Case Studies
Below is a selection of published case studies, with client information anonymized, grouped by the type of company you are—covering the foundation-model & compute layer, AI application & product, AI hardware/robots/embodied intelligence, going-global, and investors/financing/M&A: the five types of entities that actually exist across the AI industry from underlying supply to the physical world, from domestic to cross-border, from founding to exit.
What appears here is the portion that can be de-identified and written up. Geason’s full engagement record covers 100+ companies across the AI industry chain; the rest remain confidential.
Each case contains three parts: real challenges (not a restatement of statutes), Geason’s approach (the corresponding regulatory mechanism and deliverables), and the non-obvious judgment (the extra point we see that generalist services miss).
Recurring hard problems we handle
- Filing & access: Algorithm filing, deep-synthesis filing, and generative-AI safety assessment have different triggers; splitting by function rather than entity is the premise of complete coverage.
- Content & labeling: AIGC labeling (GB 45438-2025) is a dual explicit+implicit obligation and must be retained—not “add a watermark.”
- Export & going-global: Data-export paths (security assessment / standard contract / certification) are statutory, not optional—determine before hub selection; US state laws and SEA PDPA require a “jurisdiction matrix,” not a global template.
- Training data & supply side: Training-data authorization must cover the “model training” purpose; compute/Token compliance turns on the secondary-clearing boundary and data export under cross-border compute.
- Hardware, robots & embodied intelligence: The architecture choice of on-device data processing determines the compliance radius; robot compliance centers on liability entity and interaction boundary rather than filing; embodied intelligence stacks safety assessment, liability, and real-world data—frameworks must be built forward-looking.
- Financing & M&A: What investors verify is “verifiable compliance assets” (filing numbers, safety assessments, data ownership, FTO), not “whether there is a compliance department.”
The cases above come from actual engagements; client names and commercial data are anonymized, while the applicable rules, regulatory procedures and deliverable types are actual and not simplified. If your business resembles any case, we welcome a conversation on the specifics.
Client Type
Foundation-Model & Compute-Layer Companies
Companies building models, training data, and compute supply—compliance starts before launch and on the supply side.
Compute / API ServicesA compute-service and API-resale company built a contract system and data-export boundary across GPU leasing, Token billing, and cross-border compute scheduling, mitigating supply-side compliance risk.
Compute Leasing ComplianceToken/API ResaleCross-Border ComputeContract System
The compliance key for compute leasing and Token resale lies at the 'secondary-clearing/unlicensed-operation' boundary and data export under cross-border compute—cheap offshore compute combined with onshore data may trigger data-export obligations, the most overlooked supply-side intersection.
View case →LLM / Foundation ModelA foundation-model company completed LLM filing, generative-AI safety assessment, and corpus-compliance record-keeping before launch, establishing a traceable compliance baseline.
LLM FilingGenerative-AI Safety AssessmentAlgorithm FilingCorpus Compliance
LLM filing and generative-AI safety assessment are two separate procedures—one is registration, the other a risk assessment—and are often conflated; corpus-source compliance is the core evidence of the assessment and must be recorded before training, not patched before launch.
View case →Data Labeling / Training DataAn AI company built a dual copyright-and-personal-information compliance framework across data acquisition, labeling, and open-dataset use, mitigating underlying-asset ownership risk.
Data ComplianceCopyright ReviewOpen-Source LicensingPersonal-Information Protection
The copyright risk in training data is not 'whether there is authorization' but 'whether the authorization scope covers AI training as a purpose'—many open datasets' licenses do not cover model training, the most overlooked underlying landmine.
View case → Client Type
AI Application & Product Companies
Companies building tools, agents, content generation, and digital humans—compliance centers on filing, labeling, and personal-information protection.
AI Digital Human / Digital TwinA company implementing deep-synthesis filing, explicit labeling, and portrait/voice-right authorization across digital-human live-streaming, smart customer service, and brand endorsement.
Deep Synthesis FilingPortrait/Voice RightsAIGC LabelingAdvertising Compliance
Digital-human endorsement requires explicit labeling and must not impersonate a real person; portrait/voice-right authorization must cover the 'synthesis' purpose—many authorizations only cover 'real appearance,' not the digital twin, a high-incidence infringement area.
View case →AI Tools / Model AggregationA China-funded AI tool and model aggregation platform built a verifiable compliance system spanning algorithm filing, deep synthesis filing, generative-AI safety assessment, and overseas multi-jurisdiction adaptation, with an asset pack ready for financing due diligence.
Algorithm FilingDeep Synthesis FilingGenerative-AI Safety AssessmentData ComplianceOverseas Compliance
Under a multi-model aggregation architecture, algorithm filing and deep synthesis filing are two separate obligations; splitting by function rather than by entity avoids the post-launch regulatory interview trap.
View case →AIGC Video GenerationA video generative AI Agent platform completed, pre-launch, the three compliance building blocks: deep synthesis algorithm filing, generative-AI service safety assessment, and AIGC labeling under GB 45438-2025.
