Direct Answer: What Is the China AI Governance Framework?

China’s AI governance framework now comprises at least 7 distinct regulatory instruments that together form one of the most comprehensive and fast-moving technology governance systems in the world. Since 2021, the Cyberspace Administration of China (CAC, or 网信办, Wǎngxìn Bàn) has published more than 2,000 algorithm filings across three major filing rounds — a number that underscores the scale of compliance already underway. For foreign companies developing or deploying AI, fintech, or algorithmic services in or into China, understanding this framework is not optional: failure to comply can result in fines of up to RMB 1 million, service suspension, and reputational damage. This article answers the core question in depth.

Direct Answer: What Is the China AI Governance Framework?

The China AI governance framework is a layered set of laws, administrative regulations, and departmental rules that govern the development, deployment, and use of artificial intelligence, algorithms, and data-driven services across the Chinese digital economy. It is not a single AI law — unlike the European Union’s AI Act, China has taken a piecemeal, regulatory-first approach, building controls incrementally atop existing cybersecurity and data protection legislation.

At the foundation stand three cross-cutting laws: the Cybersecurity Law (网络安全法, Wǎngluò Ānquán Fǎ, effective 2017), the Data Security Law (数据安全法, Shùjù Ānquán Fǎ, effective 2021), and the Personal Information Protection Law (个人信息保护法, Gèrén Xìnxī Bǎohù Fǎ, or PIPL, effective 2021). Above these sit AI-specific regulations targeting algorithmic recommendation, deep synthesis, and generative AI. The result is a regulatory environment in which virtually any AI-powered product or service — from a news feed to a chatbot to a credit-scoring model — must satisfy filing, security assessment, and content-moderation obligations before and during operation.

For foreign companies, the framework applies extraterritorially where Chinese users are affected, and domestically when a foreign entity establishes a Chinese subsidiary or joint venture. In practice, this means that any foreign fintech, AI, or technology firm offering algorithmic services to users in mainland China must comply — even if its servers are located outside the country.

The Pillars of China’s AI Governance Framework

To understand how the framework operates, it helps to see it as a pyramid built on three statutory pillars, each of which imposes specific obligations relevant to AI services.

Together, these three laws create the legal foundation upon which China’s AI-specific regulations are built. Any AI service that processes personal data (and nearly all do) must satisfy PIPL’s consent and purpose-limitation requirements. Any service that handles “important data” (a category defined under the Data Security Law) must complete a security assessment. Any system that is part of a network infrastructure must meet Cybersecurity Law standards. Foreign companies must map their AI data flows against all three laws as a baseline compliance exercise.

Key AI-Specific Regulations

Above and beyond the three foundational laws, China has enacted a series of AI-specific regulations that directly impose obligations on providers and users of algorithmic and generative AI services. The three most significant are detailed below.

1. Algorithmic Recommendation Provisions (2022)

The Internet Information Service Algorithmic Recommendation Management Provisions (互联网信息服务算法推荐管理规定, Hùliánwǎng Xìnxī Fúwù Suànfǎ Tuījiàn Guǎnlǐ Guīdìng) took effect on March 1, 2022. These provisions apply to any internet information service that uses algorithms to recommend content — including news feeds, search results, product recommendations, short-video feeds, and rankings. Key obligations include:

• Algorithm filing (算法备案, suànfǎ bèi’àn): Providers must file algorithm details with the CAC through the Algorithm Filing System (Art. 24).
• Transparency: Users must be informed when algorithmic recommendations are used, and offered a way to disable personalization (Art. 16).
• User opt-out and explanation rights: Users can request an explanation of how recommendations are generated and can opt out of personalized recommendations (Art. 16–17).
• Content moderation obligation: Algorithms must not generate or disseminate illegal content; providers must establish a content review mechanism (Art. 9).
• Minor protection: Services targeting minors must implement special algorithmic protections (Art. 13).

