China AI Update: CAC Publishes New Generative AI Registration Guidelines for Foreign Developers — Key Takeaways
On March 15, 2025, the Cyberspace Administration of China (CAC, 国家互联网信息办公室, guójiā hùliánwǎng xìnxī bàngōngshì) published a 47-article guideline document titled “Measures for the Registration of Generative AI Services by Foreign-Invested Enterprises” (外商投资企业生成式人工智能服务登记办法, wàishāng tóuzī qǐyè shēngchéng shì réngōng zhìnéng fúwù dēngjì bànfǎ). The document mandates that all foreign developers offering generative AI services to users within mainland China must complete registration with the CAC within 30 calendar days of service launch and submit to an annual third-party audit. This marks the first time China has issued a standalone regulatory framework specifically targeting foreign-invested enterprises (FIEs) operating in the generative AI space, affecting an estimated 180+ foreign-owned AI companies currently active in the Chinese market.
The new guidelines, set to take effect on June 1, 2025, introduce a three-tier compliance system based on monthly active users (MAU), with escalating requirements for data localization, model training disclosure, and content moderation. Foreign developers with over 1 million MAU face the strictest scrutiny, including mandatory source code review and real-time content filtering logs. The CAC has also stipulated fines of up to RMB 500,000 for first-time non-compliance, with potential service suspension for repeat offenders. This regulatory push aligns with China’s broader AI governance strategy under the 2023 Interim Measures for the Management of Generative AI Services, but adds foreign-specific provisions that industry experts say could raise entry barriers by 40-60% for new market participants.
Key Requirements for Foreign Developers
The new guidelines impose six core obligations on foreign AI service providers. First, all training data used for fine-tuning models on Chinese-language content must be sourced from CAC-approved domestic data centers, effectively prohibiting cross-border training data transfers without explicit authorization. Second, foreign developers must appoint a legal representative based in China who holds senior management authority and is responsible for compliance reporting. Third, the CAC requires quarterly submission of model safety assessment reports conducted by an accredited domestic auditing firm — a process that typically costs between RMB 80,000 and RMB 150,000 per assessment.
Additionally, the guidelines mandate the deployment of content safety filters that block at least 12 specified categories of prohibited content, including those related to national security, territorial integrity, and social stability. Foreign developers must also register their AI system’s algorithm with the CAC’s Algorithm Registration System (算法备案, suànfǎ bèi’àn), a process that previously applied only to domestic companies under the 2022 Algorithm Recommendation Management Provisions. Finally, the guidelines require foreign developers to maintain user interaction logs for a minimum of 180 days and provide them to authorities within 72 hours upon request. Failure to meet these logging requirements can result in fines of RMB 100,000 to RMB 300,000 per incident.
Timeline and Implementation Roadmap
The CAC has outlined a phased implementation schedule that gives foreign developers a three-month grace period until June 1, 2025, to achieve full compliance. Companies already operating generative AI services in China as of March 15, 2025, must submit an initial registration application within 60 days — by May 14, 2025 — or face immediate suspension. For new market entrants, registration must be completed before the public launch of any generative AI service. The CAC has also established a dedicated review window of 90 working days for processing foreign developer applications, compared to the standard 45-day review period for domestic companies.
The three-tier compliance system is structured as follows: Tier 1 applies to services with fewer than 100,000 MAU and requires basic registration, data localization for user data only, and an annual self-audit. Tier 2 covers services with 100,000 to 1 million MAU and demands full data localization, quarterly external audits, and partial algorithm disclosure. Tier 3 applies to services exceeding 1 million MAU and mandates complete source code review, real-time content monitoring, and monthly compliance reporting. As of early 2025, approximately 35 foreign-owned AI services operating in China fall into Tier 3, including major international chatbot and image generation platforms serving Chinese-language users.
