China's Interim Measures for generative AI services take effect

China's Interim Measures for the Management of Generative Artificial Intelligence Services are rules governing generative AI services offered to the public in mainland China, and they took effect on 15 August 2023. The Cyberspace Administration of China (CAC) and six other central government regulators issued the final text on 10 July 2023, after a draft released for public comment in April.

What it is

The measures cover the use of generative AI technology to provide text, image, audio, video or similar content to the public within mainland China. Development and use that does not provide services to the public falls outside their scope. A provider is any organisation or individual offering such services, including through a programmable interface. Co-issuers include the Ministry of Public Security and the Ministry of Industry and Information Technology.

What it requires

Services with public opinion attributes or social mobilisation capabilities must apply to the CAC for a security assessment, and algorithm filing under the earlier Algorithmic Recommendation Provisions also applies. Providers must take effective steps to improve the quality of training data. They carry responsibilities as producers of online information content and, where personal information is involved, as personal information processors. They may not unlawfully retain input information that identifies a user, pass users' inputs to others, or collect unnecessary personal information. For services originating outside mainland China that break these rules, the national cyberspace authority is to notify the relevant bodies to take technical and other measures.

What security leaders should do

If your company offers a generative AI feature to users in mainland China, confirm with counsel whether it falls in scope and whether a security assessment or algorithm filing applies before launch. Review how the product stores prompts and conversation logs: the limits on retaining identifying inputs and sharing them with others translate directly into retention settings, access controls and vendor contracts. Internal-only tools sit outside the measures as described, but keep the boundary documented in case a tool is later exposed to customers.