On 23 September 2026 the Cyberspace Administration of China announced filing information for three generative AI services operating on mobile devices, among them YOYO Claw. Nine days earlier, the filing announcement of 14 September had already counted mobile on-device services separately: of the 124 services that completed national filing between July and August, seven fell within that category. The two announcements, less than two weeks apart, together make one point — on-device generative AI is no longer treated as a new form requiring separate discussion, but has entered the ordinary filing sequence.
Running on the device is not an exemption
The selling point of on-device generative AI is usually expressed as “data never leaves the device”. The phrase invites a misunderstanding: that because the model runs locally and data is not uploaded, the service falls outside the filing regime for generative AI services.
The filing obligation established by the Interim Measures for the Administration of Generative AI Services turns on whether a service provides generative AI capability to the public within the territory and whether it has the attributes of public opinion or the capacity for social mobilisation — not on where the compute is deployed. Putting a model into a handset and completing inference on the device changes the data path, not the nature of the service. The two September announcements, which label and announce “mobile on-device” as a separate category, confirm precisely how the regulator treats it: within the unified system, not as an exception.
The obligations of an on-device product are therefore not reduced by local operation. Data staying on the device does have advantages for personal information protection — it lowers the risk of leakage from centralised storage and may reduce cross-border transfer — but those advantages operate on the data compliance path, not on the filing obligation itself.
Allocation of duties between the model developer and the manufacturer
An on-device AI product is typically a combination of a model party and a device party, and this is where compliance gaps most often arise in practice. Their duties are not the same.
The model developer bears developer responsibility for the model service itself and will usually need to complete national filing. It is also obliged to provide its device partner with the information required for filing, including basic information about the model, the security assessment materials, and an explanation of the boundaries of the model’s capability and its inherent limitations.
The device manufacturer integrates the model into a system or application and provides generative AI functions directly to users. It must confirm the filing status of the model it uses and discharge the disclosure obligation — a point stated expressly in the announcement of 14 September: a generative AI application or function that has been launched shall disclose, in a prominent position or on the product detail page, the filed or registered service it uses, stating the model name and the filing number or launch number. Where the manufacturer has built its own application-layer generation functions on top of the model, local cyberspace administration registration may also be triggered.
A common misjudgment arises here: the device manufacturer assumes that because someone else filed the model, the matter is not its concern. The filing obligation is indeed borne mainly by the model party, but the disclosure obligation is borne by the party that ultimately faces the user. If an on-device function sits deep in system settings with no disclosure at all, the risk falls on the manufacturer, not the model party.
The distinction between filing and registration is equally easily confused in practice. Developing a model oneself and providing the service to the public goes through national filing; calling the capability of a filed model through an API or otherwise to build an application or function goes through local registration. The accepting authorities and material requirements differ, and choosing the wrong channel renders compliance ineffective. On this, see The Difference between Large-Model Filing and Registration.
Disclosure, labelling and version changes
Beyond disclosure, two further steps in on-device services are easily underestimated.
Content labelling and filing are two parallel obligations. Filing addresses market access; labelling addresses the identifiability of generated content. Content generated on the device must likewise carry visible and implicit labels, and local generation is no exemption. For the specific material requirements on labelling, see Checklist of Materials for Generative AI Filing.
Version change is a problem specific to on-device services. Updates to cloud services are completed on the server and the filed information remains relatively stable; on-device models are distributed with system or application OTA updates and iterate frequently. Where the model version or the scope of its capability changes materially, it must be assessed whether this triggers a change to the filed information. Without a process for this step, it is easy to end up in a state where the filed information does not match the version actually deployed — and in an inspection that mismatch is itself the problem.
What this means for each type of company
For the model developer, the normalisation of on-device filing means that partners’ compliance needs must be built into product delivery: filing information, security assessment materials and the explanation of capability boundaries should be provided when the cooperation agreement is signed, rather than left for the device party to request.
For the device manufacturer, the key step is to establish a verifiable process: confirm the model’s filing status, implement disclosure in the product, and assess OTA version changes for compliance. The process is not costly, but the exposure when it is absent is large — it engages filing compliance, content labelling and personal information protection at once, and any of them may be checked directly at launch or on inspection.
The normalisation of on-device filing shows that the regulator’s approach to new forms is to bring them into the existing system as quickly as possible. The question a manufacturer must answer is not whether filing is required, but how responsibility for filing, disclosure and version management is clearly divided between the model party and the device party. That is both a compliance question and a question of contract terms.
For assistance with the filing route for on-device AI, the assessment of registration, and the implementation of disclosure and labelling, see the Algorithm Registration and Large-Model Filing service page. Related reading: the analysis of the Supreme People’s Court opinion on AI disputes provides a systematic account of intellectual property and personality rights risk in generated content.
This article is prepared on the basis of the Announcement on the Publication of Filed Information for Generative AI Services (July to August 2026) of 14 September 2026, the Announcement on the Publication of Filed Information for Three Generative AI Services Provided on Mobile Devices of 23 September 2026, and the Interim Measures for the Administration of Generative AI Services. It is for reference only and does not constitute legal advice. Specific filing and registration requirements are subject to the practice of the local cyberspace administration.