CAC's revised Internet Information Service Measures draft adds a dedicated AI chapter

China's Cyberspace Administration of China released a revised draft of the Measures for the Administration of Internet Information Services for public consultation on July 3, 2026.

The revision adds, for the first time, a chapter dedicated to generative AI, marking the first time that generative AI has been comprehensively regulated through an administrative regulation rather than lower-level departmental rules.

What it is

The draft is a rewrite of the Measures for the Administration of Internet Information Services and has expanded from 27 articles in 2000 to 94 articles, almost doubling in size compared with the 54-article draft published for consultation in 2021.

The draft contains two entirely new chapters, one covering platform information services and the other covering intelligent information services.

The new chapter also marks the first appearance of the term AI agents in an administrative regulation.

What it requires

The draft introduces requirements covering training data provenance, mandatory labeling of AI-generated content, prohibitions on tampering with those labels, algorithm registration, and the option for users to disable personalized recommendation systems.

For the first time, an administrative regulation defines what constitutes a large internet platform, with the threshold set at either more than 50 million registered users or more than 10 million monthly active users.

These platforms would face a series of additional obligations, including establishing comprehensive compliance systems, dedicated compliance departments, independent external oversight bodies, 24-hour complaint-handling mechanisms, annual social responsibility reports, reporting major operational changes, and complying with algorithm-related competition rules.

Corporate fines also increase significantly, with the maximum penalty rising from RMB 1 million to RMB 10 million, and individuals directly responsible for violations face fines of up to RMB 1 million and, in serious cases, may be barred from serving as directors, supervisors, senior executives, or information security officers of internet companies.

What security leaders should do

Security and compliance teams building AI products for the China market should begin mapping which services would fall under the new intelligent information services chapter, since training data provenance disclosure and content-labeling integrity appear as distinct draft obligations. Teams should also review how close their user base sits to the proposed large-platform thresholds, since crossing either the 50 million registered-user or 10 million monthly-active-user line would trigger added compliance-department, external-oversight, and 24-hour complaint-handling requirements. Given the draft's dual-liability enforcement model, organizations should identify who internally would bear responsibility for AI-agent and content-labeling compliance failures before the rule is finalized, since individual accountability and higher corporate fines are both proposed.