The documents required for large-model filing fall into two blocks: four sets of basic documents shared with algorithm filing, and five additional items required only for large-model filing. The most common misjudgement is to prepare against the algorithm filing list and submit, only to find on return that the missing part is precisely the additional set.
The conclusion first: large-model filing requires five items beyond algorithm filing
Self-developed models, continued pre-training, large-scale instruction fine-tuning on a company’s own data and replacement of the foundation model all fall on the large-model filing side. Beyond the shared documents, such companies need five additional items:
| No. | Additional item | Content required | Common amendment point |
|---|---|---|---|
| 1 | Security assessment report | More detailed than the algorithm self-assessment report, covering corpus, training, output and resistance to attack across the whole chain | Reusing the algorithm filing template directly, so that risk items do not match the model’s actual capability |
| 2 | Model service agreement | The terms of model use presented to users | Generic disclaimers only, with no mention of generative-content labelling or complaints channels |
| 3 | Corpus labelling rules | Labelling standards for training data and management of labelling personnel | “Manual labelling” stated without specification or quality-control records |
| 4 | List of interception keywords | The keyword library used to intercept unlawful or non-compliant content | The library diverges from actual interception logs |
| 5 | Assessment test question set | A standard test set for assessing model safety | Questions unrelated to the product’s actual scenarios, failing to cover high-risk cases |
The relationship between the two filings and how to classify a given business are set out in What Is the Difference Between Algorithm Filing and Large-Model Filing and Large-Model Filing versus Registration: Three Compliance Routes and How They Apply. This article deals only with documents.
The four sets below are shared by both filings, and each is described with the points to watch in preparation.
Set one: entity qualification documents
Entity qualification documents establish “who you are” and form the first threshold of filing.
| No. | Document | Description | Preparation point |
|---|---|---|---|
| 1 | Scanned business licence | With company seal | Ensure it is valid and that the business scope covers the relevant activity |
| 2 | Identity document of the legal representative | Both sides of the identity card | Must be clearly legible |
| 3 | Identity document of the algorithm security officer | Both sides of the identity card | Must be a formal employee |
| 4 | Description of the organisational structure of the algorithm security department | Department structure chart | Mark the division of duties and reporting lines |
| 5 | Letter of authorisation | Where the legal representative is not handling the matter directly | Signed and sealed by the legal representative |
Common issues:
- Where the business scope does not cover “information technology services” or “artificial intelligence services”, consider changing the scope first
- The algorithm security officer should preferably be the legal or technical lead, with a formal employment contract
- The organisational description should show the independence of algorithm security management duties
Set two: core algorithm documents
This is the core of the filing documents and the part most often returned on review.
2.1 Algorithm description document
The algorithm description must answer four questions: what the algorithm is, how it operates, where it is used, and how data flows.
| Section | Content required | Drafting point |
|---|---|---|
| Basic information | Name, version, type | Use the five categories: generative synthesis, personalised push, ranking and selection, retrieval and filtering, scheduling and decision-making |
| Principles | Basic principles and operating logic | Avoid excessive academic language; describe in terms a reviewer can follow |
| Technical architecture | Model architecture and training workflow | Attach an architecture diagram showing the full data flow |
| Data sources | Training data and input data | State the source, acquisition method and legal basis for each category |
| Application scenario | Product functions and user groups | Specify the product name and functional module |
| Output | Output type and format | Text, images, audio, video and so on |
2.2 Algorithm security self-assessment report (the core and most time-consuming item)
The algorithm security self-assessment report covers six dimensions and represents the largest single workload in document preparation:
Dimension one: data security
| Assessment item | Content |
|---|---|
| Lawfulness of data sources | Source, acquisition method and authorisation status of training data |
| Classification and grading | Whether a classification and grading system is established under the Data Security Law |
| Storage security | Storage location, encryption and access permissions |
| Transmission security | Protocols, encryption schemes and link security |
| Destruction | Destruction mechanism and records |
Dimension two: model security
| Assessment item | Content |
|---|---|
| Training security | Security of the training environment and training data |
| Output security | Output review mechanism and interception of non-compliant content |
| Resistance to attack | Defence against adversarial samples and prompt injection |
| Model updates | Update frequency and update review mechanism |
Dimension three: content compliance
| Assessment item | Content |
|---|---|
