China's AI rules: 2023 generative AI measures and May 2026 agent guidelines

What the source documents cover

This guide uses three documents. The first is a Library of Congress Global Legal Monitor article dated July 18, 2023, on China's finalized generative AI measures. The second is the Chinese-language text of the AI agent implementation guidelines, published on the website of the Cyberspace Administration of China (CAC) on May 8, 2026. The third is a Xinhua report on the same guidelines, carried by the State Council of China on May 8, 2026.

None of the three documents sets out the deep synthesis rules. The Library of Congress article does not mention them, so this guide does not describe what they require. Anyone who needs that detail has to read the deep synthesis text itself.

The documents also differ in how they name roles. The 2023 measures, as the Library of Congress describes them, define a "provider" and place the obligations on providers. The article does not describe a separate "deployer" category, so this guide does not either.

Who the 2023 generative AI measures cover

The Library of Congress article says that on July 10, 2023, the CAC, joined by six other central government regulators, issued the finalized measures.

On scope, the article says the measures apply to services that generate content for the public in mainland China.

The article also reports an explicit exclusion.

The article quotes the definition of a provider in Article 22. The definition reaches API access: a provider is "any organization or individual" using generative AI technology to provide services, and it names providing them through a programmable interface. That is the route API providers use.

The article reports that the measures take effect on August 15, 2023.

What the 2023 measures require of providers

The article describes three provider obligations.

The first is a security assessment for some services. According to the article, Article 17 requires providers of services "with public opinion attributes or social mobilization capabilities" to apply to the CAC. The article describes the obligation as running in accordance with relevant state provisions.

The second concerns training data. The article says the finalized text requires providers to improve data quality, and it quotes Article 7 on this point.

The third concerns responsibility for content. The article quotes Article 9, which makes providers responsible as producers of online information content.

The article also quotes Article 9 on personal information. Where personal information is involved, providers assume responsibility as a personal information processor, and the article notes that providers must sign service agreements with registered users. This guide does not mark those points further, because the article's full text on them is already given above in summary form.

Overseas services under the measures

The Library of Congress article says the finalized measures add an article on services that originate outside mainland China and are offered to the public in China. This is Article 20. The article describes the consequence of a breach. Where such a service breaks Chinese law, regulations or the generative AI measures, the measures state that the national cyberspace authority shall notify the relevant bodies to apply technical measures.

The article does not say which technical measures are meant, and it does not describe any registration step for overseas providers. This guide therefore adds nothing on either point.

What the May 2026 AI agent guidelines say

The Xinhua report, dated May 8, 2026, says the guidelines were issued jointly by three bodies.

The CAC text opens with a definition. It describes an AI agent as an intelligent system with the ability to perceive, remember, decide, interact and act on its own.

The guidelines list four basic principles. The first is that security and control come first: the text treats safe, reliable and trustworthy agents as a bottom-line requirement across the whole life cycle.

Xinhua adds that the guidelines identify 19 typical application scenarios.

Security and governance items

The security items sit in section three of the CAC text. They include the following.

• User authority (item 6). The text says users keep the right to know about, and the final say over, an agent's autonomous decisions. It also says an agent's actions must stay within what the user has authorized.

• Behavior control (item 7). The text calls for technologies such as embedded rules and behavior fences, so that agents act lawfully in public, private and special-purpose places.

• Built-in security (item 8). The text calls for research on agent security technologies and lists the risks to be prevented, among them data poisoning, privacy leakage, algorithm tampering and loss of control.

• Supply chain (item 9). The text calls for security rules covering the full life cycle and stronger management of model access, API calls and the use of extension tools.

• Misuse (item 10). The text says agents should not be used for automated attacks, privacy violations, false information or online fraud.

• Tiered governance (item 11). For sensitive fields and key industries, the text applies filing, testing and recall of problem products.

• Overseas operations (item 38). The text directs companies to build overseas compliance, so that agents adapt to local laws and customs.

Gaps security teams should note

Three limits apply to what these documents show.

First, the deep synthesis measures are not covered by any of the three documents, so no requirement from them is listed here.

Second, the Library of Congress article is a summary of the 2023 measures, not the full text. It quotes only some articles. Articles on topics it does not mention, such as filing details or user-complaint handling, are outside this guide.

Third, the agent guidelines in the CAC text are written largely as directions to research, explore, promote and improve, with item 11 naming filing, testing and recall measures. The documents given here do not state penalties for failing to follow the guidelines. They also do not say how the guidelines relate to the 2023 generative AI measures beyond what is quoted above. This guide does not fill either gap.