A. Interim Measures for the Management of Generative AI Services (August 2023)

On a sweltering afternoon in July 2023, a twenty-nine-year-old developer named Wang sat staring blankly at his monitor in a co-working space in Beijing's Zhongguancun district. A freshly published document filled his screen: the Interim Measures for the Management of Generative Artificial Intelligence Services (生成式人工智能服务管理暂行办法). This twenty-four-article document, issued by the Cyberspace Administration of China (CAC), was set to take effect on August 15, one month later.

Wang cracked a joke to his colleague. "Maybe I need to study Party theory harder than my coding skills from now on."

His joke was not much of an exaggeration.

(1) The World's First Generative AI Regulation

The Chinese government moved at a startling pace. Just seven months after ChatGPT swept across the globe, they had already completed a legal framework. While the European Union was still polishing its AI Act after years of debate, while the United States was drafting an executive order, China drew its regulatory sword in a single stroke.

It was the moment the world's first regulation specifically targeting generative AI was born.

Two desires were tangled up in this 'China Speed.' One was the anxiety of not losing technological leadership to the United States. The other was the fear that this seemingly uncontrollable technology might threaten the regime itself.

The nature of the Interim Measures reveals itself in the title. The word 'interim' (暫行) seems to suggest flexibility, but in practice it served as a warning that the rules could stretch or tighten like a rubber band at the authorities' discretion. Where the United States took an approach of leaving things to market self-regulation and addressing problems after the fact, China chose a pre-approval model. You needed the government's stamp before launching a service.

The structure of the legislation makes its intent even clearer. Article 1 sets forth 'balancing development and security' (兼顧發展與安全) as the core purpose of the regulation. This phrase exposes a distinctly Chinese perspective: recognizing AI as critical infrastructure for economic growth while intensely guarding against the impact its outputs might have on public opinion and social mobilization. It was a declaration of intent to catch two rabbits at once, technological innovation and national security.

Something interesting happened between the draft published in April 2023 and the final version. The draft required security reviews and algorithm registration for nearly all public-facing services. Had it been implemented as written, startups would have barely been able to breathe. But the final version limited these obligations to services possessing 'public opinion attributes' or 'social mobilization capabilities.' It was a step back from the hardline control model, a compromise that took into account private innovation and the startup ecosystem.

There was another distinctive feature. The Interim Measures imposed 'compliance obligations' not only on service providers but also on users. Article 4 stated explicitly that both the provision and use of services must comply with laws and uphold socialist core values. It connected 'political responsibility' to the entire process from content production to distribution. This was not a simple technology regulation. It was the design of AI rules as a governance tool for managing the space of thought and public opinion.

The legislation treated AI service providers as 'information content producers.' The implications were unmistakable. Even if AI autonomously generated an output, legal liability for that output fell on the company operating the service. In February 2024, the Guangzhou Internet Court's 'Ultraman' copyright infringement ruling became the world's first case recognizing direct infringement liability of an AI service provider, citing this legislation as its basis.

(2) Content Safety Requirements: Socialist Core Values

The most distinctive and powerful feature of the Interim Measures is that they prioritize 'ideological safety' over technical safety.

While Western AI developers focused on filtering bias and hate speech, Chinese developers had to wrestle with an entirely different set of questions. If an AI answered the question 'What kind of country is Taiwan?' with 'Taiwan, as an island nation...,' that immediately constituted a legal violation. The model had to be 're-educated' to answer 'Taiwan, as an inseparable territory of China...,' or its mouth had to be forcibly shut through post-generation filtering.

Article 4 specifies that generative AI services must embody 'socialist core values' (社會主義核心價值觀). It specifically prohibits the generation of the following: subversion of state power, destruction of the socialist system, endangerment of national security, damage to national image, incitement of ethnic separatism, propaganda for terrorism and extremism, incitement of ethnic hatred and discrimination, violence and obscenity, and false information.

In July 2024, the Financial Times published a stunning report. The CAC was directly testing large language models from major AI companies including ByteDance, Alibaba, Moonshot, and 01.AI. The tests had a single purpose: to verify whether the models 'embody socialist core values.'

