China AI Governance Framework

China’s AI governance model is best understood as a layered regulatory architecture rather than a single comprehensive AI statute. Its foundation comes from cybersecurity, data security, personal information protection, network data governance, and internet information service regulation. AI-specific governance is added through the Algorithm Recommendation Provisions, Deep Synthesis Provisions, Interim Measures for Generative AI Services, and AI-generated/synthetic content labeling measures. Technical standards, including GB 45438—2025 and generative AI security requirements, translate parts of this regulatory architecture into operational controls.

Since the previous review, the Interim Measures for the Management of Anthropomorphic AI Interactive Services took effect on 15 July 2026, extending the active service-governance layer to sustained human-like interaction, including safeguards, safety assessment, labeling, and platform responsibilities. CAC’s four-month 2026 AI-application rectification campaign produced first-stage results on 6 July and second-stage results on 2 September, with action against products, accounts, platforms and other services for filing, safety-review, data-poisoning, and content-labeling failures. CAC also continued official filing notices for generative-AI and mobile on-device generative-AI services. These are binding-rule and enforcement developments, not voluntary guidance.

For enterprises, the practical burden is operational rather than only legal. A company deploying AI in China must examine whether its service is public-facing, whether it uses algorithm recommendation, deep synthesis, or anthropomorphic interaction technologies, whether generated or synthetic content requires explicit or implicit labels, whether personal information or important data is processed, whether data leaves China, whether security assessment or filing obligations are triggered, and whether sector-specific regulators are involved. China’s model therefore combines AI safety, cybersecurity, data security, content governance, platform accountability, technical standardization, and industrial development priorities.

China’s AI governance architecture is led primarily through cyberspace, data, standards, industrial-policy, market-supervision, and sectoral authorities. The Cyberspace Administration of China is the central regulator for many AI-relevant internet information service rules, including algorithm recommendation, deep synthesis, generative AI services, AI-generated content labeling, anthropomorphic AI interactive services, data export security assessment, and network data governance. NDRC and MIIT are important for industrial strategy, digital infrastructure, AI+ deployment, and sectoral implementation. SAMR and SAC connect AI governance to the national standards system, while TC260 provides cybersecurity and AI security technical standards. MOST contributes responsible AI and ethics principles. MPS and sectoral regulators become relevant where AI systems implicate cybersecurity, public security, finance, healthcare, education, transport, or other regulated sectors. The 2026 CAC enforcement campaign and NMPA’s AI-plus-drug-regulation opinions show the architecture operating through both platform enforcement and sector-specific implementation.

For enterprises, China’s AI governance system creates a multi-layer compliance burden. Companies should not treat AI compliance as only a model-safety issue. They need to assess service scope, public-facing deployment, platform status, algorithm recommendation functions, deep synthesis functions, generated or synthetic content labeling, training data governance, personal information processing, important data exposure, cross-border data transfer, cybersecurity obligations, security assessment, algorithm or service filing, user rights, complaint handling, minor protection, and content safety controls.

The operational center of gravity is documentation and control. Enterprises deploying AI in China should build evidence around data provenance, model and output testing, labeling implementation, user notices, complaint channels, human review, cybersecurity management, content moderation, risk monitoring, vendor allocation, and readiness for regulatory review or filing. Multinational companies should pay special attention to cross-border data flows, model access from outside China, overseas API calls, and whether personal information or important data is processed in a way that triggers outbound data requirements.

Implementation is becoming more granular across deployment form and technical architecture. Filing/registration totals and the mobile on-device notice show continued operation of the existing generative-AI regime. September standards add technical references for large models, knowledge systems and government deployments. Distinguish binding filing, data, labelling and platform duties from non-binding safety frameworks and recommended/guiding technical documents.

Observatory interpretation: China’s model is best described as a state-led, security-sensitive, platform-and-data governance model. It governs AI through the same institutional logic used for internet information services, cybersecurity, data governance, and platform accountability.

Observatory interpretation: The most important compliance feature is the connection between AI governance and content/data controls. Algorithm recommendation, deep synthesis, generative AI, and labeling rules are not isolated AI policies; they sit inside a broader governance architecture concerned with public opinion, social mobilization, cybersecurity, data security, personal information protection, and platform responsibility.

Observatory interpretation: China’s approach is operationally demanding for enterprises because obligations may arise from multiple layers at once: laws, administrative regulations, departmental rules, interim measures, technical standards, filing notices, security assessments, and sectoral requirements. The profile should therefore emphasize compliance architecture, not only legal taxonomy.

The September 2026 standards cluster shows technical standardization developing alongside laws, departmental rules, filing mechanisms and safety frameworks. Framework 3.0 is a non-binding governance reference; GB/T recommended standards and GB/Z guiding technical documents do not become mandatory merely because they are national documents.