Glossary of AI Legal Terms in China

The same term often carries different meanings in different settings, and the misalignment shows up in negotiations. This glossary covers fifty concepts that arise in establishment, financing, filing, expansion and disputes. Definitions follow the current rules; the practical note reflects how the point is usually handled.

The terms are grouped into five sections: filing and registration; data and cybersecurity; intellectual property and employment; capital and transactions; cross-border compliance.

I. Filing and registration

Algorithm filing

The obligation of a provider of algorithm recommendation services with public opinion attributes or social mobilisation capacity to file algorithm information, conduct a security self-assessment and publish the relevant information, under the Algorithm Recommendation Provisions.

In practice, establish first whether the service has public opinion attributes or social mobilisation capacity, then whether it is offered to the public. Both must hold. Internal ranking systems usually fall outside.

Generative AI filing

The obligation of a provider offering generative AI services to the public, where the model is self-developed or substantively modified, under the Generative AI Measures.

The test is substantive modification: continued pre-training, large-scale instruction tuning on proprietary data, or a change of base model all count. Packaging an application around an already-filed model usually does not.

Generative AI registration

The registration route for applications that call an already-filed model without substantive modification. Registration is a separate path, not a simplified filing; the materials and the review focus differ.

The common error is filing an application-layer product as a self-developed model, which leaves the materials impossible to prepare; the reverse error is registering a substantively modified model, which is returned.

Algorithm security self-assessment

A required component of algorithm filing, in which the provider assesses algorithm mechanics, data use, content safety and impact on user rights, and produces a report.

Reviewers look for reasoning rather than conclusions. A report that asserts safety without describing the mechanism tends to attract follow-up questions.

Large model security assessment report

The security assessment prepared before launch for generative AI services within the filing scope, covering corpus safety, model output and content management.

It sits on the critical path. Where it is required, the launch date is set by the assessment, not by development readiness.

The statutory trigger for algorithm filing and for security assessment. Neither term is defined, and the assessment is made on the basis of actual service function.

In practice the boundary is drawn by function: content distribution, recommendation at scale, and services capable of shaping public discussion are usually inside; internal tools are usually outside.

Generated content labelling

The obligation to attach a detectable identifier to AI-generated content, and to ensure the identifier does not interfere with normal use.

The obligation is technical. A statement of intent without an implemented mechanism does not satisfy it.

Deep synthesis services

Services that generate or edit text, images, audio or video using synthesis technology, regulated by the Deep Synthesis Provisions.

Filing is triggered by public opinion attributes or social mobilisation capacity, not by the technology itself; but labelling obligations apply more broadly.

Generative AI service provider

An organisation or individual providing generative AI services to the public within China, under the Generative AI Measures.

The test is offering to the public in China. Internal research, services offered only abroad, and closed enterprise deployments usually fall outside — but a customer opening the service to its own end users may bring it back in.

Algorithm filing changes and deregistration

Information changes must be handled within the prescribed period, and service termination requires deregistration, under the Algorithm Recommendation Provisions.

Ten and twenty working days are the periods most often missed. A product taken offline without deregistration tends to surface during annual verification.

Corpus security assessment

The assessment of the lawfulness of training corpus sources and the safety of content, forming part of the filing materials.

The focus is traceability and a complete authorisation chain, not content filtering alone. A filter log without provenance does not establish the assessment.

II. Data and cybersecurity

Personal information protection impact assessment (PIA)

The assessment required before processing personal information in high-risk scenarios, including sensitive information, automated decision-making, entrustment, provision to third parties and cross-border transfer.

It is a precondition rather than a formality: the assessment determines whether the processing may proceed and on what safeguards.

Important data

Data whose damage, loss or misuse may endanger national security, economic operation, social stability or public health and safety.

Identification is industry-specific and often awaits catalogues. Where classification is uncertain, treating data as important until confirmed otherwise is the safer planning assumption.

Data export security assessment

The route for outbound transfers of important data, personal information held by critical information infrastructure operators, and volumes above the statutory thresholds.

It runs in months. Starting after the system goes live converts a scheduling question into a compliance one.

Personal information export standard contract

A contract with the overseas recipient on prescribed terms, filed with the provincial regulator, for transfers within the middle volume band.

Filing is reviewed within ten working days of acceptance; preparation usually takes longer than review.

Personal information protection certification

An alternative to the standard contract for the same volume band, involving assessment by an accredited institution.

It is chosen where the recipient or the group already holds certification, or where a contractual route is impractical.

Cybersecurity classified protection (MLPS)

The tiered security protection regime for network operators, with obligations that scale from level one to level five.

Most AI companies sit at level two or three; the tier determines assessment frequency and remediation requirements.

Critical information infrastructure

Infrastructure identified by regulators in sectors whose disruption may seriously harm national security or public interests.

Operators carry additional obligations, including a mandatory security assessment for any export of personal information.

Delegated processing

Processing carried out by a recipient acting on the instructions of the processor, without determining purpose or means, under the PIPL.

The processor determines purpose and means; the contract must set the scope of instructions, security measures, and return or deletion.

Joint processing

Processing where two or more processors jointly determine purpose and means, with joint liability for damage.

The test is joint determination, not data sharing. Joint modelling, co-marketing and shared user profiles commonly fall inside.

Consent obtained separately for specific scenarios, such as sensitive personal information or provision of information to third parties.

It cannot be bundled with other terms and must state the purpose and necessity on its own.

