China: AI regulation & deadlines

China PIPL Art. 24 — automated decision-making transparency, opt-out and explanation

Binds Personal information handlers (organisations and individuals that independently determine the purposes and means of processing) processing personal information within China, and — under Art. 3 — handlers outside China processing the personal information of natural persons in China to provide them products or services or to analyse or assess their conduct. 'Automated decision-making' is defined in Art. 73(2) as activities that automatically analyse or assess an individual's behavioural habits, interests or economic, health or credit situation by computer program, and make decisions. Impact tier: all entities.. Personal information handlers using personal information for automated decision-making must ensure the transparency of the decision-making and the fairness and impartiality of the result, and may not impose unreasonable differential treatment on individuals in transaction prices or other transaction conditions. Where information push delivery or commercial marketing is carried out through automated decision-making, an option not targeted at the individual's personal characteristics must be offered at the same time, or a convenient way to refuse must be provided. Where an automated decision has a major effect on an individual's rights and interests, the individual may require the handler to explain it and may refuse a decision made solely by automated means. Art. 55(2) additionally requires a personal information protection impact assessment before any automated decision-making, with the report and processing record kept at least three years (Art. 56).

Text verified in two official versions carrying identical wording of Arts. 24, 55, 66, 73 and 74: the NPC text at http://www.npc.gov.cn/npc/c2/c30834/202108/t20210820_313088.html (http only — npc.gov.cn does not answer on https, so the cited link is the CAC republication) and the Cyberspace Administration of China republication cited here. Commencement is on the face of the statute: PIPL Art. 74 states the Law takes effect 1 November 2021 (adopted by the NPC Standing Committee 20 August 2021). Art. 24 is the general personal-data ADM duty and is distinct from, and cumulative with, China's AI-specific CAC instruments already tracked (cn-genai-interim, cn-deep-synthesis, cn-ai-labelling, cn-anthropomorphic-ai, cn-ai-agents-opinions): the trigger here is personal-information processing, not the provision of an AI service. Note the second paragraph is the statutory basis for the 'convenient refusal' switch that later CAC algorithm rules operationalise, and the first paragraph is the basis for enforcement against algorithmic differential pricing. Coverage-symmetry note (2026-08-15): the CAC Provisions on the Administration of Algorithmic Recommendation in Internet Information Services (in force 1 March 2022) are a separate, not-yet-tracked instrument — logged as a follow-up gap, not merged into this row.

Stated maximum penalty — PIPL Art. 66: order to correct, warning, confiscation of unlawful gains, and an order to suspend or terminate the offending app; if correction is refused, a fine up to RMB 1,000,000 plus RMB 10,000-100,000 on the directly responsible persons. Where the circumstances are serious, a provincial-level or higher authority may confiscate unlawful gains and impose a fine up to RMB 50,000,000 or 5% of the prior year's turnover, order suspension of business or closure for rectification, and notify the competent authority to revoke the business permit or licence; RMB 100,000-1,000,000 on the directly responsible persons, who may also be barred for a period from serving as director, supervisor, senior manager or personal information protection officer. CAC-led enforcement.

CAC Algorithmic Recommendation Provisions — disclosure, opt-out and algorithm filing

Binds Any provider applying algorithmic recommendation technology to supply internet information services within the territory of the PRC (Art. 2). 'Applying algorithmic recommendation technology' is defined as using generative/synthetic, personalised push, ranking and selection, retrieval and filtering, or scheduling and decision-making algorithms to provide information to users — a definition wide enough to cover feeds, search ranking, content moderation filters and platform dispatch systems, not only recommender feeds. The filing, disclosure-number and security-assessment duties in Arts. 24, 26 and 27 bind only the subset of providers with public-opinion attributes or social-mobilisation capacity. Impact tier: all entities.. Providers of internet information services that use recommendation algorithms must tell users conspicuously that an algorithmic recommendation service is being provided and publicise its basic principles, purpose and main operating mechanisms (Art. 16); offer an option not targeted at the user's personal characteristics or a convenient way to switch the recommendation service off, and let users select or delete the personal-characteristic tags used for recommendation (Art. 17); periodically review, assess and verify the algorithm's mechanisms, models, data and outputs, and not deploy models that induce addiction or excessive consumption (Art. 8); and label unlabelled algorithmically generated or synthesised information before further transmission (Art. 9). Providers with public-opinion attributes or social-mobilisation capacity must additionally file with the CAC internet information service algorithm filing system within 10 working days of starting service — submitting the provider name, service form, application field, algorithm type, algorithm self-assessment report and the intended public-disclosure content — file changes within 10 working days and deregister within 20 working days of termination (Art. 24), display the filing number and a link to the disclosure on their site or app (Art. 26), and carry out a security assessment (Art. 27). Sector rules also apply: protection duties for minors (Art. 18), the elderly (Art. 19), gig workers subject to algorithmic work dispatch (Art. 20), and a ban on unreasonable differential treatment of consumers on price or other transaction terms — algorithmic price discrimination (Art. 21).

