AI Security Wiki
GitHub

Home / China AI Compliance / China (Mainland): Role Guide

China (Mainland): Role Guide

Verification required. Claims on this page about Chinese law were compiled on 7 October 2026 from secondary web sources and from memory of the law. No primary legal text was read, and each claim is tagged [Reported], [Recalled], [Conflict] or [Unverified] as explained on the section home page. Check the primary text before relying on any of them. This is not legal advice.

Use the China AI Regulatory Hub for instrument detail, and the templates in this section.

AI practitioners

For engineers, data scientists and security staff.

  • Implement explicit and implicit labels on generated content, including metadata (CN-T2).
  • Build content moderation and complaint handling for public-facing services.
  • Keep records of training data provenance and legality.
  • Separate the environments and data flows for mainland users, and plan for localisation and transfer rules.
  • Add dependency safeguards and protections for minors to companion-style products.

Product companies

For vendors, SaaS providers and platforms.

  • Check before launch whether you need algorithm or generative AI service filings (CN-T1).
  • Expect local partners and platforms to demand labelling and compliance evidence.
  • If you are a foreign vendor, confirm whether you operate a service in mainland China at all, and consult mainland counsel.
  • Set up an ethics review process for high-risk functions (CN-T3).
  • Avoid claiming an approval or filing that you do not hold.

Auditors

For internal, external and assurance auditors.

  • Rely on mainland legal advice for the criteria, and state the basis in the report.
  • Test for the presence of labels and metadata on a sample of generated content.
  • Check the ethics review minutes and the external expert input.
  • Inspect filing records, including updates made after a material change.
  • Test complaint handling and content review logs.

Implementors

For programme leads, GRC teams, CISOs and DPOs.

  • Create a China overlay on the group standard, and keep it visibly separate from the group text.
  • Assign a mainland compliance owner and a legal advisor.
  • Maintain a tracker of measures (the China AI Regulatory Hub is a starting point) and a filing calendar.
  • Align data residency with business and legal constraints.
  • Run labelling and content review tests every quarter.

Shared evidence list

  • Filing and assessment records
  • Labelling test results
  • Ethics committee minutes
  • Content review and complaint logs
  • Data classification and transfer records
  • Training data provenance

Report limitation sentence for auditors

"Criteria were taken from a regulatory register dated 7 October 2026, compiled from secondary sources and not verified against primary legal text. This report is not a legal opinion."