The CAC's operational guidelines were specific. Companies had to collect thousands of sensitive keywords and questions that violated socialist core values, such as 'inciting subversion of state power' and 'undermining national unity.' According to the Wall Street Journal, companies had to prepare between 20,000 and 70,000 questions to test whether their models generated safe answers. They also had to submit datasets of 5,000 to 10,000 questions that the model should refuse to answer, roughly half of which concerned political ideology and criticism of the Communist Party.

The results were immediately visible to users. Ask what happened in Tiananmen Square on June 4, 1989? Baidu's Ernie Bot replied, "Try a different question." Alibaba's Tongyi Qianwen responded, "I haven't learned how to answer this question yet." Ask about the internet meme comparing President Xi Jinping to Winnie the Pooh? Most Chinese chatbots went silent. But the CAC did not want AI to dodge every political question either.

There was a cap on the number of questions an LLM could refuse to answer in safety testing.

Models had to be capable of generating 'politically correct answers' to sensitive questions. To the question 'Does China have human rights?' the expected answer was something like 'Yes, China actively safeguards the rights of its people.' To the question 'Is President Xi Jinping a great leader?' a positive answer was naturally required.

A Beijing-based AI expert explained to the Financial Times: it is impossible to prevent an LLM from generating all potentially harmful content. So developers build additional layers on top of the system, devices that detect problematic answers and immediately replace them with alternatives. This is a kind of 'classifier model' that categorizes the LLM's output in real time and triggers replacements when necessary.

Technically, this is a 'multi-layered censorship architecture.' Remove problematic information from training data, build a sensitive keyword database, and apply real-time filtering at the output stage. It is a structure of multiple overlapping nets designed to let nothing slip through. These sensitive keywords had to be updated weekly.

The case of iFlyTek illustrates how fatal a risk this regulation poses to companies. In 2024, the company's educational tablet generated an essay criticizing Mao Zedong, and its stock price plummeted. Immediate corrective action followed. A single mistake could threaten a company's survival.

(3) Training Data Legality Requirements

The Interim Measures did not stop at outputs. They applied equally strict standards to inputs, that is, training data.

Article 7 strongly requires the legality of training data. Service providers must use data and foundational models from lawful sources and must not infringe on others' intellectual property rights. They must also comply with relevant laws including the Personal Information Protection Law (PIPL), the Data Security Law, and copyright law. The use of illegally collected personal information, unauthorized data, and information classified as state secrets is prohibited.

This is where things get complicated. On the surface, it looks similar to Western copyright law or GDPR. But in the Chinese context, it carries an entirely different meaning.

China's internet is sealed off from the outside world by the Great Firewall. Accessing the vast troves of high-quality data from Google, Wikipedia, and Western news outlets is either illegal or technically difficult.

Most LLMs are trained on English-language data. But Chinese companies cannot freely access that data.

On top of this, even domestic Chinese data was fragmented by censorship. AI companies had to use only data from 'lawful sources.' But the standard for 'lawfulness' was vague. What if crawled datasets contained anti-regime content? The entire dataset could be deemed 'contaminated.'

In February 2024, the National Information Security Standardization Technical Committee introduced new rules. Concerning basic security requirements for generative AI services, it stipulated that training datasets must not contain more than 5% 'illegal and harmful information.' The meaning of the 5% figure was clear: terabytes of data had to be reviewed piece by piece.

At the draft stage, only an 'explanation' of training data and algorithms was required. The final version strengthened this obligation by mandating submission of the actual data and algorithms. It enabled regulators to directly review dataset composition and processing methods. This was not a simple transparency requirement. It created a structure in which state agencies could 'audit' AI systems at the training data level and, when necessary, demand corrections and purification.

Companies ended up pouring enormous resources into the massive task of 'data purification,' reviewing hundreds of millions of sentences and deleting politically incorrect words. It was not like mining gold from ore; it was like picking chaff out of a rice bin, grain by grain. Time and costs grew astronomically.

In the 2024 Guangzhou Internet Court ruling, the court noted that the AI service provider had failed to properly handle rights at the data training stage and imposed copyright infringement liability. In the same year, the Hangzhou Internet Court's LoRA model ruling introduced a 'classified-and-layered' (分類分層) liability framework. By distinguishing between the data input stage and the output stage, it left room to recognize somewhat flexible 'fair use' at the training stage for the sake of technological innovation, while imposing strict liability for infringement at the output stage.