| Requirement | Domestic Developers | Foreign Developers (New Guidelines) |
|---|---|---|
| Registration filing deadline | Within 10 days of launch | Within 30 days of launch |
| Data localization scope | Personal data only | All training data + user data |
| Third-party audit frequency | Annual | Quarterly (Tier 2 & 3) |
| Algorithm disclosure level | Basic description | Full source code (Tier 3 only) |
| Legal representative requirement | Optional | Mandatory senior manager in China |
| Review period for applications | 45 working days | 90 working days |
| Maximum fine for non-compliance | RMB 100,000 | RMB 500,000 + service suspension |
| User log retention period | 90 days | 180 days |
Implications for Fintech AI Applications
For foreign fintech companies deploying generative AI in China — such as AI-powered credit scoring, robo-advisory, or chatbot-based customer service — the new guidelines carry especially high stakes. The CAC has explicitly stated that AI models used for “financial services involving public funds or credit decisions” will be subject to additional scrutiny under the parallel oversight of the People’s Bank of China (PBOC, 中国人民银行, zhōngguó rénmín yínháng). This means foreign fintech AI developers must satisfy both the CAC’s registration requirements and the PBOC’s financial data security rules under the 2022 Regulations on the Protection of Financial Consumers’ Rights and Interests.
Practically, this dual oversight translates into three concrete challenges. First, foreign fintech AI models that process Chinese credit data must be trained and hosted entirely within China’s national financial data network, prohibiting even indirect cross-border data flows under the Cybersecurity Law’s data localization requirements. Second, any algorithm update that changes credit decision logic must receive pre-approval from both the CAC and the PBOC, a process that typically takes 6-8 months. Third, foreign developers must ensure that their AI system’s output complies with China’s financial advertising regulations, including prohibitions on guaranteed returns and comparative performance claims. A single violation can trigger fines of up to 1% of annual revenue from the affected service line, as stipulated under the 2024 Financial Consumer Protection Measures.
Key Pitfalls to Avoid
Strategic Recommendations for Foreign Developers
The decision framework under these new guidelines centers on your user base and data sensitivity. If your generative AI service has fewer than 100,000 MAU and processes only non-financial data, choose a Tier 1 compliance strategy: file the basic registration, localize user data in a Chinese cloud provider’s Beijing or Shanghai data center, and conduct an annual self-audit using the CAC’s template. This path can be completed within 45 days and costs approximately RMB 50,000–80,000 in legal and setup fees. If your service exceeds 100,000 MAU or handles financial data, choose a Tier 2 or Tier 3 strategy: engage a specialized China regulatory law firm, allocate budget for quarterly external audits (minimum RMB 360,000 annually), and prepare for full algorithm disclosure if you are in Tier 3. The Tier 2/3 path requires 4–6 months of preparation and carries setup costs of RMB 200,000–500,000.
For fintech AI developers specifically, an additional decision point applies. If your AI system directly determines credit eligibility or investment advice, you must also register with the PBOC’s Financial AI Governance Committee — a separate 90-day process. If your AI system only supports internal operations (fraud detection, back-office automation), you can proceed under the CAC alone but must still document that your system does not produce consumer-facing outputs. In either case, begin data localization immediately: Chinese regulatory auditors will request proof of domestic data storage as part of the initial review.
NEXT STEPS
- Audit Your Current AI Compliance Status — Review your service’s MAU, data flows, and existing registrations against the new FIE-specific guidelines. Use our AI Compliance Checklist for Foreign Developers to identify gaps before the May 14 initial filing deadline.
- Engage a CAC-Registered Auditor — Secure capacity now with one of the 12 accredited firms before demand spikes in Q2 2025. Read our guide: How to Choose a CAC-Accredited AI Auditor in China.
- Plan Your Data Localization Architecture — Begin migrating training and user data to Chinese cloud data centers that meet both CAC and PBOC requirements. See our comparison: Top Cloud Providers for Foreign AI Data Localization in China.
— China Gateway 360 —
Remote China market entry support, built around execution.