2. Deep Synthesis Regulations (2023)

The Internet Information Service Deep Synthesis Management Regulations (深度合成管理规定, Shēndù Héchéng Guǎnlǐ Guīdìng) took effect on January 10, 2023. “Deep synthesis” covers AI technologies that generate or edit images, audio, video, and text — including deepfakes, voice cloning, and AI-generated avatars. Key obligations:

• Labelling: All deep-synthesis-generated content must be clearly labelled (水印标识, shuǐyìn biāoshí) so users can distinguish synthetic from authentic content (Art. 16).
• Data compliance: Training data used for deep synthesis models must be obtained lawfully and not infringe on others’ rights (Art. 14).
• Security assessments: Providers must conduct security assessments before offering deep synthesis services (Art. 6).
• No generation of fake news: Deep synthesis must not be used to produce or distribute false and harmful information (Art. 7).

3. Generative AI Interim Measures (2023)

The Interim Measures for the Management of Generative AI Services (生成式人工智能服务管理暂行办法, Shēngchéng Shì Rén Gōng Zhìnéng Fúwù Guǎnlǐ Zànxíng Bànfǎ) took effect on August 15, 2023. These are the most directly relevant rules for companies offering large-language-model-based or generative AI services to users in China. Key requirements:

• Content must promote socialist core values (社会主义核心价值观, shèhuì zhǔyì héxīn jiàzhíguān): Generated content must not subvert state power, undermine national unity, promote terrorism or extremism, incite ethnic hatred, or spread obscenity or violence (Art. 4).
• Training data compliance: Training data must come from lawful sources, must not infringe intellectual property rights, and must not contain discriminatory or biased content (Art. 7).
• Generated content labelling: AI-generated content must be identifiable, typically via watermarks or metadata tags (Art. 12).
• User registration: Service providers must implement real-name user registration (Art. 11).
• Security assessment and filing: Providers must complete a security assessment with the CAC before launching a generative AI service (Art. 6). Algorithm filing also applies (Art. 24 of the Algorithmic Recommendation Provisions, cross-referenced).

Algorithm Filing (算法备案): The Central Mechanism

Algorithm filing (算法备案, suànfǎ bèi’àn) is the single most important procedural obligation in China’s AI governance framework. It functions as a registration system through which the CAC tracks and reviews algorithms used in internet information services. Without filing, an algorithm-based service cannot lawfully operate in China.

The CAC operates a dedicated Algorithm Filing System (互联网信息服务算法备案系统) accessible online. Providers must submit detailed information including:

1. Basic service information (name, type, target users).
2. Algorithmic principles and logic (a description of how the algorithm functions).
3. Training data sources and pre-processing methods.
4. Potential risks and the corresponding risk-mitigation measures.
5. Contact information for the responsible person (安全负责人, ānquán fùzérén) within the organization.

Filing numbers are published in public batches. The CAC released its first batch of algorithm filings in August 2022, covering 30 algorithms. By the third round (released in January 2024), the published list had grown to more than 500 algorithms. As of mid-2025, industry estimates suggest more than 2,000 algorithms have been filed across multiple rounds, spanning categories from news recommendation and search to e-commerce ranking, ride-hailing dispatch, and AI-generated content. The list is searchable by the public, providing a transparency mechanism that also serves as an enforcement tool — companies not on the list risk being identified as non-compliant.

How the Framework Applies to Foreign Companies

Foreign companies face four particular challenges under China’s AI governance framework: extraterritorial reach, entity structure requirements, algorithm filing through a local entity, and heightened scrutiny on cross-border data.

Extraterritorial application

Under PIPL Article 3, the law applies to the processing of personal information of individuals in China by organizations outside China where the purpose is to provide products or services to, or analyze the behavior of, individuals in China. The Generative AI Measures (Art. 2) similarly apply to “providing generative AI services to the public within the territory of the People’s Republic of China.” This means that a foreign AI company offering a chatbot, recommendation engine, or generative AI tool that Chinese users can access — even from servers abroad — falls within scope. In practice, many global firms block Chinese IP access to avoid this exposure, but this is not a viable strategy for companies with a China market strategy.

Local entity and responsible person

To file algorithms, pay fines, and engage with regulators, foreign companies generally must establish a local subsidiary in China. This entity becomes the “provider” (提供者) under the regulations and must appoint a legally responsible security officer (安全负责人). The local entity bears the compliance burden, and the parent company may be held jointly liable in serious cases. The Algorithms Recommendation Provisions (Art. 24) and the Generative AI Measures (Art. 6) both require the provider to be a legally established entity with a clear responsible person.

