China does not have one comprehensive AI law. It regulates AI through a stack of targeted rules, mostly issued by the Cyberspace Administration of China (CAC) with other ministries, on top of the data and cybersecurity laws. Some of these rules are strict and already enforced. This guide explains what applies, when it started and who is caught. It is general information, not legal advice.
The short version
- There is no single AI statute. The State Council's 2026 legislative work plan (11 May 2026) says it will speed up comprehensive AI legislation, but reports say it includes no AI bill for the National People's Congress Standing Committee this year.
- Public-facing generative AI services in China must be filed or registered, and the biggest ones need a security assessment before launch.
- AI-generated content must be labelled, visibly and in the file metadata, since 1 September 2025.
- AI companion and "human-like" chatbot services have their own rules since 15 July 2026.
- The rules reach foreign providers that serve people in China.
The rules, by what they cover
- Algorithmic recommendation provisions (1 March 2022): recommendation algorithms, user controls, and filing for services that can shape public opinion.
- Deep synthesis provisions (10 January 2023): face swap, voice synthesis and similar tools, with real-name checks, labels and filing.
- Interim Measures for Generative AI Services (15 August 2023): public text, image, audio and video generation services.
- Measures for Labelling AI-Generated Content, with mandatory standard GB 45438-2025 (1 September 2025): explicit and implicit labels on AI-generated content.
- Cybersecurity Law, as amended (1 January 2026): a new Article 20 on AI, plus higher fines.
- Interim Measures for Anthropomorphic AI Interactive Services (15 July 2026): AI companions and role-play chatbots offered to the public.
Generative AI: filing, registration and security assessment
The generative AI measures apply to services offered to the public in China, wherever the provider is based. Three things matter most in practice.
- Filing and registration. Model providers file with the national CAC. Apps that only call an already filed model through an API register with their provincial CAC office instead. Services must show the model name and their filing or registration number.
- Security assessment. Public-facing services with the ability to influence public opinion or mobilise people need a security assessment before launch.
- Content duties. Providers must keep to content restrictions, avoid discrimination, protect privacy and trade secrets, deal with unlawful content and report it. Staff-only internal tools fall outside these measures, but still face data and ethics rules.
Labelling AI-generated content
Since 1 September 2025, AI-generated text, images, audio, video and virtual scenes must carry two kinds of label. Explicit labels are visible or audible to people and must stay when content is downloaded or exported. Implicit labels sit in the file metadata, and digital watermarks are encouraged. The duties are shared. Service providers explain their labelling in user agreements and keep logs where users ask for content without explicit labels, platforms check for labels and warn users, app stores check whether apps offer AI generation, and users must declare AI-generated content when they publish it. Removing or forging labels is banned. Enforcement is real. In April 2026 the CAC told local regulators to act against two apps and an AI website for poor labelling. Companies were summoned and told to fix problems, with warnings and discipline for responsible staff.
AI companions and human-like chatbots
The Anthropomorphic AI Interactive Services measures were issued on 10 April 2026 and took effect on 15 July 2026, from the CAC with four other bodies. They cover services that imitate a person's personality, thinking or way of talking and keep up emotional interaction with the public. Customer service, Q&A, work assistants, education and research tools are outside them. Key duties include telling users they are talking to an AI, parental consent for children under 14, age checks and time-limited minor modes, warnings for users who show signs of excessive dependence, crisis monitoring with ways to intervene, and letting users copy or delete their chat history. The measures also ban content that encourages self-harm or manipulates users into dependence.
Data, privacy and the Cybersecurity Law
AI sits on top of the Personal Information Protection Law (PIPL), the Data Security Law and the Cybersecurity Law. The amended Cybersecurity Law took effect on 1 January 2026. Its new Article 20 supports AI research and ethics but does not itself create new company duties. The higher fines do matter: one law-firm summary reports penalties of RMB 500,000 to 2 million for serious consequences and RMB 2 million to 10 million for especially serious ones, with fines on responsible individuals as well. Check the amended text before relying on exact figures.
Other rules to know
- Ethics review. Trial measures from ten authorities in 2026 require internal ethics review for AI research and development.
- Finance. On 18 June 2026 the National Financial Regulatory Administration issued guiding opinions on AI in banking and insurance, covering risk classes, human oversight and third-party model risk.
- Courts. On 7 September 2026 the Supreme People's Court issued opinions on AI disputes. Liability is generally fault-based, providers must act promptly on valid infringement notices, and using someone's voice to train an identifiable synthetic voice without consent infringes voice rights.
- Voluntary standards. Three recommended national standards on generative AI security, training data and data labelling took effect on 1 November 2025.
Does this apply to a foreign company?
It can. The generative AI measures cover public services in China whatever the provider's location. The CAC can ask other agencies to take technical measures, in practice blocking access, against non-compliant services provided from abroad. The PIPL reaches processing outside China that aims to offer products or services to people in China. A purely internal tool with no users in China is far less exposed, but you should still check data rules if you handle personal information of people in China.
What to do first
- Decide whether you serve the public in China, or only staff inside your own organisation.
- If you serve the public, work out whether you must file as a model provider or register as an app, and whether a security assessment applies.
- Check labelling for everything your service generates, both the visible label and the metadata.
- If you run a companion or role-play product, read the minors and dependence rules first.
- Review how personal data of people in China is collected, stored and sent abroad.
Official sources
- Cyberspace Administration of China for the measures, announcements and filing lists
- National Laws and Regulations Database for the Cybersecurity Law, PIPL and Data Security Law
- For the rest of the world, see which AI laws apply to your business
Last reviewed 30 October 2026. Chinese rules change quickly and the official texts are in Chinese. Confirm details with qualified counsel in China before you act.
