Data compliance for AI products operates on a different scale from that of the traditional internet. In the traditional model, data flows linearly — collection, storage, use. In AI products the flow is a mesh: training data, user input, model output, API transit and cross-border transfer, each with its own compliance requirements.
Five data compliance risk areas for AI products
Risk one: lawfulness of training data sources
Legal basis: Article 7, Interim Measures for the Administration of Generative Artificial Intelligence Services
Providers of generative artificial intelligence services shall conduct pre-training, optimisation training and other training data processing activities in accordance with law, and comply with the following: (1) use data and foundation models from lawful sources; (2) where intellectual property is involved, not infringe the intellectual property rights lawfully enjoyed by others; (3) where personal information is involved, obtain the consent of the individual or satisfy other circumstances provided by laws and administrative regulations; (4) take effective measures to improve the quality of training data and enhance its authenticity, accuracy, objectivity and diversity.
Risk scenarios:
| Data source | Compliance risk | Response |
|---|---|---|
| Crawled public web data | Possible infringement of copyright or personal information | Review robots.txt, copyright notices and whether the data contains personal information |
| User-generated content | Users have not authorised use of their content for training | Specify data-use terms in the user agreement and obtain consent |
| Purchased third-party datasets | Opaque provenance | Require the supplier to provide provenance and authorisation chain |
| Open-source datasets | Licence restricts commercial use | Review each licence (CC-BY, Apache 2.0 and others) for commercial restrictions |
| Employee data | Personal information without consent | Obtain informed consent specifying purpose and rights |
Key points:
- Maintain an inventory of training data assets recording source, acquisition method and authorisation status for each item
- Obtain separate consent for data containing personal information
- Obtain commercial licences for copyright-protected data
- Retain provenance documents for at least three years
Risk two: data flows in API aggregation
Typical scenario: your product calls the API of large model A, passes user data to B for processing, and then passes the result to C for storage — A to B to C, with each segment carrying its own compliance responsibility.
The central question: how is responsibility divided across each segment?
| Stage | Role | Compliance duty |
|---|---|---|
| You to model A | Data provider | Ensure user consent covers the transfer; sign a data processing agreement |
| Model A to B | A acts as processor | Review A’s data processing terms and confirm whether data is used for training |
| B to C | B acts as processor | Confirm B’s security measures and sign a DPA |
| Storage at C | C acts as storage provider | Confirm storage location, encryption and retention period |
Key points:
- Disclose in the user agreement which third parties receive the data
- Sign a data processing agreement (DPA) with each API provider
- Review each API provider’s data processing terms, in particular whether user data is used for model training
- Maintain an API data flow diagram marking the compliance duty at each segment
Risk three: personal information leaked through model output
Description: during training a large model may “memorise” personal information in the training data (names, telephone numbers, identity card numbers). That information may then be output in response to user prompts.
Regulatory risk: breach of the Personal Information Protection Law’s provisions on processing, which may attract fines of up to RMB 50 million or 5% of the previous year’s turnover.
Response:
- At training: de-identify personal information in training data
- At inference: deploy output filtering to intercept outputs containing personal information
- At system level: establish an emergency response mechanism for “personal information leakage through model output”
- At user level: disclose the possible risk in the privacy policy and provide a complaints channel
Risk four: informed consent for automated decision-making
Legal basis: Article 24, Personal Information Protection Law
Where a personal information processor uses personal information to make automated decisions, it shall ensure the transparency of the decisions and the fairness and equity of the results, and shall not apply unreasonable differential treatment to individuals in transaction prices or other transaction conditions. Where information is pushed or commercial marketing is carried out to an individual by way of automated decision-making, an option not targeting the individual’s characteristics shall be provided at the same time, or a convenient means of refusal shall be offered. Where a decision with a significant impact on an individual’s rights and interests is made by way of automated decision-making, the individual has the right to require the processor to provide an explanation, and the right to refuse a decision made solely by automated means.
