China AI Governance Profile

Executive summary

China’s AI governance model is best understood as a layered regulatory architecture rather than a single comprehensive AI statute. Its foundation comes from cybersecurity, data security, personal information protection, network data governance, and internet information service regulation. AI-specific governance is added through the Algorithm Recommendation Provisions, Deep Synthesis Provisions, Interim Measures for Generative AI Services, and AI-generated/synthetic content labeling measures. Technical standards, including GB 45438—2025 and generative AI security requirements, translate parts of this regulatory architecture into operational controls. For enterprises, the practical burden is operational rather than only legal. A company deploying AI in China must examine whether its service is public-facing, whether it uses algorithm recommendation or deep synthesis technologies, whether generated or synthetic content requires explicit or implicit labels, whether personal information or important data is processed, whether data leaves China, whether security assessment or filing obligations are triggered, and whether sector-specific regulators are involved. China’s model therefore combines AI safety, cybersecurity, data security, content governance, platform accountability, and industrial development priorities.

Governance architecture

China’s AI governance architecture is led primarily through cyberspace, data, standards, industrial-policy, market-supervision, and sectoral authorities. The Cyberspace Administration of China is the central regulator for many AI-relevant internet information service rules, including algorithm recommendation, deep synthesis, generative AI services, AI-generated content labeling, data export security assessment, and network data governance. NDRC and MIIT are important for industrial strategy, digital infrastructure, AI+ deployment, and sectoral implementation. SAMR and SAC connect AI governance to the national standards system, while TC260 provides cybersecurity and AI security technical standards. MOST contributes responsible AI and ethics principles. MPS and sectoral regulators become relevant where AI systems implicate cybersecurity, public security, finance, healthcare, education, transport, or other regulated sectors.

Major policies and frameworks

Policy timeline

Enterprise implications

For enterprises, China’s AI governance system creates a multi-layer compliance burden. Companies should not treat AI compliance as only a model-safety issue. They need to assess service scope, public-facing deployment, platform status, algorithm recommendation functions, deep synthesis functions, generated or synthetic content labeling, training data governance, personal information processing, important data exposure, cross-border data transfer, cybersecurity obligations, security assessment, algorithm or service filing, user rights, complaint handling, minor protection, and content safety controls. The operational center of gravity is documentation and control. Enterprises deploying AI in China should build evidence around data provenance, model and output testing, labeling implementation, user notices, complaint channels, human review, cybersecurity management, content moderation, risk monitoring, vendor allocation, and readiness for regulatory review or filing. Multinational companies should pay special attention to cross-border data flows, model access from outside China, overseas API calls, and whether personal information or important data is processed in a way that triggers outbound data requirements.

Observatory interpretation

Observatory interpretation: China’s model is best described as a state-led, security-sensitive, platform-and-data governance model. It governs AI through the same institutional logic used for internet information services, cybersecurity, data governance, and platform accountability. Observatory interpretation: The most important compliance feature is the connection between AI governance and content/data controls. Algorithm recommendation, deep synthesis, generative AI, and labeling rules are not isolated AI policies; they sit inside a broader governance architecture concerned with public opinion, social mobilization, cybersecurity, data security, personal information protection, and platform responsibility. Observatory interpretation: China’s approach is operationally demanding for enterprises because obligations may arise from multiple layers at once: laws, administrative regulations, departmental rules, interim measures, technical standards, filing notices, security assessments, and sectoral requirements. The profile should therefore emphasize compliance architecture, not only legal taxonomy.

Official resources

Downloadable artifacts

Update log