China's New Measures on Generative AI Services: Shaping the Landscape

by Richard Ma, Joanna Jiang, Jonathan Pfister, and Chris Beall

On 10 July 2023, the Cybersecurity Administration of China (“CAC”), alongside six other PRC government departments,[1] jointly released the Interim Measures for the Administration of Generative Artificial Intelligence Services (生成式人工智能服务管理暂行办法, “Generative AI Measures”), which will come into effect on 15 August 2023.

The Generative AI Measures have been published following the release of the Measures on the Administration of Generative Artificial Intelligence Services (Public Comment Draft) (生成式人工智能服务管理办法（征求意见稿）), on 11 April 2023 (“Draft Measures”). Compared with the Draft Measures, the requirements of the Generative AI Measures seem softer and more business/innovation friendly.

Who will the Generative AI Measures apply to?

Any entity, organization or individual that provides services that generate any text, images, audios, videos or other content to the general public in mainland China using “generative AI technology”, whether through APIs or other means, (“Generative AI Services”) will be subject to the Generative AI Measures. “Generative AI technology” is defined to include any models and relevant technology that can generate text, images, audio, videos, or other content.

As a result, Baidu’s ERNIE bot, Alibaba’s Tongyi Qianwen, and a number of other generative AI chatbots available in China will need to comply with the Generative AI Measures. However, anyone researching, developing, and using generative AI technology without offering Generative AI Services to the general public in China will not fall within the scope of the Generative AI Measures.

Entities established outside of China are also covered. Article 20 expressly provides that the CAC, in conjunction with other PRC regulators, will take necessary technical and other measures against Generative AI Services that are provided to users in China from the offshore level (i.e., via servers and data hosted outside of China) that violate the Generative AI Measures or other PRC laws and regulations. In practice, we expect this will most often result in non-compliant Generative AI Services being restricted or blocked by China’s Great Firewall, given the difficulty of extraterritorial enforcement against non-PRC entities, which may not have operations or assets within the reach of China’s regulators.

Generative AI with Chinese Characteristics

Aligned with China’s longstanding online service/content requirements, Generative AI Services will also be subject to PRC content censorship. Specifically, Generative AI Services must (among other things):

• “Uphold the Core Socialist Values”, and not generate any content that incites subversion of national sovereignty or the overthrow of China’s socialist system, threatens national security and interests, harms the nation's image, incites separatism, undermines national unity and social stability, propagates terrorism or extremism, or propagates ethnic hatred;
• adopt effective measures to prevent the generation of content that discriminates on the basis of race, ethnicity, beliefs, nationality, region, gender, age, occupation, or health;
• respect IP rights and commercial ethics, and protect commercial secrets; and
• respect the lawful rights and interests of others, not endanger the physical and psychological well-being of others, and not infringe the rights and interests of others, including their likeness, reputation, honor, etc.

Although the means of doing so will differ, the Generative AI Measures will likely require Generative AI Services to adopt measures to self-censor content similar to that censored by online service/content providers in China.

Notably absent from the above list is the requirement found in the Draft Measures that content generated by Generative AI Services be “truthful and accurate, and that measures be taken to prevent the generation of false information”. This omission will be a welcomed change for companies in this space, due to the immense difficulties faced by Generative AI Services in controlling and preventing “hallucinations” (the generation of false or incorrect content). The Generative AI Measures now merely provide that effective measures will need be taken to increase the transparency of relevant services and to improve the accuracy and reliability of content – a much lower threshold than found under the Draft Measures.

Obligations on Generative AI Service Providers

The Generative AI Measures require generative AI service providers[2] to take a number of actions, many of which are aimed at ensuring compliance with a number of PRC laws and regulations[3]. In addition to complying with the requirements of the PRC Cybersecurity Law, the PRC Data Security Law and the PRC Personal Information Protection Law, the following are worth noting:

• Execution of service agreements. Service providers are required to execute service agreements with users who register for their Generative AI Services. Although the format of such service agreements is currently undetermined, they may well take the form of standard terms of service. This requirement is again less onerous than that under the Draft Measures, which required users to provide real identity information in accordance with the PRC Cybersecurity Law.
• Anti-addiction measures. Generative AI service providers are required to employ effective measures aimed at preventing minor users from becoming over-reliant on or addicted to such services.
• Deep fake labeling. Service providers offering “deep synthesis” services[4] are required to prominently label pictures, videos, and other generated content in a reasonable place or area to alert the public about its artificial/edited status.
• Reporting content violations and wrongful activities to PRC regulators. If any illegal content is discovered, service providers must promptly stop its generation or transmission and remove it, and employ measures, such as model optimization training, to rectify the processes responsible for generating such content. The case must be reported to relevant authorities as well. Moreover, if any users are found to be using Generative AI Services for illegal activities, the service provider must issue warnings, restrict functions, and suspend or terminate services to such users, must keep all related records, and must report the case to relevant authorities.
• Complaint channels. Service providers are required to establish and maintain an easily accessible complaint channel, which can promptly accept and handle complaints and reports from the public and provide feedback on the outcome of any complaints/reported matters.