Commencement is on the face of the instrument: Art. 35 states the Provisions take effect 1 March 2022, and the promulgation order records adoption at the 20th CAC executive meeting of 2021 on 16 November 2021, agreement by MIIT, the Ministry of Public Security and SAMR, and signature on 31 December 2021 (published 4 January 2022) as Order No. 9 of the four departments. Full Chinese text of Arts. 1-35 read at the cited CAC page. Distinct from, and cumulative with, the CAC instruments already tracked: cn-pipl-art24 is the statutory personal-information basis for the Art. 17 off-switch, while these Provisions are the operative administrative regime (filing system, self-assessment report, filing number display). Where a service also generates or synthesises content, cn-deep-synthesis, cn-genai-interim and cn-ai-labelling apply in parallel. Note npc.gov.cn is http-only; this instrument is a departmental rule (bumen guizhang), so the CAC publication is the authoritative text.

Stated maximum penalty — Art. 31: for breach of Arts. 7, 8, 9(1), 10, 14, 16, 17, 22, 24 or 26, where no other law or administrative regulation provides otherwise — warning, circulated criticism and an order to rectify within a time limit; if rectification is refused or the circumstances are serious, an order to suspend information updates plus a fine of RMB 10,000 to 100,000, with public-security penalties or criminal liability where applicable. Art. 33: obtaining a filing by concealment or false material means revocation of the filing, warning, circulated criticism and, in serious cases, suspension of information updates plus a fine of RMB 10,000 to 100,000. Art. 32 routes breaches of Arts. 6, 9(2), 11, 13, 15, 18, 19, 20, 21, 27 and 28(2) to the penalties of the underlying laws (e.g. PIPL Art. 66, up to RMB 50,000,000 or 5% of turnover, and the Minors Protection Law). Enforced by the CAC with MIIT, public-security and market-regulation authorities.

Deep Synthesis Provisions

Binds Deep-synthesis service providers, technical supporters, and users. Conspicuous labelling and consent for synthetic media / deepfakes.

Stated maximum penalty — Rectification, suspension, criminal referral

Generative AI Interim Measures

Binds Providers of public-facing generative AI services in mainland China. Security assessment, algorithm filing and content controls for public-facing GenAI services.

Stated maximum penalty — Rectification, suspension, criminal referral

AI-content labelling (+ GB 45438-2025)

Binds AI-content service & propagation platforms, app stores, and users. Explicit (visible) and implicit (metadata/watermark) labels on AI-generated content.

Stated maximum penalty — CAC administrative penalties

China AI Agents Implementation Opinions (CAC/NDRC/MIIT)

Binds Developers and deployers of AI agent services in China; mandatory compliance for healthcare, transportation, media, and public safety sectors; guidance-level for others. First national policy framework for AI agents. Mandatory for 19 priority sectors (healthcare, transport, media, public safety): filing, compliance testing, product recall provisions. Establishes three-tier decision authority model. AI-generated content labeling required. Enforceable via existing CSL/DSL/PIPL frameworks.

Published and operative from May 8, 2026 (jointly issued by CAC, NDRC, MIIT). Three-tier decision authority model: decisions requiring human-only authority; decisions requiring user approval; decisions agent may handle autonomously. High-risk sector filing and testing obligations enforceable under Cybersecurity Law, Data Security Law, PIPL. No standalone penalty regime; enforcement via existing frameworks.

Stated maximum penalty — Enforcement via CSL/DSL/PIPL (no standalone penalties specified)

Anthropomorphic AI Interactive Services Measures

Binds Providers of anthropomorphic AI interactive services (virtual companions, emotional chatbots, human-like AI) publicly available in mainland China. Dedicated compliance regime for AI companion services, virtual chatbots and emotionally interactive AI; mandates AI-identity disclosure, minor protections, usage-time warnings, and prohibits inducing emotional dependence.

In force 15 Jul 2026. No confirmed enforcement actions as of 2026-08-08: exhaustive cross-check (Bird & Bird, IAPP, Covington, CAC official news/enforcement index, DigitalPolicyAlert) found no penalty decisions or enforcement notices. CAC does not publish a searchable administrative-penalty registry. A claim of 12 fines / RMB 4.2M circulates in AI-generated blog content (Cubbbix, Aug 2026; republished by Ethicore Substack verbatim) — not independently verifiable and treated as unconfirmed.

Stated maximum penalty — CAC administrative penalties; service suspension