High-risk scenarios for AI companies:
| Scenario | Compliance requirement |
|---|---|
| AI recommendation systems | Provide an option not targeting the individual’s characteristics |
| AI credit assessment | Retain manual review and provide explanations |
| AI recruitment screening | Must not discriminate; provide manual review |
| AI pricing systems | Must not apply unreasonable differential treatment |
| AI customer service | Provide an option to transfer to a human agent |
Key points:
- Assess whether each automated decision has a significant impact on individual rights
- Provide manual review for decisions with significant impact
- Provide a convenient route for refusing automated decision-making
- Retain explanations of decision logic for regulatory enquiry
Risk five: cross-border data flows
Legal basis: Article 4, Measures for the Security Assessment of Data Export
Circumstances requiring a data export security assessment:
| No. | Circumstance | Threshold |
|---|---|---|
| 1 | Providing important data abroad | No threshold |
| 2 | A critical information infrastructure operator providing personal information abroad | One million individuals or more |
| 3 | A processor handling personal information of one million individuals or more providing personal information abroad | One million individuals or more |
| 4 | Cumulative provision abroad of personal information of 100,000 individuals since 1 January of the previous year | 100,000 individuals |
| 5 | Cumulative provision abroad of sensitive personal information of 10,000 individuals since 1 January of the previous year | 10,000 individuals |
Latest policy position for 2026 (CAC Questions and Answers on Data Export Security Management):
- A non-critical information infrastructure operator that has cumulatively provided abroad the personal information of 100,000 or more but fewer than one million individuals (excluding sensitive information), or sensitive personal information of fewer than 10,000 individuals, may discharge its obligations through certification of personal information export
- Data that should be subject to a security assessment may not be converted to the certification route by splitting volumes or similar means
- Where certification has been obtained but cumulative volumes later reach the security assessment threshold, the company must switch to a security assessment
High-risk scenarios for AI companies:
- Calling an overseas large-model API such as OpenAI, with user data transferred across borders
- Deploying model nodes overseas, with data stored across borders
- Cross-border data sharing within a multinational group
- Training data containing overseas personal information
Compliance checklist
Data classification and grading
| Check | Requirement |
|---|---|
| Has a data classification and grading system been established? | Required by Article 21, Data Security Law |
| Is there a data asset inventory? | Covering training data, user data, employee data and third-party data |
| Are the scopes of important, core and general data clearly defined? | Graded by severity of harm |
| Is model training data included in classification and grading? | A specific requirement for AI companies |
Notice and consent
| Check | Requirement |
|---|---|
| Are processing rules disclosed prominently? | In clear and intelligible language |
| Has consent been obtained? | Particular attention to automated decision-making and cross-border transfer |
| Has separate consent been obtained for sensitive personal information? | Biometrics, religious belief, medical health and similar |
| Does the user agreement explain use of data for AI training? | State clearly whether user data is used for training |
Personal information protection impact assessment (PIA)
| Trigger | Requirement |
|---|---|
| Processing sensitive personal information | A PIA must be carried out in advance |
| Automated decision-making | A PIA must be carried out in advance |
| Entrusted processing, sharing or public disclosure | A PIA must be carried out in advance |
| Cross-border transfer | A PIA must be carried out in advance |
| Significant impact on individual rights | A PIA must be carried out in advance |
Cross-border data transfer
| Check | Requirement |
|---|---|
| Have data export scenarios been identified? | Overseas APIs, overseas storage, cross-border sharing |
| Has the security assessment threshold been reached? | By reference to the four circumstances above |
| Has a security assessment, certification or standard contract been completed? | One of the three; volume splitting is not permitted |
| Have legal documents been signed with the overseas recipient? | A DPA or SCC |
Third-party cooperation
| Check | Requirement |
|---|---|
| Are API providers’ data processing rules reviewed? | Particular attention to whether data is used for training |
| Has a data processing agreement (DPA) been signed? | Setting out each party’s duties |
| Has an API data flow diagram been established? | Marking the compliance duty at each segment |
Compliance timeline
| Timing | Action | Priority |
|---|---|---|
| Week 1 | Establish the data asset inventory and complete classification and grading | P0 |
| Weeks 1–2 | Review the privacy policy and user agreement; add AI training clauses | P0 |
| Weeks 2–3 | Assess data export scenarios and determine the compliance route | P0 |
| Weeks 3–4 | Complete PIAs for sensitive information, automated decision-making and cross-border transfer | P1 |
| Weeks 4–6 | Sign DPAs with API providers and establish the data flow diagram | P1 |
| Weeks 6–8 | Deploy the model output filtering system | P1 |
| Ongoing | Establish a data compliance audit mechanism, once every six months | P2 |
Enforcement cases
Case one: a technology company in Jiangsu (2025) The company operated an “API relay station” calling several large-model interfaces to provide AI dialogue services, without conducting the required security assessment, creating content security risks. The CAC authority verified the breach and took action against the companies concerned.
Case two: the Replika GDPR penalty The Italian supervisory authority imposed an administrative fine of EUR 5 million on Luka Inc., the company behind the Replika AI chatbot, for multiple breaches of the GDPR, including failure to obtain valid consent, failure to provide adequate information and failure to carry out a DPIA.
This article is prepared on the basis of the Personal Information Protection Law, the Data Security Law, the Measures for the Security Assessment of Data Export, the Interim Measures for the Administration of Generative Artificial Intelligence Services and the CAC’s 2026 policy questions and answers on data export. For assistance in building a data compliance system for an AI company, please contact Geason Law Offices.