China's CAC finalizes generative AI rules reaching overseas and API providers

China's Cyberspace Administration (CAC), joined by six other central government regulators, issued finalized measures aimed at regulating the provision of generative AI services to the public of mainland China on July 10, 2023.

The finalized text also added a new article addressing generative AI services that originate from outside mainland China, and the rules took effect on August 15, 2023.

What it is

Article 2 of the finalized text states that these measures apply to the use of generative AI technologies to provide services to the public in the mainland PRC for the generation of text, images, audio, video, or other content.

A legal analysis of the finalized text states that the requirements of this regulation will apply to domestic companies and to overseas generative AI service providers offering generative AI services to general public in China.

The measures place obligations mainly on service providers, a category that a law firm analysis of the text says includes technical supporters providing direct service providers with access to generative AI technologies through APIs.

What it requires

Providers must use data and foundational models that have lawful sources for pretraining and optimization training.

They must enter into service agreements with registered generative AI service users which specify the rights and obligations of both parties.

Providers must also tag generated content such as photos and video as pursuant to the Administrative Provisions on Deep Synthesis of Internet-based Information Services.

Services with a public opinion attribute or social mobilisation ability must carry out a safety assessment obligation and go through separate record-filing formalities under the Algorithm Provisions, according to the measures.

For services provided from outside mainland China, Article 20 of the finalized text provides that the state cybersecurity and informatization department shall notify the relevant organs to employ technical measures and other necessary measures to address it.

A legal analysis of the measures explains that the CAC and relevant authorities can inform generative AI service providers who are outside China and providing generative AI services in the territory to take technical or other necessary measures if they are not compliant with relevant Chinese laws and regulations.

What security leaders should do

Any vendor or API-based technical supporter whose generative AI product reaches mainland Chinese users should map each offering against the public-facing-service scope described above, since internal research never offered to the public falls outside the measures. Compliance and security teams should document training-data provenance and build the service-agreement, content-labeling, and input-confidentiality controls these measures describe before launch rather than after a CAC inquiry. Teams running services with recommendation, search, or distribution features should assess whether those features could be read as carrying public opinion or social mobilization capability, since that triggers the separate security-assessment and algorithm-filing track. Legal and security leads overseeing offshore infrastructure that serves China-based users should also track how the extraterritorial notice-and-technical-measures provision might be applied, given it gives Chinese authorities a basis to act against non-compliant services hosted abroad.