China's AI Ethics Review Measures take effect, mandating risk-based reviews

China's Measures for the Ethical Review of and Services for Artificial Intelligence Science and Technology (Trial) are ten-department rules that establish risk-based ethics review and continuing oversight for covered AI scientific activities. The Measures took effect on March 20, 2026, the day they were issued under notice 工信部联科〔2026〕75号 by the Ministry of Industry and Information Technology and ten other departments.

What it is

The Measures establish an AI-specific system for ethical governance of scientific research, technology development and other covered activities, rather than a new product-approval pathway. Coverage extends to activities conducted within the People's Republic of China that may create ethical risks affecting human dignity, public order, life and health, the ecological environment or sustainable development. Other jurisdictions have also applied risk-based oversight to AI in research settings; the EU's AI Act, formally Regulation (EU) 2024/1689, classifies AI systems used in clinical settings as high risk, requiring increased scrutiny by ethics committees and national authorities.

What it requires

Universities, research institutions, medical and health institutions, enterprises and other organizations conducting AI activities must establish their own ethics committees and protect their independent operation. Review bodies must examine six substantive dimensions, including human welfare, fairness and justice, controllability and trustworthiness, transparency and explainability, accountability and traceability, and privacy protection. General review decisions are due within 30 calendar days after acceptance, while emergency reviews generally finish within 72 hours. Three categories of activity trigger an additional expert re-review stage: human-machine integration with strong human effects, systems capable of public-opinion mobilization or social-awareness guidance, and highly autonomous decision-making in safety- or health-related settings. Approved activities undergo follow-up review generally at intervals not exceeding 12 months, tightened to six months for activities on the expert re-review list. Violations are investigated and penalized under existing instruments such as the Cybersecurity Law, Data Security Law and Personal Information Protection Law, rather than a standalone fine schedule.

What security leaders should do

Security and compliance teams running AI research activities in China should confirm whether an internal ethics committee exists or whether review must be entrusted to a qualified service center. Teams should prepare application materials covering algorithm mechanisms, data sources and risk assessments before activities begin. Organizations should map which projects could trigger expert re-review, since those face shorter follow-up cycles, and treat ethics review as continuing governance rather than a one-time filing.