China does not have a single AI law. Instead, it regulates generative AI through a stack of rules, each written for a specific kind of service and issued mainly by the Cyberspace Administration of China (CAC), the country's internet regulator, together with other ministries. If you use a Chinese chatbot, build on a Chinese model, or just want to understand why Chinese AI apps behave the way they do, these rules explain a lot.
This guide walks through the main rules in the order they arrived, what each one asks companies to do, and how they fit together. It is an explainer, not legal advice.
The short version
As a 2026 overview by MMLC Group puts it, China "has not yet enacted a dedicated 'Artificial Intelligence Law'." Governance runs through general laws on cybersecurity, data and personal information, plus targeted rules. Four targeted rules matter most for generative AI:
- Algorithmic recommendation rules (in effect since March 1, 2022): cover feeds and recommendation systems, and set up the algorithm filing system.
- Deep synthesis rules (in effect since January 10, 2023): cover tools that generate or edit text, images, audio and video, including deepfakes.
- Generative AI measures (in effect since August 15, 2023): the main rulebook for public chatbots and content generators.
- AI content labeling measures (in effect since September 1, 2025): detailed rules for marking AI-generated content.
On top of that, an amendment to the Cybersecurity Law that took effect on January 1, 2026 added a general article on AI.
1. Algorithmic recommendation rules (2022)
The Provisions on the Management of Algorithmic Recommendations in Internet Information Services were aimed at recommendation feeds, not chatbots. They still matter for generative AI because later rules build on them.
Two parts stand out:
- User choice. Providers must tell users when algorithmic recommendation is used and give them options not based on their personal characteristics, or a simple way to turn recommendation off.
- Algorithm filing. Providers whose services have "public opinion properties or capacity for social mobilization" must file details with the regulator within 10 working days of launch. The filing covers items such as the service form, the type of algorithm and an algorithm self-assessment report.
The 2023 generative AI measures later required some generative AI services to file under it.
2. Deep synthesis rules (2023)
The Provisions on the Administration of Deep Synthesis Internet Information Services took effect on January 10, 2023. "Deep synthesis" covers technology that generates or edits text, images, audio, video and virtual scenes.
The key duties:
- Providers must set up management systems for things like user registration, algorithm review, ethics review, data security and fraud prevention.
- Providers must attach marks to content their users create or edit, in a way that does not affect use, and keep logs.
- For services that "might cause confusion or mislead the public," such as smart dialogue or smart writing that simulates a person, providers must add a conspicuous label telling the public the content is generated.
The 2025 labeling measures cite these rules as one of their bases.
3. Generative AI measures (2023)
The Interim Measures for the Management of Generative Artificial Intelligence Services are the core rulebook. They were issued by the CAC and six other agencies and took effect on August 15, 2023.
Who they cover. The measures apply to services that use generative AI to provide text, images, audio, video or other content "to the public" in mainland China. Providing a service through an API counts. Companies, universities and research bodies that develop and use generative AI but do not offer it to the public are outside the measures.
What content is banned. Services must "uphold the Core Socialist Values" and must not generate content that, among other things, incites subversion of national sovereignty or the overturn of the socialist system, endangers national security, harms the nation's image, promotes terrorism, ethnic hatred, violence or obscenity, or spreads "fake and harmful information."
Training data. Providers must use data and foundation models with "lawful sources," must not infringe intellectual property, need consent (or another legal basis) for personal information, and must take steps to improve the "truth, accuracy, objectivity, and diversity" of training data. They also need clear rules and quality checks for human data labeling.
Running the service. Providers must:
- sign service agreements with registered users
- take steps to keep minors from overreliance or addiction
- keep user inputs and usage records confidential, and not illegally retain or share them
- label generated content such as images and video, following the deep synthesis rules
- stop and remove illegal content when they find it, fix the model, and report to regulators
- set up easy ways for the public to complain and report problems
Security assessments and filing. Services with "public opinion properties or the capacity for social mobilization" must pass a security assessment and file their algorithms under the 2022 recommendation rules.
Foreign services. If a generative AI service provided from outside mainland China does not meet the rules, the CAC "shall notify the relevant organs to employ technical measures" to deal with it. This gives the regulator a legal basis to act against noncompliant foreign services.
