Mainland China

《中华人民共和国网络安全法》

• Network construction, operation, maintenance and use in mainland China
• network operators, providers, critical information infrastructure operators, regulators and other network-data actors.

Build network-security controls, data-security governance, incident reporting/response, access control, logging, supply-chain and platform security. A service’s AI model or deepfake controls do not displace the baseline duties of the network operator.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

《中华人民共和国数据安全法》

• Data-processing activities in mainland China and specified extraterritorial activities affecting China’s national security or public interests
• data processors, organizations and regulators.

Classify data identify whether a dataset or output record is important data apply security controls, access governance, backups, incident handling and risk assessments maintain records sufficient to demonstrate lawful handling. Do not assume that removing names makes biometric or identity data non-sensitive in every context.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

《中华人民共和国个人信息保护法》

• Personal-information processing in mainland China and specified processing outside China involving individuals in China
• personal-information processors, entrusted processors, recipients, public bodies and individuals.

Lawful, legitimate, necessary and transparent processing purpose limitation and data minimization notice and consent or another statutory legal basis special rules for sensitive information and minors security measures breach response and notification processor/entrusted-processing controls impact assessments for high-risk processing individual rights restrictions on automated decision-making and discriminatory outcomes deletion/retention controls and restrictions on overseas provision.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

《网络数据安全管理条例》; State Council Order No. 790

• Network-data processing and security in mainland China
• network-data processors, personal-information processors, platforms, regulators and organizations handling important data.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

《互联网信息服务管理办法》; State Council Order No. 292

• Internet information services provided in mainland China, including operating and non-operating services.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

《网络信息内容生态治理规定》; CAC Order No. 5

• Network-information-content producers, service platforms, users, industry organizations and regulators in mainland China.

Maintain content standards, moderation escalation, user complaint/reporting channels, records and remediation treat deepfake impersonation, fraud, reputational harm and false information as content-governance risks even where a separate AI rule does not apply.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

《互联网信息服务算法推荐管理规定》

• Providers using algorithmic recommendation technology to deliver internet information services in mainland China. The definition covers generation/synthesis, personalized recommendation, ranking/selection, retrieval/filtering and dispatch/decision algorithms.

Establish algorithm-security and content-management systems respect user rights, including choice/management of recommendation services address algorithmic discrimination, excessive personalization and inducement protect minors maintain logs handle complaints cooperate with inspections and perform filing for services with public-opinion attributes or social-mobilization capability.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

《互联网信息服务深度合成管理规定》

• Applying deep-synthesis technology to provide internet information services in mainland China. Actors include deep-synthesis service providers, technical supporters, content-distribution platforms, users and regulators.

Establish and implement information-security management systems and technical safeguards. Perform real-identity authentication and related user management. Review and manage generated/edited content, deal with unlawful information and establish rumor clarification mechanisms. Add hidden technical indicators/metadata to generated or edited content, and add prominent visible labels where content could cause public confusion or mistaken identification. For services with public-opinion attributes or social-mobilization capability, complete algorithm filing and other required procedures conduct security assessment before launching relevant new products, applications or functions where required. Platforms that disseminate content must verify and manage labels and cooperate with investigations.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

《生成式人工智能服务管理暂行办法》; CAC, NDRC, MOE, MOST, MIIT, MPS and NRTA Order No. 15

• Providers serving the public in mainland China with text, images, audio, video or other generative outputs. R&D and internal enterprise/research uses that do not provide a public service in mainland China are outside the rule’s specified public-service scope, subject to other laws and rules.

Follow lawful, accurate and reliable service requirements and prohibited-content rules. Manage training-data collection and processing, including lawful sources, intellectual-property and personal-information requirements, data quality and data labeling. Establish content-security, complaint/reporting and user-management systems take timely measures against unlawful content and correct model/service defects. Protect user input and usage records and prevent unlawful collection or use of personal information. Take measures against minors’ overreliance or addiction. Mark image/video and other applicable generated content according to the deep-synthesis rule, now supplemented by the 2025 labeling measures and GB 45438-2025. Services with public-opinion attributes or social-mobilization capability must undergo the required security assessment and algorithm filing/change/cancellation filing. Cooperate with inspections and explain training-data source, scale, type, labeling rules and algorithm mechanism when lawfully required.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

《人工智能生成合成内容标识办法》

• Network-information service providers that fall within the algorithm-recommendation, deep-synthesis or generative-AI rules
• generation/synthesis service providers, content-distribution providers, app-distribution platforms and users.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

《人脸识别技术应用安全管理办法》; CAC/MPS Order No. 19

• Organizations and individuals applying facial-recognition technology to process face information in mainland China
• personal-information processors, public-place operators, service providers and regulators.

