Deploys a chatbot, in China

Cybersecurity Law of the People's Republic of China (as amended by the Decision of October 28, 2025), Art. 23 · Read the law's page

• This binds a network operator, meaning any organization that owns or manages a network or provides services over one, so it reaches every declared activity and every declared role; the level of protection follows the classification of the network under the classified protection system.
• Formulate internal security management rules and operating procedures, designate a person responsible for network security and put network security protection responsibility into effect (Article 23, item 1).
• Take technical measures against computer viruses, network attacks and network intrusions (Article 23, item 2).
• Monitor and record the network's operating status and security incidents and keep the network logs for not less than six months (Article 23, item 3).
• Take data classification, backup of important data and encryption measures (Article 23, item 4).

Arts. 8 and 13, Provisions on the Management of Network Product Security Vulnerabilities (Ministry of Industry and Information Technology, Cyberspace Administration of China and Ministry of Public Security) · Read the law's page

• Applies to a network operator, meaning the owner or manager of a network or a provider of services over one, so it reaches an app developer that runs its own servers or service (Articles 2 and 8).
• On finding or learning that your network, information system or equipment has a security vulnerability, take measures at once, verify the vulnerability in good time and complete its repair (Article 8).
• Keep a channel for receiving vulnerability information open and unobstructed, and keep the receipt logs for at least 6 months (Article 5).

Data Security Law of the People's Republic of China, Art. 27 · Read the law's page

• This binds any organization or individual engaging in a data-processing activity, regardless of sector, and reaches data generally rather than only personal information.
• Establish and maintain a full-process data-security management system covering the collection, storage, use, processing, transmission, provision, and disclosure of the data you process, and provide data-security education and training to your staff.
• Take the technical measures and other necessary measures appropriate to your processing to keep your data secure.
• Where you process data over the internet or another information network, meet this duty in addition to, not instead of, your classified-protection obligations under the Cybersecurity Law, already this jurisdiction's own deferred network-operator duty.
• If you process important data, an official classification this corpus cannot flag against on its own, designate a person responsible for data security and a managing body, and implement that responsibility.

Data Security Law of the People's Republic of China, Art. 29 · Read the law's page

• Strengthen risk monitoring of your data-processing activity, and on discovering a data-security defect, vulnerability, or other risk, immediately take remedial measures.
• On an actual data-security incident, immediately take disposal measures, promptly notify affected users as provided, and report the incident to the competent authority; the statute states no numeric deadline, only immediacy and promptness.
• This binds the same data processor as this jurisdiction's Data Security Law data-security-program duty; it adds a risk-monitoring and incident-response duty rather than reaching a different party.
• A processor of important data carries an additional, periodic risk-assessment-and-reporting duty under Article 30 tied to the important-data classification rather than to any activity in this vocabulary, so it is not flagged as its own instrument.

Issued by CAC, Ministry of Industry and Information Technology, Ministry of Public Security, and State Administration for Market Regulation on 31 December 2021; effective 1 March 2022

• Disclose your use of recommendation algorithms in your service rules.
• Give users the ability to opt out of personalized recommendations and to view non-personalized alternatives.
• Do not use algorithms to apply unreasonable differential pricing to users.
• Do not use algorithms designed to addict users.
• Do not use algorithms to manipulate public opinion.
• Let users easily turn off algorithmic content curation.
• Register significant algorithms with the CAC.

Provisions on the Administration of Deep Synthesis Internet Information Services (互联网信息服务深度合成管理规定), issued by CAC, MIIT and MPS, 2022, Art. 10 · Read the law's page

• Strengthen your management of deep synthesis content: review your users' input data and synthesis output by technical or manual means, and record and retain the related network logs, if you provide a deep synthesis service.
• Build and maintain a feature database for identifying illegal and undesirable information, with entry standards, rules, and procedures.
• Upon discovering illegal or undesirable information, take disposal measures and preserve relevant records in accordance with law, and promptly report the discovery to the cyberspace administration department and the relevant competent authority. The text marks only this reporting step as prompt, counted from the moment of discovery, and states no separate promptness standard for the disposal and record-keeping steps that precede it.
• Separately take measures against the responsible user, such as warning, restricting features, suspending the service, or closing the account, in accordance with law and your service agreement.

Provisions on the Administration of Deep Synthesis Internet Information Services (互联网信息服务深度合成管理规定), issued by CAC, MIIT and MPS, 2022, Arts. 16-17 · Read the law's page

• Label content your service generates or edits, by a technical measure that does not interfere with normal use
• Apply a prominent public-facing label where the service simulates dialogue or writing, synthesizes or alters voice, generates or swaps faces, or builds immersive simulated scenes
• Retain the log information the Provisions require

Interim Measures for the Management of Generative AI Services (生成式人工智能服务管理暂行办法), 2023, Art. 11 · Read the law's page

• Protect your users' input information and usage records in accordance with law, and do not collect personal information that is not necessary.
• Do not unlawfully retain input information or usage records that can identify a user, and do not unlawfully provide them to others.
• Promptly accept and handle, in accordance with law, individuals' requests to access, copy, correct, supplement or delete their personal information.