Data classification and grading

The division of data by importance and by the impact of compromise, with protection obligations attached to each level.

The result is a precondition: it determines the export route, the MLPS tier, and whether the data is important data.

Personal information protection officer

A designated officer required for processors above the prescribed volume, filed with the regulator.

The officer should be able to participate in decisions; a nominal appointment is usually not accepted on inspection.

Training corpus authorisation chain

The documented sequence of licences, procurement and permissions supporting the use of training data.

It cannot be reconstructed after development. Records must be kept while the corpus is assembled.

III. Intellectual property and employment

Model weights

The parameter files produced by training, and one of the core assets of an AI company.

Ownership depends on data rights, compute and personnel. Joint development should allocate weights, licence scope and improvements in advance.

Copyright in training data

Copyright that may subsist in the corpus itself, so that reproduction and use require authorisation or an applicable exception.

The fair-use defence is narrow in commercial training. A verifiable licence chain is more reliable than an argument made after the fact.

Employee personal information protection

The obligation to process employee and applicant information on a minimum-necessity basis, with notice.

Background checks, attendance and workplace monitoring, and retention after departure are the three common failure points.

Open-source licence compliance

Compliance with the terms of open-source licences, including attribution, copyleft and notice requirements.

Copyleft obligations attach to distribution and to certain forms of linking. Internal use usually does not trigger them; a product build may.

Trade secrets

Non-public technical and operational information with commercial value, protected where reasonable measures are taken.

Reasonable measures mean access control, confidentiality agreements and records. Without them, the information is difficult to protect as a secret.

Non-compete

Contractual restrictions on employees joining competitors, subject to scope, duration and compensation requirements.

Enforceability depends on the compensation actually paid and on the scope being proportionate; over-broad clauses are often struck down.

Employee inventions and ownership

The allocation of rights in inventions created in the course of employment, with statutory default rules.

Service inventions belong to the employer by default, but reward and remuneration obligations must be met.

IV. Capital and transactions

Liquidation preference

The right of preferred shareholders to receive a defined amount before ordinary shareholders on liquidation or exit.

The multiple and the participation feature decide the economics in a downside scenario, which is where the clause matters.

Anti-dilution

Protection for investors against dilution from later issues at a lower price.

Broad-based weighted average is the market norm; full ratchet is rare and usually resisted.

Valuation adjustment and repurchase

Mechanisms adjusting valuation on performance or triggering repurchase on agreed events.

Repurchase obligations are only as good as the obligor’s solvency. Enforceability should be tested before signature, not after.

Drag-along

The right of a defined majority to compel minority shareholders to join a sale on the same terms.

The threshold and the protections for dragged holders are the points worth negotiating.

Equity incentive and option pool

The reserve of shares for employees, and the terms on which options vest and are exercised.

Pool size affects dilution and valuation; vesting and leaver provisions decide what happens when people depart.

VIE structure

A contractual arrangement replicating equity control where direct foreign ownership is restricted.

It depends on enforceability of the contracts and on regulatory tolerance, both of which should be assessed before reliance.

Red-chip restructuring

The reorganisation of a domestic operating company under an offshore holding structure.

It involves outbound investment, tax and foreign exchange steps, and is difficult to unwind once executed.

Export controls and economic sanctions

Restrictions on the export of controlled technology and on dealings with sanctioned parties.

Classification of the technology precedes any transaction. Assumptions about classification are the usual source of exposure.

EU AI Act risk tiers

The four-tier classification of AI systems under the EU AI Act, with obligations increasing from minimal to unacceptable risk.

Providers placing systems on the EU market must classify first; the tier determines the compliance workload.

V. Cross-border compliance

Closing conditions

Conditions precedent that must be satisfied before a transaction completes.

Compliance remediation is often written in as a closing condition, which makes the timetable depend on the remediation.

Representations and warranties

Statements by the seller about the target company, breach of which triggers indemnity or adjustment.

Data compliance and intellectual property are the focus; the scope should be wide enough to close diligence and narrow enough to be insurable.

Right of first refusal and co-sale

The right of existing holders to acquire shares before an outside sale, and the right of minority holders to participate on the same terms.

They usually appear together; the negotiation turns on exercise periods, notice and exceptions.

Accredited investor

An investor meeting prescribed criteria of risk identification and bearing capacity.

Qualification affects fund structuring and offshore reorganisations, and should be confirmed before closing.

Nominee shareholding

An arrangement in which the registered shareholder differs from the beneficial owner.

The arrangement binds the parties but not third parties, who rely on the register. It is usually unwound before listing.

The application of the GDPR to entities outside the EU that offer goods or services to, or monitor the behaviour of, people in the EU.

The test is targeting — language, currency, marketing and user base — not the location of servers.

Data localisation

Requirements in certain jurisdictions that data be stored domestically, or that specified data not leave the country.

Where it overlaps with export rules, both must be satisfied; one does not substitute for the other.

Deemed export

The treatment of technology provided to a foreign national within the country as an export to that person’s country.

Foreign employees accessing code repositories, remote collaboration and technical demonstrations can all trigger it.

Overseas listing filing

The filing with the CSRC required for an overseas offering or listing by a Chinese company.

It runs in parallel with data export and cybersecurity review; starting late compresses the whole timetable.

CFIUS review

National security review by the Committee on Foreign Investment in the United States for transactions touching US business.

Sensitive technology, personal data and certain real estate can require filing; the assessment belongs at structuring, not after signing.