Penalties. Violations are handled under existing laws on cybersecurity, data security and personal information. Where those laws are silent, regulators can issue warnings, criticism or orders to correct, and can suspend a service if a company refuses or the case is serious.
The word "interim" matters. Article 3 calls for "tolerant and cautious graded management by category," and Article 16 tells regulators to write rules or guidelines "by type and grade." The measures were designed to be built on.
4. AI content labeling measures (2025)
The Measures for Labeling of AI-Generated Synthetic Content, issued by the CAC and three other agencies, took effect on September 1, 2025. They turn the earlier labeling duties into a detailed system with two layers:
- Explicit labels are visible or audible to users: a text notice in or beside text, a voice or sound cue in audio, a conspicuous notice on images, and a notice on a video's opening screen or around the player.
- Implicit labels are hidden in file metadata. They must include information such as the content's attributes, the provider's name or code, and a content reference number. Digital watermarks are encouraged but not required.
The measures also reach beyond the AI companies:
- Platforms that distribute content, such as social apps, must check uploaded files for implicit labels. If they find one, or the user says the content is AI-generated, or the platform detects signs of generation, they must add a visible notice. Depending on the evidence, the notice says the content is, might be, or is suspected of being AI-generated.
- App stores must ask apps whether they provide generative AI services and check their labeling materials.
- Users who post AI-generated content must declare it and use the platform's labeling tools.
A user can ask a provider for content without visible labels. The provider may agree after the service agreement spells out the user's labeling duties, and must keep the related logs for at least 6 months. No one may maliciously delete, alter, fake or hide the labels, or offer tools to do so.
5. The Cybersecurity Law amendment (2026)
The Standing Committee of the National People's Congress passed an amendment to the Cybersecurity Law on October 28, 2025, which took effect on January 1, 2026, according to the decision published in the People's Daily. It added a new Article 20 on AI. In CSET's English translation, the state "supports basic theoretical research in artificial intelligence," the building of training data and computing infrastructure, improved AI ethical norms, and stronger "risk monitoring and assessment as well as security supervision."
The article is a statement of policy direction, not a list of company duties. An overview by MMLC Group calls it the first time AI has received "a dedicated and systematic expression" in the Cybersecurity Law.
How the pieces fit together
A useful way to read the system:
- The general laws (cybersecurity, data security, personal information) set the base duties and most of the penalties.
- The recommendation rules created the algorithm filing system.
- The deep synthesis rules set the first labeling and management duties for generated content.
- The generative AI measures set the full set of duties for public generative AI services: content limits, training data, user protection, security assessments and filing.
- The labeling measures spell out exactly how generated content is marked, and pull platforms, app stores and users into the system.
The newer rules build on the older ones rather than replace them. The generative AI measures point to the deep synthesis rules for labeling and to the recommendation rules for filing. The labeling measures name all three, plus the Cybersecurity Law, as their basis.
These rules govern AI services inside China. Exports are a separate track: see our report on China's proposed export controls on frontier AI models. For a different approach, see our EU AI Act explainer.
What this means if you use Chinese AI
- Content limits are a legal requirement. They are written into the generative AI measures, so a chatbot offered to the public in mainland China has to follow them.
- Labels are expected. On services covered by the labeling measures, AI-generated images, video, audio and some text should carry visible labels and hidden metadata.
- The rules target services, not only models. The measures cover services offered to the public, including through APIs. They do not cover research and development that is not offered to the public.
- Foreign services can face "technical measures." Article 20 of the generative AI measures gives the regulator a legal basis to act against noncompliant services from outside mainland China.
Sources
- China Law Translate: Interim Measures for the Management of Generative Artificial Intelligence Services
- China Law Translate: Measures for Labeling of AI-Generated Synthetic Content
- China Law Translate: Provisions on the Administration of Deep Synthesis Internet Information Services
- China Law Translate: Provisions on the Management of Algorithmic Recommendations in Internet Information Services
- People's Daily: NPC Standing Committee decision amending the Cybersecurity Law (Chinese)
- CSET: Cybersecurity Law of the People's Republic of China, 2025 amended version (English translation)
- MMLC Group: China's AI Legal Framework As At August 2026