Have a specific purpose and sufficient necessity comply with PIPL and perform a personal-information protection impact assessment. Where the same purpose/business requirement can be met by a non-face method, do not use facial recognition as the sole verification method, unless another law provides otherwise. Do not mislead, defraud, coerce or induce people to accept facial verification. Public-place face-recognition devices must be necessary for public security, operate within a reasonably defined collection area and display prominent notice. Do not install them inside private spaces in hotel rooms, public bathrooms, public changing rooms and similar locations. Apply access control, encryption or other security measures manage storage, use, deletion and entrusted processing. When stored face information reaches 100,000 people, file with the provincial-level or higher local cyberspace administration within 30 working days file changes and termination as required.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

《国家网络身份认证公共服务管理办法》

• National network-identity public service platform, individuals, internet platforms and the responsible government departments.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

《互联网用户账号信息管理规定》

• Internet information service providers and users who register, use or manage account information in mainland China.

Real-identity authentication for specified account and publishing/messaging services account-information verification and management. Verify professional, institutional and certification claims where applicable prevent false, fabricated, impersonated or misleading account information. Platforms must maintain content-security, ecosystem-governance, emergency-response, privacy and account-credit systems, and handle complaints/reporting. Display IP-address region information within the required reasonable scope and disclose specified public-account operating information.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

《中华人民共和国反电信网络诈骗法》

• Prevention, restraint and punishment of telecom and online fraud
• telecom businesses, financial institutions, internet service providers, users, law-enforcement and other government bodies.

Internet platforms and relevant service providers should maintain anti-fraud systems, cooperate with investigations and respond to risk signals, while ensuring lawful data use and legitimate-user protections. An AI-generated voice or video becomes an anti-fraud issue when used as part of a fraudulent scheme the statute does not create a general requirement that every content provider deploy a specific deepfake classifier.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

《中华人民共和国反洗钱法》

• Financial institutions and other obligated entities, regulators, persons and organizations involved in money laundering and related crimes.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

《金融机构客户尽职调查和客户身份资料及交易记录保存管理办法》; PBOC/NFRA/CSRC Order [2025] No. 11

• Covered financial institutions and regulated financial businesses
• PBOC, National Financial Regulatory Administration, CSRC and related authorities.

Apply a risk-based customer-due-diligence program and understand the customer, beneficial owner, transaction purpose and transaction nature. Address non-face-to-face/new-technology business, higher-risk customers/transactions, third-party due diligence, wire transfers, agents and beneficial owners. Maintain customer-identity materials, beneficial-owner information and due-diligence records securely, accurately, completely and confidentially. Use administrative and technical measures to protect electronic records and personal information and prevent loss, destruction or leakage. Preserve identity materials and transaction records for the periods specified by the rule the official text states that transaction records are generally retained for at least ten years after the transaction ends, subject to the rule’s detailed triggers.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

《网络安全审查办法》

• Critical-information-infrastructure operators, network-platform operators and relevant suppliers/data-processing activities that affect or may affect national security.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

《数据出境安全评估办法》

• Data processors providing important data or personal information collected/generated in mainland China to recipients outside China.

Pre-export risk self-assessment, filing through the provincial CAC where required, contracts/security obligations with the overseas recipient, re-assessment triggers and post-assessment supervision. Model telemetry, account data, biometric signals, fraud data and user prompts can be in scope depending on classification and volume.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

《个人信息保护合规审计管理办法》

• Personal-information processors and professional audit institutions conducting audits in mainland China.

Processors must conduct compliance audits themselves or engage qualified professional institutions when required follow the attached audit guide provide support complete remediation and report where directed. A processor handling the rule’s very-large-volume threshold of more than 10 million individuals must conduct an audit at least once every two years. Professional institutions must be capable, independent enough for the rule’s rotation controls and legally compliant.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

《直播电商监督管理办法》

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.