Governing Generative AI

Scope of Application

According to Article 2 of the Generative AI Measures, the measures apply to the provision of generative AI services provided to the public within the PRC.

• Generative AI services refers to the services provided to the public within the PRC that generate content in the form of texts, pictures, audio and videos by using generative AI technology. (Article 2.)
• Generative AI technology refers to the models and related technologies with the ability to generate text, pictures, audio, video and other content. (Article 22.)
• Generative AI service users (Users) refers to organizations and individuals who use generative AI services to generate content. (Article 22.)
• Generative AI service providers (Providers) refers to organizations and individuals that use generative AI technology to provide generative AI services, including providing generative AI services through application programming interface (API) or other methods. (Article 22.)

A broader interpretation of the above definitions would make both the developers and Providers of generative AI technology subject to the Generative AI Measures, so long as the generative AI technology developed (by the developer) and used (by the Providers) are offered to the public within China for services of generating texts, pictures, audio, videos and other content.

Moreover, Article 20 of the Generative AI Measures specifies that if an overseas Provider that provides generative AI services to the public within the PRC fails to comply with the Generative AI Measures or relevant PRC laws and regulations, the CAC would notify the relevant government agencies to take technical measures and other necessary measures to deal with the violations by the overseas Provider. The Generative AI Measures do not define or specify what technical measures or other measures will be used to deal with violations by overseas Providers.  It is anticipated that such measures will most likely involve blocking online access for mainland China users from the generative AI service provided by the overseas Provider.

However, the Generative AI Measures explicitly exclude the following activities from its scope of application: “Research and development and application of Generative AI Technology by industry organizations, enterprises, academic and research institutions, public cultural institutions, and others that do not provide such services to the domestic public.” (Article 2.)

The Generative AI Measures clarified that the regulation is aimed at generative AI services offered “to the public” in China. The words “to the public” are an important addition: research activities and services developed for use within an organization or industry are now exempted from the regulations. The utilization of generative AI services for research and services developed for use by an organization or enterprise are now exempted from the Generative AI Measures.

Further, the regulations also clarified that other regulations governing the use of generative AI services for specific activities such as news publishing, film and television production, and literary and artistic creation would take precedence over the Generative AI Measures. These areas might be subject to industry-oriented regulations and stricter review and control of content.

Requirements for Generative AI and Rights of Users

The Generative AI Measures impose broad obligations on Providers of generative AI services, including, among others, the following key requirements:

• Monitoring Content: The Providers shall assume the responsibility of the network information content producer. (Article 9.) If a Provider discovers illegal content, it should promptly take measures, such as stopping generation and transmission and deletion, and report to the competent authority. If a Provider discovers that the User is using the service to engage in illegal activities, the Provider must issue warnings, restrict functions, suspend or terminate the services, keep relevant records, and report to the competent authority. (Article 14.)
• Marking on Generated Content: The Providers are required to add a mark on content (pictures, videos and other content generated by generative AI services) according to the Regulations on the Administration of Deep Composition of Internet Information Services. (Article 12.)
• Training Data: The Providers are required to undertake data training, such as pre-training and optimization training. During the data training, the Providers must use data and basic models with legitimate sources that do not infringe on the intellectual property rights of others, and if the training involves personal information collection and processing, Providers must obtain the consent of those individuals. (Article 7.)
• Data Labeling: If a Provider is labeling training data during the development stage, it must formulate clear, specific and practical labeling rules. The Provider must also undertake a quality assessment of its data labeling and conduct sample verification on the accuracy of the labeled content. (Article 8.)
• Protecting Personal Information: The Providers have the obligation to protect the User’s input information and usage records and must not collect unnecessary personal information. The Providers must not illegally retain input information and usage records that can identify the User’s identity and must not illegally provide the User’s input information and use records to others. (Article 11.)
• Agreement: Providers must enter into agreements with Users to prescribe obligations and responsibilities between the Provider and the User. (Article 9.)

Compared to the Draft Regulations, the Generative AI Measures ease some of the requirements and obligations of the Providers. For example, the new requirements:

• Relax the requirements on data training by replacing the previous requirement on Providers of “ensuring the authenticity and accuracy of data” with “taking effective measures to improve transparency, authenticity and accuracy of data;”
• Replace the requirements on the Providers of “taking measures to prevent the generation of false information” with requirements of “taking effective measures to enhance the transparency of Generative AI Services and improve the accuracy and reliability of generated content;”
• Eliminate the three-month timeline for Providers to improve data models after detecting violations of any laws or regulations, thereby granting Providers more freedom to enhance their AI models; and
• Remove the requirement for real identity verification.

Industry-Oriented Regulation and Classification Regulation

The Generative AI Measures also introduce an article requiring different industry regulators (such as governmental agencies supervising cyberspace, development and reform, education, technology, public security, radio and television, etc.) to strengthen regulation of generative AI within different industrial sectors. This industry-oriented regulatory model is similar to the UK’s approach, which establishes overarching principles but emphasizes that applicable regulators should apply the principles according to the context in which AI is deployed (which should essentially create a sectoral, industry-orientated approach) and aims to establish separate and additional industry-specific AI regulations and/or standards.

Also, the Generative AI Measures specify that guidelines for the classification and grading of AI would be adopted by the industry regulators and national authorities, although the details for such classification have yet to be disclosed. We expect that the classification guidelines may be provided in the implementing rules that will be formulated by the CAC and/or other industry regulators.

Legal Liability Excludes Monetary Fines

The Generative AI Measures include penalties, such as warnings, suspension of services and other criminal liabilities. In contrast to the Draft Regulations, however, the Generative AI Measures remove monetary fines from the list of penalties for violations.

Conclusion

Generative AI technology presents tremendous market opportunities while also posing potential risks. The Generative AI Measures, as China’s first specific regulation on generative AI, encourage innovations in AI applications, as well as technologies supporting AI applications. The Generative AI Measures also encourage international cooperation and international standard collaboration on generative AI technologies. These new regulations show China’s effort to strike a balance between encouraging innovation and mitigating security risks. Providers offering generative AI services to the public in China (including domestic and overseas Providers) are strongly recommended to undertake internal AI audits and ensure compliance with the new Generative AI Measures.