Shenzhen’s Action Plan for Building an AI Pioneer City addresses cross-border data as a separate item, proposing a data cross-border pioneer role and the construction of a data circulation empowerment centre and a national-level data trading platform. For companies, these arrangements lower circulation and transaction costs; whether data can lawfully leave the country still turns on the three routes established by the March 2024 Provisions on Promoting and Regulating Cross-border Data Flows.
Infrastructure is not a permit
The empowerment centre and the national trading platform address where data circulates and whether the transfer record can be checked. They make it easier for counterparties to verify provenance and authorisation, and give companies a transfer record they can explain externally. But the legality of a cross-border transfer does not change because the transaction took place on a platform. Treating a platform record as an export permit is a common misreading. A platform provides a factual record; the regulator requires a statutory procedure. The two are not interchangeable.
Three routes and exemptions
The Provisions establish security assessment, standard contract and certification as three routes, with exemptions for certain scenarios. The order of application follows the nature and scale of the data: first determine whether important data is involved, then the volume of personal information exported, and finally choose among the available routes. Exemptions address specific scenarios and cannot substitute for a filing once a threshold is met. Splitting a transaction into several contracts, or spreading individuals across different entities, does not change the calculation of cumulative volume.
Important data remains the dividing line
The data patterns of AI companies make the important-data judgment more complex. Training corpora may come from several industries, model parameters and operation logs may contain business information, and aggregated data may acquire new sensitivity. The judgment should rely on sector catalogues, notices from competent authorities and public documents, with the conclusion and basis recorded in writing. Not being designated as important data does not mean no judgment is required; without records, it is difficult to explain the reasonableness of the position in a later review.
The role of the Hetao and Qianhai pilots
Pilots in areas such as Hetao and Qianhai are valuable because they place filing, assessment, contracts and post-transfer supervision within a controlled scope and produce replicable processes. A pilot does not create a new legal exemption; it changes how matters are handled and how efficiently agencies coordinate. For companies outside the pilot areas, the templates and review standards produced there remain useful references. Treating a pilot as a special policy channel tends to lead to underestimating the substantive requirements at filing.
Outbound operations for AI companies
The work starts with a data flow map drawn down to the interface layer: whether training data is sent to an overseas parent or labelling provider, whether inference requests call an overseas model service, whether operation logs sit in an overseas cloud, and whether overseas user data flows back. Each segment should be labelled with data category, volume, recipient and transfer method, and then assessed one by one. At the contractual level, agree with the overseas recipient on purpose, limits on further provision, security incident notification and deletion arrangements. At the technical level, localise or de-identify where possible to reduce the volume requiring filing. Archive every judgment and supporting material for later changes and inspections.
For route analysis and preparation, see data compliance; for recipient arrangements and cross-border agreements, see cross-border data services; for parallel multi-jurisdiction requirements, see multi-jurisdiction compliance.
This article is based on Shenzhen’s Action Plan for Building an AI Pioneer City, the March 2024 Provisions on Promoting and Regulating Cross-border Data Flows, and public information. It is for reference only and does not constitute legal advice.