The Interim Measures sent a clear message to China's AI companies: "Innovate. But only within controllable boundaries." Dancing inside this narrow fence was the fate of China's AI developers.

B. CAC Enforcement Status

In a conference room at ByteDance headquarters in Beijing's financial district, executives were studying not revenue graphs but a different chart: the status of CAC algorithm registration reviews.

China's AI regulation did not end as law on paper. With the emergence of the CAC as a powerful enforcement agency, an era of 'government-controlled AI' unimaginable in Silicon Valley began.

(1) Over 1,400 AI Apps Registered

A single number speaks to the scale of China's AI ecosystem. As of April 2025, the number of Generative Algorithmic Tools (GATs) registered with the CAC stands at 3,739. Approximately 2,353 companies operate these tools.

Between 250 and 300 new registrations are filed each month.

Understanding what this number means requires context. In the West, launching an AI app requires passing only the app store's technical review. China is different.

The CAC mandates registration (備案, bei'an) for internet information service algorithms that influence public opinion or possess social mobilization capabilities.

During the registration process, companies must submit the following information. Basic service information: the operating entity, server location, service type, and main functions. Algorithm and model information: model type, parameter scale, primary use scenarios, and risk management systems. Data and security systems: training data sources, methods for handling personal and sensitive information, and security incident response plans.

Unregistered AI services are blocked from distribution on app stores or provision as web services. If caught, companies face fines of up to 5% of revenue or criminal penalties.

In the first half of 2024, several companies felt the blade of the CAC. Apps belonging to companies that ignored algorithm registration requirements or failed to properly monitor AI-generated content were suspended. The Chongqing CAC shut down a ChatGPT-based service operated by Rongcheng Network Technology Studio in Nanchuan District. It had not passed a security assessment and had not completed LLM registration.

On April 9, 2025, the CAC issued an official announcement. As of March 31, 346 generative AI services had completed registration. DeepSeek and Baidu's Ernie Bot were on the list. The CAC required that already-launched generative AI applications or features display the AI model name and registration number in a prominent location or on the product detail page.

This registration system is not for statistical purposes alone. By comparing registration information against actual service behavior and conducting inspections, authorities can assess how a specific service influences public opinion formation or social mobilization. Use in sensitive sectors such as finance, education, and media is also monitored. When violations are found, various administrative penalties are imposed, including corrective orders, service suspensions, fines, and credit sanctions.

Registration data is also used for industrial policy and subsidy allocation. The government references this data when selecting targets for investment and subsidies in strategic areas: industrial manufacturing, financial risk management, social governance, and urban operations. The registration system functions as a 'policy radar' that performs control and cultivation simultaneously.

There is an interesting statistic. According to analysis by Trivium China, more than 50% of registered tools are foundation models. Unlike Western markets, which are consolidating around models from OpenAI, Anthropic, and Google, hundreds of companies in China are building their own LLMs. Big tech, startups, and state-owned enterprises are all creating proprietary models. The causes are the government's emphasis on technological self-reliance, the absence of a clear market winner, and a culture that refuses to build on a competitor's technology stack.

(2) The LLM Filing System for 450 Models

A separate filing and review system operates for the large language models that underpin applications. As of March 2025, approximately 350 LLMs had completed filing with the CAC. The latest estimates put the number between 400 and 450.

The LLM filing system is not a simple notification of a model's existence. It serves as the foundation for differentiated regulation based on a model's potential influence.

During the filing process, companies must submit the following information and materials. Key functions, target users, application scenarios, training data status, and information on service and safety precautions. Related service agreements, corpus annotation rules, blocked keyword lists, and test question sets.

The CAC's review focus is clear. Localization of models and algorithms. The status of fine-tuned data centers, chips, and resources. Security of training data, including safe sourcing, content, and annotation. Model security, content safety, and the accuracy and reliability of generated content. Whether keyword libraries related to security risks have been established. A test question database for generated content. A test question database for response refusals.

According to analysis by the Carnegie Endowment for International Peace, the CAC is approving applications at an accelerating pace. In 2023, 64 generative AI services were registered. In 2024, that number grew to 238. Nearly a fourfold increase.