Potential Governmental Approvals

The Generative AI Measures require that any Generative AI Services with “public opinion properties or the capacity for social mobilization”[5] are required to do the following:

• Security assessment. The service provider must carry out a security assessment in accordance with relevant state provisions. Such an assessment can be conducted by the service provider itself or through a third party, and must cover a range of information, including information on security management departments and personnel, an explanation of the methods used to verify user identity and retention practices for user registration information, measures used to retain user login information, measures adopted to prevent and resolve illegal and harmful information, and measures for cooperating with China’s Public Security Bureau (“PSB”) and other authorities on investigations into illegal activities. The assessment results should take the form of a formal report and be filed through a designated online platform with the local branches of the CAC and the PSB for their review.[6]
• Algorithm filing. Service providers that employ recommendation algorithms are required to complete an algorithm filing via the CAC’s designated online platform[7] within ten working days of providing relevant services.

In addition, depending on the specific features and business model of a given Generative AI Service, additional regulatory requirements may need to be met, including PRC internet/telecoms regulatory requirements, content censorship/publication requirements, and the requirements of industry-specific regulations. Each Generative AI Service should therefore be reviewed on a case-by-case basis, to ensure compliance not only with the Generative AI Measures, but with other existing laws and regulations as well.

Consequences of Non-Compliance

In the event of a violation of the Generative AI Measures, penalties may be incurred pursuant to the PRC Cybersecurity Law, the PRC Data Security Law, the PRC Personal Information Protection Law, and the PRC Law on the Progress of Science and Technology. For example, violations of the personal information protection provisions of the Generative AI Measures will likely trigger penalties under the PRC Personal Information Protection Law, and may include a warning, an order for rectification, confiscation of illegal gains, and a fine of up to RMB 1 million (among others).

Where other laws or regulations are silent, relevant authorities are still authorized to issue a warning or reprimand, and can order rectification measures to be taken within a specified time limit. If parties fail to adopt such rectification measures, or if the circumstances are especially serious, then a suspension order may be issued.

Furthermore, the Generative AI Measures specify that, during an investigation into Generative AI Services, upon the request of PRC regulators, generative AI service providers must cooperate and explain the source, scale, type, labeling rules, algorithm mechanisms, etc. of their training data, and provide necessary technical, data, and other support and assistance.

Our Observations

The Generative AI Measures are the latest in a series of AI-focused regulations and policy documents issued by governmental authorities in the PRC. Currently, China is a global leader – ahead of both the US and the EU – in publishing a set of detailed AI regulations, covering deep synthesis, recommendation algorithms, and now, generative AI.

In the first half of 2023, China led the world in the number of funded generative AI startups[8]. Service providers such as these will likely welcome the Generative AI Measures. Not only do they provide clarity, but the Generative AI Measures are also less onerous and more pro-innovation than the predecessor Draft Measures. In many places, the sharp edges have been worn down, and the provision requiring the accuracy of generated content in particular has been removed. The lighter touch taken with these measures is likely due to China’s clear desire to be a global leader in this space.

All in all, we view this as a helpful development that will eliminate regulatory uncertainties in this cutting-edge industry and likely lead to the release of many more generative AI technologies and services in the near future. As always, DaHui will continue to monitor all developments in this space.

[1] The other six PRC government authorities are the National Development and Reform Commission (NDRC); Ministry of Education (MOE); Ministry of Science and Technology (MOST); Ministry of Industry and Information Technology (MIIT); Ministry of Public Security (PSB); National Radio and Television Administration (NRTA).

[2] Under the Generative AI Measures, a “Generative AI Service Provider” is any organization or individual that utilizes generative AI technology to provide Generative AI Services.

[3] These PRC laws and regulations mainly include: the PRC Cybersecurity Law, the PRC Data Security Law, the PRC Personal Information Protection Law, the PRC Law on the Progress of Science and Technology.

[4] Under the Administrative Provisions on Deep Synthesis in Internet-based Information Services jointly issued by the CAC, MIIT, and PSB, which took effect on 1 January 2023, the following services are subject to such labeling requirements: (a) smart dialogue, smart writing, or other services that simulate a natural person to generate or edit textual content; (b) speech generation services, such as voice synthesis or voice imitation or other editing services that significantly alter personal identification characteristics; (c) services that generate images or videos of people, such as face generation, face swapping, face manipulation, or posture manipulation, or editing services that significantly alter personal identification characteristics; (d) immersive simulated-scene generation, editing or other services; or (e) other services that can generate or significantly alter information content.

[5] Although not specifically mentioned under the Generative AI Measures, we believe the definition of services involved in shaping public opinion or engaging in social mobilization provided under the Provisions on the Security Assessment for Internet-based Information Services Capable of Creating Public Opinions or Social Mobilization issued by the CAC, which took effect on 30 November 2018, is instructive: (a) information services such as forums, blogs, microblogs, chat rooms, communication groups, public accounts, short videos, webcasts, information sharing; and (b) other internet-based information services that provide channels for the public to express their opinions or are capable of mobilizing the public to engage in specific activities.

[6] The online platform can be found at: http://www.beian.gov.cn/.

[7] This is same online platform mentioned above, at: https://beian.cac.gov.cn/.

[8] https://www.scmp.com/tech/tech-trends/article/3227197/china-leads-world-number-generative-ai-start-ups-receive-funding-first-half-2023-report-finds