On 13 July 2023 the Cyberspace Administration of China, together with the National Development and Reform Commission, the Ministry of Education, the Ministry of Science and Technology, the Ministry of Industry and Information Technology, the Ministry of Public Security and the National Radio and Television Administration, published the Interim Measures for the Administration of Generative Artificial Intelligence Services, effective 15 August 2023. The measures contain eight chapters and twenty-four articles, building a framework that is not lengthy but has clear boundaries, from scope and service rules to training data, supervision and liability.
Their significance lies less in the number of provisions than in treating “generative AI services” as a distinct object within the existing systems of administrative review and content governance. The deep synthesis rules addressed technology application; the Cybersecurity Law addressed network operation; the Personal Information Protection Law addressed personal data. The interim measures answer a different question: when a model generates content for the public, who is responsible, and for what.
Scope
The measures apply to services provided within China that use generative AI technology to generate text, images, audio, video and other content for the public. Research and application of the technology that does not provide services to the Chinese public falls outside.
That boundary deserves repeated reading. It uses “providing services to the public” as the jurisdictional connection, rather than model parameters, training location or place of incorporation. For outbound businesses, overseas deployment and overseas service generally fall outside scope. For domestic businesses, any product open to the Chinese public may be caught, wherever the model comes from.
Tiered supervision and filing
The measures establish tiered supervision and require a security assessment and algorithm filing for generative AI services with public-opinion attributes or social mobilisation capacity. This connects with the rules on algorithmic recommendation and deep synthesis, forming a combined “assessment plus filing” procedure.
In practice, timing is what companies underestimate. A security assessment requires documentation on data sources, model capability boundaries, risk handling and internal security management. Algorithm filing requires service information, algorithm mechanics and a self-assessment report. Neither is complete on submission, and the quality of materials affects progress. Product schedules should place this step before launch, not after.
Training data and labelling
Service providers must conduct pre-training and optimisation in accordance with law, use data and foundation models from lawful sources, not infringe intellectual property, and obtain consent or rely on another lawful basis where personal information is involved.
The measures also require identification of generated content, and labelling of images, video and other generated content in line with the deep synthesis provisions. Labelling is not decoration: it allows users and regulators to distinguish authentic from generated content. For image and short-video products, the position, style and legibility of labels should be settled at the design stage.
Provider responsibilities
Providers must conclude service agreements with users setting out rights and obligations, require real-identity verification, establish complaint and reporting channels, and handle public complaints promptly. On discovering unlawful content, they must stop generation, stop transmission or remove it, and retain records.
The key words in this structure are “discover” and “handle”. A platform cannot rely on technological neutrality to avoid management, nor wait passively for a notice before deleting. For public-facing conversational products, content review, risk keywords, human review and emergency response need to work as a combination.
What can be done before 15 August
First, confirm whether the product provides services to the Chinese public, avoiding a misjudgment of scope. Second, map the sources of training data and foundation models into a verifiable chain of authorisation. Third, assess whether the service has public-opinion or social-mobilisation attributes, and whether assessment and filing are required. Fourth, establish labelling and complaint-handling processes. Fifth, update service terms, privacy policy and minors’ protection measures together.
These five steps need not wait for the effective date. The measures leave only about a month, while assessment and filing often take longer. Preparing early is calmer than assembling materials in mid-August.
For algorithm filing and security assessment, see our algorithm filing service; for data licensing and personal information, see data compliance and intellectual property; for launch documentation, see AI product launch documents.
This article is based on the Interim Measures for the Administration of Generative Artificial Intelligence Services published by seven authorities on 13 July 2023. It is for reference only and does not constitute legal advice.