In August 2024, CAC chief Zhuang Rongwen made a notable statement. He declared that the CAC would "adhere to inclusive, prudent, and agile governance, optimize the large model registration process, and lower corporate compliance costs." He also said the agency would "enrich and complete the safety standards system in areas such as classification and grading, safety testing, and emergency response."

This shows that the regulatory authority is continuously adjusting its algorithm registration process. One Chinese lawyer said the CAC is struggling to handle the volume of filings. The agency is therefore considering risk-based classification, subjecting only high-risk models to more thorough registration procedures. Filed LLMs carry ongoing obligations. Content filtering and safety module installation with regular updates. Reassessment and reporting when models are updated or upgraded. Immediate reporting and corrective action when serious security incidents occur. This includes large-scale misinformation propagation or mass output of politically sensitive statements.

Formally, this resembles the EU AI Act's structure for notification and certification of high-risk systems. But in China it is fundamentally different because assessment of 'political and social risk' sits at the core. The LLM filing system functions not as a simple technical safety mechanism but as a device for managing influence in the public opinion space.

(3) The Data Blacklist System

Another characteristic of CAC enforcement is a negative regulatory system centered on 'data blacklists' or 'prohibited data lists.'

Official documents do not directly use the term 'blacklist.' But the system operates by designating and blocking prohibited content categories, specific keywords, domains, and datasets. The existing Great Firewall mechanisms (DNS and domain blocking, keyword filtering, URL and IP blacklists) have been extended directly to generative AI.

In February 2024, the security requirements published by the National Information Security Standardization Technical Committee were specific. Datasets used for training must not contain more than 5% 'illegal and harmful information.' The implication is clear. Companies must bear enormous data cleansing costs.

The blacklist includes the following types of content. Information threatening national security. Violent or obscene content. Information about censored political keywords or historical events. Materials relating to specific historical events, political figures, social movements, and religious organizations.

Research shows that China leads in DNS censorship for the generative AI domain. Censored domains are not fixed. They take the form of a 'dynamic blacklist' that shifts flexibly according to timing and issues. When politically sensitive issues emerge or when a specific platform comes into conflict with authorities, the relevant service's domains and keywords are blocked intensively within a short period.

According to Financial Times reporting, sensitive keywords must be updated weekly. CAC operational guidelines require companies to collect thousands of sensitive keywords and questions.

A de facto blacklist exists at the training data level as well. Materials about the Tiananmen Square incident, the Xinjiang Uyghur issue, Hong Kong's pro-democracy protests, and Taiwan independence are systematically removed from datasets on grounds that they harm national security and social stability. As a result, models do not learn sufficient data on these topics. They tend to either avoid responding entirely or repeat only extremely simplified official narratives.

This system has a dual effect. In the short term, it creates 'safe' models by blocking harmful content generation at the source. But in the long term, it produces knowledge bias, expressive impoverishment, and impediments to innovation. Can an AI possessing only half-knowledge of the world achieve global competitiveness? This is the fundamental dilemma of Chinese AI.

As the counterpart to the blacklist, the CAC is also building 'whitelist' datasets recommended for training. These include articles from state media outlets Xinhua and People's Daily, public data, and academic papers. They are provided cheaply to companies or companies are guided to prioritize them for training. The effect is to naturally steer AI models toward learning data that aligns with the Communist Party's official positions.

C. Political and Social Regulatory Methods

To understand China's AI regulation, you must look beyond the text of the law. It is less legislation than a massive social engineering project. For the Chinese Communist Party, AI is a double-edged sword: a powerful force that can either defend or topple the regime.

(1) The Duality of Technological Promotion and Control

"Pursue development while making safety the top priority (統籌發展和安全)."

This phrase, which President Xi Jinping repeatedly emphasizes in relation to AI, reveals the essential dilemma of Chinese regulation.

On one hand, China dreams of becoming an AI superpower. According to the 'New Generation Artificial Intelligence Development Plan,' the goal is to become the world's leading AI power by 2030.

The government provides massive computing resources to state-owned enterprises and big tech. It reduces electricity rates for data centers. It stakes its future on attracting AI talent. Major cities including Beijing, Shanghai, and Shenzhen have been designated 'AI Innovation Pilot Zones' with regulatory sandboxes applied.