Algorithm filing through a Chinese entity

Only a Chinese-registered legal entity can submit an algorithm filing. The foreign parent cannot file directly. This means that the Chinese subsidiary must prepare all filing materials, including descriptions of the algorithm’s logic and risk assessments. The subsidiary’s legal representative and security officer must be named. If the parent company develops the algorithm abroad, the Chinese entity must still be able to describe and vouch for it — creating a need for substantial cross-team coordination and documentation.

Cross-border data constraints

AI services that process Chinese user data face additional constraints on cross-border data transfers. The Data Security Law (Art. 31) and PIPL (Art. 38–40) require that transfers of important data or personal information outside China pass a security assessment organized by the CAC, or meet alternative mechanisms such as standard contractual clauses or certification. For AI companies that train models on Chinese data and want to use that data for global model improvement, this is a significant obstacle. The typical workaround is to establish a fully localized AI stack within China.

Penalties for non-compliance

The penalty regime escalates with severity:

• Minor violations (e.g., late filing, incomplete documentation): administrative warnings and fines from RMB 10,000 to RMB 100,000 (approx. USD 1,400–14,000).
• Serious violations (e.g., operating an unregistered algorithm service that generates harmful content): fines of up to RMB 1 million (approx. USD 140,000), confiscation of illegal income, suspension of service, and potential revocation of licenses. The responsible person may face personal fines of RMB 10,000–100,000 (PIPL Art. 66; Generative AI Measures Art. 21).
• Criminal liability applies where violations involve the dissemination of illegal content or data breaches that harm national security or public interests.

Compliance Roadmap for Foreign AI Companies

For a foreign company planning to offer AI services in China, the following step-by-step roadmap aligns with the current regulatory requirements. The timeline assumes 6–12 months from planning to launch, depending on the complexity of the AI service and data flows.

1. Engage local legal and regulatory counsel. The framework changes frequently — the Generative AI Measures are explicitly “interim,” meaning revisions are expected. Retain counsel with specific CAC filing experience. (Month 1)
2. Establish or verify your local entity. If no Chinese subsidiary exists, incorporate one. Ensure the entity’s business scope covers the proposed AI services. Appoint a legally qualified responsible person (安全负责人). (Months 1–3)
3. Map data flows and classify data. Identify all personal information, important data, and training data. Determine which data classification applies under the Data Security Law. Assess whether cross-border transfers are needed. (Months 2–3)
4. Conduct a PIPL impact assessment. For high-risk AI processing, a Personal Information Protection Impact Assessment (PIPIA) is required (PIPL Art. 55). Document the purpose, necessity, risks, and mitigation measures. (Months 3–4)
5. Conduct a security assessment. Before launching, complete a security assessment (安全评估) with the CAC, as required by the Generative AI Measures (Art. 6). This is a substantive review of the model, training data, output controls, and content moderation system. (Months 3–5)
6. File algorithms with the CAC. Submit the algorithm filing through the Chinese entity via the online filing system. Prepare detailed descriptions of algorithm logic, training data, risk controls, and governance processes. Filing numbers are typically issued within 20–30 working days. (Months 4–6)
7. Implement content moderation and labelling. Deploy the required content moderation filters, user opt-out mechanisms, and AI-generated-content labelling (watermarking for deep synthesis and generative AI). (Months 4–6)
8. Establish ongoing monitoring and reporting. Post-launch, the local entity must monitor algorithm performance, handle user complaints regarding algorithmic decisions, and submit periodic compliance reports as required. (Ongoing, from Month 6)

Foreign companies that serve Chinese users from abroad (without a local entity) face a more constrained set of options: either establish an entity and follow the full roadmap above, or restrict access to avoid triggering the regulations. There is no “light-touch” compliance path for algorithm-based services.

Where to Go From Here

Based on what you just read:

• Ready to act? Read [guide: SLUG-TO-BE-FILLED]
• Still comparing? See [comparison: SLUG-TO-BE-FILLED]
• Need numbers? Try [tool: SLUG-TO-BE-FILLED]

— China Gateway 360 —
Remote China market entry support, built around execution.