ChinaInterim Measures for the Management of Generative AI Services, Article 11 (user input and usage records)
Interim Measures for the Management of Generative AI Services (生成式人工智能服务管理暂行办法), 2023, Art. 11
In force since .
An AI governance rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Market targeting
- Audit expectation
- none
As of .
What it requires
- Protect your users' input information and usage records in accordance with law, and do not collect personal information that is not necessary.
- Do not unlawfully retain input information or usage records that can identify a user, and do not unlawfully provide them to others.
- Promptly accept and handle, in accordance with law, individuals' requests to access, copy, correct, supplement or delete their personal information.
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Log retention
Article 11 bars unlawful retention outright rather than setting a period, and leaves what makes a retention lawful to other law, so no minimum or maximum value is stated.
- As of
- Basis
- Unspecified
- Prohibits retaining
- Input information and usage records that can identify the user, where the provider has no lawful basis to keep them; the provider also may not unlawfully provide them to others.
Logging duty
Article 11 states no duty to create, keep or produce a log or record. It limits what a provider may keep: it may not unlawfully retain input information and usage records that can identify the user (使用记录, usage records), and may not unlawfully provide them to others. Article 14, second paragraph, of the same Measures separately requires a provider to preserve records of a user's illegal activity, and Article 19 gives the competent authorities an on-request inspection power over training-data and algorithm information; neither sits within Article 11's own text.
- Kind
- None
- As of
What this law does
Article 11 of the Interim Measures for the Management of Generative AI Services requires a provider to perform, in accordance with law, its protection obligations for users' input information and usage records, and bars it from collecting personal information that is not necessary. The article bars a provider from unlawfully retaining input information and usage records that can identify the user, and from unlawfully providing them to others.
A provider must promptly accept and handle, in accordance with law, an individual's request to access, copy, correct, supplement or delete that individual's personal information.
When LexLint raises it
When your app profile says your app generates content with AI or deploys a chatbot.