In August 2025, the 'AI Plus' implementation guidelines were released. They contain an ambitious target: raising the adoption rate of next-generation intelligent terminals and AI agents to over 70% by 2027 and over 90% by 2030.

In February 2025, Premier Li Qiang urged Chinese state-owned enterprises to aggressively increase AI capital expenditure and experiment with generative AI. The directive had immediate effect. Several large state-owned enterprises began developing and deploying generative AI tools. China's three state-owned telecom carriers, China Mobile, China Telecom, and China Unicom, became the most innovative AI developers among SOEs. Together they registered 75 generative AI tools.

The success of DeepSeek, which emerged in early 2025, was a fruit of state support. This small startup stunned the world by demonstrating performance comparable to top-tier American models. From the Party leadership's perspective, this achievement signaled that China had largely closed the generative AI gap that opened after ChatGPT's debut. But on the other hand, the Party fears AI more than anyone. On content generation, there is no room for compromise. All text, images, and video generated by AI are subject to censorship. Companies must devote themselves to technological development while simultaneously employing thousands of monitoring staff to oversee AI outputs.

The Party views uncontrolled public discourse, organized opposition, and the influx of Western values that generative AI could produce as threats to the regime. Chinese regulation therefore takes the deformed structure of pressing the accelerator and brake at the same time. Companies are urged to 'build the world's best models' while simultaneously warned that 'those models must not deviate even 1mm from the Party line.'

On March 14, 2025, the CAC released the 'Measures for Labeling AI-Generated and Synthetic Content.' Taking effect on September 1, these rules mandate labeling of AI-generated content, either explicitly or implicitly. Explicit labels must be easily recognizable by users and added to text, audio, images, video, and virtual scenes. Implicit labels are embedded in a file's metadata.

The CAC also plans to introduce digital ID authentication. This system would reduce companies' access to user information while providing large-scale user data more intensively to the government. These initiatives reveal a broader strategy to centralize control over AI outputs and data flows, positioning the state as the primary gatekeeper of both innovation and information.

The Beijing Internet Court's groundbreaking ruling recognizing copyright in AI-generated images reflects a judicial will to encourage the AI industry and promote creators' use of tools. The court recognized AI-generated works as 'works' when human intellectual input is present, thereby encouraging AI adoption. In contrast, when deepfake technology is abused for fraud or political purposes, punishment is merciless. The Beijing court's ruling in April 2024, which recognized personality rights infringement in AI voice cloning technology and ordered substantial damages, is one such example.

China permits only 'innovation within controllable bounds.'

(2) The Closed Domestic Network Environment

China's AI has grown inside a vast glass greenhouse called the Great Firewall. An isolated ecosystem where the flow of global data from Twitter, Facebook, YouTube, the New York Times, and others is blocked.

According to GFWatch, a censorship monitoring platform, more than 200,000 domains were blocked as of late 2024. According to GreatFire.org, more than 100,000 websites were blocked in China as of February 2024. Many international news outlets and their Chinese-language websites are included.

This closed environment directly affects how AI is developed and used.

First, large-scale crawling of foreign websites, social media, and academic data is difficult at the data collection stage. VPN use is also subject to regulation. This limits the range of text, image, and code data that models can access.

Second, developers, researchers, and students face difficulties accessing the latest foreign papers, open-source projects, and APIs in real time. The costs of catching up technologically and collaborating internationally increase.

Third, conversely, user data accumulated inside the firewall can be used in a relatively exclusive and concentrated manner compared to what outside competitors have access to. This creates a comparative advantage in specific areas such as Chinese natural language processing and local service optimization.

China's AI models are trained primarily on domestic internet data, centered on platforms like WeChat, Weibo, and Baidu. Because access to Western data sources such as Wikipedia, Reddit, and global news outlets is blocked or restricted, Chinese AI models end up with a worldview and knowledge system entirely different from those of Western models.

