Background
The client is a China-funded AI tool and model aggregation platform serving developers and SMEs with one-stop model and tool access. It aggregates multiple foundation-model APIs on one side and third-party AI tools on the other, and fine-tunes models on user data. As the business scaled, overlapping compliance obligations outgrew an ad-hoc approach.
Key Challenges
- Filing scope: Which algorithms must be filed (algorithm filing vs. deep synthesis filing) by the platform entity was non-obvious, carrying both under- and over-filing risk.
- Data flow: User data forwarded to underlying models required redesign of notice/consent, processor relationships, and liability allocation.
- Overseas adaptation: Southeast Asia expansion required two-way PIPL and local data/AI law alignment plus a data-export path.
- Financing DD: The new round made verifiable compliance assets (filing numbers, safety assessment reports) a DD focus the existing materials could not support.
Geason’s Approach
- Domestic compliance: Managed end-to-end algorithm filing, deep synthesis filing, and generative-AI safety assessment; rebuilt the data-compliance framework (privacy policy, DPA, authorization chains).
- Dual-track overseas: Used Singapore as a hub for PIPL–PDPA alignment, designed the data-export path, and delivered a multi-jurisdiction checklist.
- Investor DD pack: Delivered full internal and clean client-facing compliance asset packs, including a filing-number list and TaaS compliance whitepaper, ready for DD.
The Non-Obvious Judgment
Most aggregators treat “algorithm filing” and “deep synthesis filing” as one item and file only one. Our view: their triggers differ—the former keys on recommendation/ranking functions, the latter on generating/editing faces or voices. Filing by function, not by entity, is the complete regulatory coverage; conflating them is the leading cause of post-launch regulatory interviews. This judgment determined the integrity of the filing scope.
Key Outcomes
- All in-operation algorithm filing and registration obligations were closed, producing a traceable filing-number list.
- The data-compliance and authorization system was rebuilt to support multi-party data flows, with DPAs covering the underlying model-call chain.
- The compliance asset pack (filing numbers, safety assessment reports, TaaS whitepaper) entered the financing DD materials and passed the investor compliance team’s verification.
Client names and commercial data are anonymized. The rules, regulatory procedures and deliverable types described are as they occurred, not simplified.