Interim Measures for the Management of Generative AI Services (生成式人工智能服务管理暂行办法), 2023, Art. 12 · Read the law's page

• Label generated images, video, and comparable output if you offer generative AI services to the public in China
• Follow the Deep Synthesis Provisions' Articles 16 and 17 for how to label, rather than a separate standard of your own

Interim Measures for the Management of Generative AI Services (生成式人工智能服务管理暂行办法), 2023, Art. 14 · Read the law's page

• Upon discovering illegal content your generative AI service has produced, promptly stop generating it, stop transmitting it, eliminate it, carry out rectification such as retraining the model, and report it to the relevant competent authority, all under the same 'promptly' standard the text sets from the moment of discovery.
• If you discover a user has used the service to engage in illegal activity, warn the user, restrict their access to features, or suspend or terminate their access, in accordance with law and your service agreement.
• Preserve records of that user's illegal activity and report it to the relevant competent authority. The text sets no promptness standard or deadline for this second reporting duty, stating only that it follows discovery.

Regulation on Network Data Security Management (State Council Order 790), Arts. 9-11 · Read the law's page

• Applies to a network data processor, meaning an individual or organization that decides for itself the purpose and means of processing network data, for processing in China (Articles 2 and 62); because that reaches almost any organization running a system, this instrument flags on every activity and role this corpus can express.
• Protect network data on the basis of classified cybersecurity protection: keep data security management rules in place and use encryption, backup, access control and security authentication (Article 9).
• On finding a security defect, vulnerability or similar risk in a network product or service you provide, take remedial measures at once, tell users as required and report to the competent department; where national security or the public interest is endangered, also report to the competent department within 24 hours (Article 10).
• Keep an emergency plan for network data security incidents; when an incident occurs, start the plan at once, act to stop the harm spreading and remove the hazard, and report to the competent department as provided (Article 11).
• Where an incident harms the lawful rights and interests of individuals or organizations, promptly tell those affected the incident, the risk, the harm and the remedial steps taken, by phone, text message, instant message, email or public announcement, unless a law or administrative regulation allows non-notification (Article 11).

Measures for Labeling AI-Generated Synthetic Content (国信办通字〔2025〕2号), issued by CAC, MIIT, MPS and NRTA, 2025, Arts. 4-5 · Read the law's page

• Add a user-perceptible label to AI-generated text, image, audio, video, and virtual-scene content
• Embed a machine-readable identifier in file metadata carrying the generation attributes and your provider name or code
• Check incoming content for labels and add a risk prompt to unlabeled or suspected-generated content, if you distribute content others supply
• Never delete, alter, forge, or conceal a required label

Measures for the Administration of National Cybersecurity Incident Reporting (Cyberspace Administration of China, issued September 11, 2025), Arts. 2, 4, 5, 8, 9, 12, 14 · Read the law's page

• On discovering or becoming aware of a cybersecurity incident affecting your own operations, grade it against China's four-tier National Cybersecurity Incident Classification and Grading Guide (especially major, major, relatively major, ordinary), and report only where you grade it relatively major or above; an ordinary incident carries no report duty under this instrument.
• Where the incident involves critical information infrastructure, report to your sector's protection-work department and to the public security organ within 1 hour of discovering or becoming aware of the incident.
• Where you are a department of a central or state organ, or a directly affiliated unit of one, report to your own department's cyberspace affairs unit within 2 hours of discovering or becoming aware of the incident.for a public body
• Every other network operator must report to the cyberspace administration department of its own province within 4 hours of discovering or becoming aware of the incident.
• Where your industry carries its own reporting rule, also report as your industry's regulator requires, and report a suspected crime to the public security organ promptly.
• Where an organization or individual provides you network-security or system-operation-and-maintenance services under contract, require that provider by contract to promptly report to you any cybersecurity incident it discovers through monitoring, and to assist your own reporting under these Measures; this is the paragraph that reaches a cloud host, managed-security vendor, or AI operator serving you as its customer.
• Within 30 days of completing disposal of a relatively major incident or above, submit a summary report covering the incident's cause, your emergency response, the harm caused, accountability, remediation, and lessons learned, through the same channel you used for the original report.
• This binds a network operator, meaning the owner, manager, or network service provider of a network, that builds or operates a network, or provides a service through a network, inside China; because that reaches almost any organization running a system, this instrument flags on every activity and role this corpus can express rather than a narrower guess.
• A major or especially major incident additionally triggers an escalation between government bodies up to the national cyberspace administration after you report; that further escalation is not a step you perform yourself.
• Taking reasonable and necessary protective measures, disposing of the incident under your emergency plan, effectively reducing its impact and harm, and reporting it promptly as these Measures require can draw lighter treatment, or none at all, of the liability of your unit and its personnel for the incident.

Interim Measures for the Administration of Anthropomorphic Interactive Services of Artificial Intelligence (人工智能拟人化互动服务管理暂行办法), 2026, Art. 14 · Read the law's page

• Do not offer minors virtual-relative, virtual-partner or other virtual intimate-relationship services if you provide anthropomorphic (companion-style) AI interactive services in China.
• Obtain the consent of a parent or other guardian before offering any other anthropomorphic interactive service to a minor under fourteen.
• Provide a minors mode with mode switching, periodic reality reminders and usage-time limits, and support guardian controls: safety-risk reminders, an overview of the minor's use, blocking specific characters and limiting spending.
• Take effective measures, while protecting privacy and personal information, to identify minor users, switch identified minors to the minors mode or apply other measures required by national rules, and provide a channel for appeal.

Interim Measures for the Administration of Anthropomorphic Interactive Services of Artificial Intelligence (人工智能拟人化互动服务管理暂行办法), 2026, Art. 18 · Read the law's page

• Remind users they are interacting with an AI service rather than a person, at first use and again at re-login, if your product simulates a human personality and converses in an emotional style
• Re-notify prominently, by a method such as a pop-up, when the system detects signs of over-reliance or addiction
• Re-notify prominently once continuous use passes two hours
• This reaches companion-style interaction services, not every chatbot or AI-assisted tool