On 26 December 2025 China’s Ministry of State Security issued a public safety notice on artificial intelligence tools, flagging risks at both the individual and organisational levels.

Three categories of risk

First, deepfakes used to mislead public opinion. The notice notes that AI’s deep-learning algorithms can automatically process data and simulate or forge images, audio and video. Misused or maliciously deployed, this can harm individual rights, social stability and national security. The Ministry said it had found foreign hostile forces generating fake videos with deepfake technology and attempting to spread them domestically.

Second, improper use of open-source AI tools causing data leakage. The notice disclosed a case in which an employee, handling internal documents, improperly used an open-source AI tool; because the computer had public network access enabled by default and no password, internal sensitive material was illegally accessed and downloaded by a foreign IP address.

Third, over-broad permissions granted to large models. The notice reminds users to authorise large-model software permissions prudently, to prevent personal information theft and sensitive data being transmitted abroad.

Why this notice matters to companies

The notice is addressed to the public, but the disclosed case arose in an organisational setting and points to a category of risk companies most easily overlook: employees “feeding” internal material to external AI tools.

In practice the motive is usually efficiency rather than malice — an employee pastes work content into a public large model to process a document, generate a summary or polish text. The problem is that where the material involves trade secrets, customer information, undisclosed operational data or important data, the act itself can trigger three lines at once: data security, personal information protection and confidentiality duties. See our notes on major personal information processor obligations.

Four arrangements companies should make

First, define what may and may not be fed to AI tools. A clear list should set out categories that must not be entered into external AI tools — customer personal information, undisclosed financial data, source code, trade secrets and material bearing on national security.

Second, distinguish public cloud tools from private deployment. For sensitive processing, prefer private deployment or enterprise products bound by data processing agreements, and check the provider’s data retention and cross-border transfer arrangements. See our data compliance service.

Third, put AI tool use into internal policy. Add AI tool use clauses to confidentiality rules, the employee handbook and information security measures, supported by training and a breach-handling mechanism.

Fourth, retain traceable usage records. For internal AI platforms, retain call logs and permission records; for personal use of public tools, rely on policy constraints in place of technical logging. See our note on the AI application ethics and security guideline.

Reporting channels

The notice also published reporting channels: where AI large models are found to steal personal information or transmit sensitive data abroad, reports can be made through the 12339 state security reporting hotline or platform, or directly to the local state security authority. Companies should assess whether an internal finding is a reportable matter, to avoid widening the risk through mishandling. See our note on the AI misuse reporting channel.

The Ministry’s notice moves “AI security” from an abstract technical topic to concrete user behaviour. For companies, the most practical step is not buying more security products but first drawing a clear line on which material must not be fed to AI tools.

This article is based on the Ministry of State Security’s public AI safety notice and public information. It is for general reference only and does not constitute legal advice.