Deep Synthesis FilingGenerative-AI Safety AssessmentAIGC LabelingContent Safety
AIGC labeling under GB 45438-2025 is not 'add a watermark'—the boundary between explicit and implicit labeling and the metadata retention period directly determine whether the product passes app-store review.
View case → Client Type
AI Hardware, Robots & Embodied-Intelligence Companies
Companies building smart devices, robots, and embodied intelligence—compliance centers on on-device data processing, safety-liability boundaries, and frontier regulation.
AI Hardware / Smart DevicesAn AI smart-device company built a compliance framework for on-device data processing, data localization, and product safety across camera, wearable, and speaker products.
Product ComplianceData LocalizationDevice CertificationPersonal-Information Protection
The distinctiveness of AI-hardware compliance lies in 'on-device data processing'—obligations like PIPL and data export are determined by whether data is processed on-device or in the cloud; this is the most overlooked yet architecture-locked decision for hardware companies.
View case →Embodied AI / AgentsAn embodied-AI company proactively built safety assessment, a liability framework, and real-world data compliance across the perceive-decide-act loop, seizing the first-mover compliance position in an opening regulatory window.
Frontier RegulationSafety AssessmentLiability FrameworkTraining Data
Embodied intelligence is a frontier with an just-opened regulatory window—it stacks three propositions: generative-AI safety assessment + robot liability + real-world data collection. Existing rules do not yet fully cover it; building safety and liability frameworks earlier means leading when rules land.
View case →Robotics / AutomationA robotics and automation company built a compliance framework for safety-liability entities, human-robot interaction boundaries, and liability allocation across industrial and consumer scenarios.
Product SafetyLiability AllocationHRI ComplianceSector Access
The core of robot compliance is not 'algorithm filing' but 'safety-liability entity and interaction boundary'—when robots collaborate with or autonomously decide, liability attribution and disclosure duties are high-frequency minefields, and industrial special-equipment vs. consumer robots follow different regulatory paths.
View case → Client Type
Going-Global & International Companies
Companies targeting the EU, Southeast Asia, and US markets—compliance centers on multi-jurisdiction alignment and data export.
AI SaaS Going GlobalAn AI SaaS company with domestic R&D and overseas operations built, via a Singapore hub, a compliance architecture spanning data export and multiple jurisdictions (PIPL / PDPA / GDPR / EU AI Act).
Data ExportOverseas ComplianceMulti-JurisdictionPrivacy Compliance
Going-global teams often equate 'data export' with 'sign a standard contract.' Our view: determine the export path type (security assessment / standard contract / certification) first, then choose the hub—reverse the order and the architecture must be rebuilt.
View case →Smart Hardware / IoTA smart-hardware company transmitting user data overseas for operations and analytics completed its statutory PIPL data-export path selection and filing among the three available routes.
Data ExportPersonal Information ProtectionCompliance System
The three data-export routes (security assessment / standard contract / certification) are not 'pick the lightest'—they are statutorily applicable by data nature and volume; a wrong route invalidates all subsequent materials.
View case →AI Product / EU MarketAn AI company entering the EU completed its EU AI Act risk classification, GDPR Data Protection Impact Assessment, and high-risk system obligation mapping.
EU AI ActGDPR ComplianceMulti-Jurisdiction
EU AI Act risk classification determines everything—many Chinese companies build the product as 'high-risk' then remediate, but classification should intervene at design stage, not pre-launch.
View case →AI Product / North America · SEAAn AI product company selling across North America and Southeast Asia built a matrix-based compliance program, avoiding the mistake of covering fragmented jurisdictions with a single template.
US State Law ComplianceSEA PDPAMulti-JurisdictionOverseas Compliance
The US has no unified federal AI law; state laws (e.g., California, Colorado) are fragmented with staggered effective dates; SEA PDPA differs by country—overseas compliance requires a 'jurisdiction matrix,' not one global template.
View case → Client Type
Investors, Financing & M&A Counterparties
Companies and capital in financing, invested, and M&A transactions—compliance centers on verifiable assets, ownership, and pre-transaction obligations (including cross-border data-export verification).
AI Enterprise / InvestmentAn AI company in a new funding round and strategic acquisition consolidated scattered compliance results into a verifiable asset pack and completed equity and data-asset due-diligence cleanup.
Financing & M&A ComplianceEquity StructureDD SupportData Assets
Investors don't DD 'whether you have a compliance team'—they DD 'whether you have verifiable compliance assets': filing numbers, safety assessment reports, data-asset ownership. Those are what enter the deal documents.
View case →AI Company / Financing & M&AAn AI company consolidated patents, software copyrights, training-data ownership, and open-source obligations into a verifiable IP-asset view ahead of financing and M&A, supporting valuation and deal documents.
IP Due DiligenceOwnership ReviewOpen-Source ComplianceValuation Support
AI IP diligence is distinctive in 'training-data ownership' and 'open-source license contagion'—algorithm patents are easy to check, but data ownership and open-source obligations are the easily overlooked, valuation-critical landmines in deal documents.
View case →