| Interception of unlawful content | Rules, interception rates and handling of false positives |
| Content review workflow | Machine and human review, and staffing |
| Content labelling | Labelling mechanism for AI-generated content |
| Protection of minors | Minor mode and content filtering rules |
Dimension four: user rights
| Assessment item | Content |
|---|---|
| Right to be informed | How basic algorithm information is published |
| Right to choose | Options not targeting individual characteristics and means of refusal |
| Complaints | Channels and handling deadlines |
| Data subject rights | Access, correction, deletion and portability |
Dimension five: risk prevention
| Assessment item | Content |
|---|---|
| Risk identification | Risk types and levels identified |
| Risk assessment | Probability and impact |
| Risk handling | Measures, responsible persons and deadlines |
| Risk monitoring | Real-time monitoring and warning thresholds |
Dimension six: emergency response
| Assessment item | Content |
|---|---|
| Contingency plans | Incident classification and response levels |
| Handling process | Detection, reporting, handling, recovery and review |
| Drill records | Frequency and results |
| Incident reporting | Reporting mechanism and deadlines |
Set three: operational and risk-control documents
| No. | Document | Content |
|---|---|---|
| 1 | Manual content review mechanism | Number of reviewers, workflow and standards |
| 2 | Complaints and reporting handling rules | Channels, acceptance deadlines and process |
| 3 | Contingency plan for algorithm security incidents | Incident grading, response levels and process |
| 4 | Rules on content protection for minors | Age identification, content filtering and time limits |
| 5 | Specifications for traceability and labelling of AI-generated content | Labelling method, traceability chain and label placement |
Set four: system attachments
System attachments are the standard-format files required by the filing system:
| Attachment | Content required |
|---|---|
| Algorithm Filing Undertaking | Undertaking that the filed information is true and complete, and acceptance of supervision |
| Statement on Implementation of the Primary Responsibility for Algorithm Security | Responsible persons, responsible department and institutional documents |
| Content Proposed for Publication | Basic algorithm information to be disclosed to the public |
| Other supporting documents | Prompted automatically by the system according to the information entered |
Recommended preparation time
| Document | Recommended time | Difficulty |
|---|---|---|
| Entity qualification documents | One to two days | Mainly document collection |
| Algorithm description document | Three to five days | Requires cooperation from the technical team |
| Algorithm security self-assessment report | Two to three weeks | The most time-consuming, requiring cross-departmental collaboration |
| Operational and risk-control documents | Three to five days | Requires cooperation from the operations team |
| System attachments | One day | Template completion |
| Additional large-model filing documents | Three to four weeks | Requires deep involvement of the algorithm team |
Total preparation time: four to six weeks for algorithm filing, eight to ten weeks for algorithm filing together with large-model filing.
Five ways to improve the chance of passing first time
- Write the algorithm description in plain language — reviewers are not necessarily technical experts; avoid academic phrasing and use flow diagrams instead of prose
- Put numbers in the self-assessment report — rather than stating that “a mechanism has been established”, give figures such as “five reviewers appointed, 100% review coverage”
- Keep the documents consistent with one another — the algorithm type in the description must match the risk analysis in the self-assessment report
- Get the content proposed for publication right — this is disclosed to the public and is difficult to change once published
- Speak to the local CAC office early — provincial offices have local formatting requirements, and early consultation reduces returns
Frequently asked questions
Q: May the algorithm security self-assessment report be drafted by a third party? A: Yes. A third party may assist with drafting, but the filing entity signs and seals the document and bears responsibility. An agency with algorithm filing experience is advisable.
Q: What happens if the documents are returned? A: The return notice states the reasons; the documents are amended item by item and resubmitted. Each return adds roughly two to four weeks to the review period. Around 30% of applications are returned at least once.
Q: Once the filing number is issued, what remains to be done? A: The number must be displayed conspicuously on the website or app, with a link to the published information. Changes to algorithm information must be filed within ten working days, and cancellation within twenty working days where services cease.
Q: We already hold an algorithm filing. Does a new AI function require a new filing? A: Where the new function constitutes a new algorithm service — for example an existing recommendation algorithm with a new generative AI function added — a new algorithm filing is required. Where it is only an iterative optimisation of the existing algorithm, a change filing suffices.
This article is prepared on the basis of the Provisions on the Administration of Internet Information Service Algorithmic Recommendations and the practical requirements of the algorithm filing system at beian.cac.gov.cn. For assistance with filing documents or drafting a self-assessment report, please contact Geason Law Offices.