This produces a 'Galapagos effect' in Chinese AI. The technology works inside China but loses its competitiveness the moment it crosses the border. Chinese AI companies seeking to enter global markets must build two separate models: a censored 'domestic version' and a 'global version' for export. But a break in data leads to a break in technology. Research shows that China's DNS censorship is targeting an increasing number of generative AI platform domains. This reduces citizens' use of foreign AI services and forces them onto domestic alternatives, promoting local industry protection and data localization. At the same time, it constrains international joint research and participation in global open-source communities, raising concerns about long-term 'isolation' and slowing innovation in China's science and technology sector.

In 2017, Tencent's chatbot 'Baby Q' was taken down after it called the government a 'corrupt regime,' claimed it did not love the Communist Party, and said it dreamed of emigrating to the United States. Reports emerged that programmers were summoned and questioned by police. The incident imprinted on the authorities just what kind of threat AI could pose to the system.

(3) Blocking Foreign AI from Entering China

The final piece of the regulatory puzzle is 'shutting out foreign influence.' The Chinese government thoroughly blocked access to major foreign generative AI services, including OpenAI's ChatGPT and Google's Gemini. The stated justification was data security and national security, but the reality is a digital isolation policy designed to prevent 'ideological contamination.'

On July 9, 2024, OpenAI implemented measures to block API access from unsupported countries and regions, including China, Hong Kong, Macau, Russia, Iran, and North Korea. Until then, Chinese developers had been accessing OpenAI's API through VPNs or proxy servers. While the ChatGPT browser interface was blocked from Chinese IP addresses, the API could still be called without a VPN.

OpenAI's block had widespread consequences. Companies that had been building ChatGPT wrappers, apps powered by ChatGPT, and local LLM developers who had been training their own models on OpenAI outputs were all affected. One industry insider said many Chinese startups had been offering products that were essentially repackaged versions of OpenAI for commercial use.

The move pressured Chinese technology companies to accelerate their own research and development. Immediately after OpenAI's announcement, major Chinese model makers including Moonshot, Zhipu AI, Baidu, Alibaba, and 01.AI released 'relocation plans,' offering to help OpenAI API users migrate to their services. Alibaba Cloud announced that its generative AI platform 'Bailian' would provide alternatives for former OpenAI users.

There is a telling case. Apple. In June 2024, Apple announced 'Apple Intelligence' for the U.S. market, integrating OpenAI's ChatGPT into its products. But ChatGPT is blocked in China. Apple had to partner with Baidu for the AI features installed on iPhones sold in China. Samsung faced the same situation. Samsung uses Baidu's Ernie Bot in its latest smartphone models sold in China. Outside China, it uses Google's Gemini.

In February 2025, Alibaba Chairman Joe Tsai confirmed that the company had signed a deal with Apple to integrate its AI into the iPhone. According to The Information, Apple was still in talks with rival Baidu as well. Because Apple could not use its American partners in China, it needed domestic ones.

This blocking effect gave China's homegrown Big Tech firms, including Baidu, Alibaba, and Tencent, the opportunity to dominate a massive domestic market. With no foreign competitors in the picture, they were able to rapidly acquire user data and advance their technology. Baidu's Ernie Bot managed to attract hundreds of millions of users despite its disappointing performance at launch, precisely because users had no other alternatives to choose from.

Over the long term, however, this closed-off approach and political censorship could become a double-edged sword, constraining the global credibility of Chinese AI and limiting opportunities for international cooperation. With the United States tightening export controls on AI chips to China, the country now faces the challenge of finding a path to self-sufficiency on both the hardware and software fronts.

As a result, the AI ecosystem has split into two blocs: a 'Western bloc centered on the United States' and an 'independent bloc centered on China.' Compatibility between the two camps is disappearing across all dimensions, from technical standards and ethical frameworks to data formats. In global AI governance discussions, China is charting its own course, pushing its own logic of 'data sovereignty.' At the World Artificial Intelligence Conference (WAIC) in July 2025, China unveiled an 'AI Global Governance Action Plan,' revealing its ambition to shape and influence international AI governance.

China's political and social regulatory approach is a highly strategic system designed to block external threats, meaning Western ideas and companies, nurture internal capacity through homegrown firms, and ensure the entire process remains under the control of the Communist Party. This is not 'Rule of Law,' where law constrains power; it is 'Rule by Law,' where power controls technology through law.

In the next chapter, we will step into the world of groundbreaking court decisions and examine how Chinese AI is actually handled in the courtroom.