At six o’clock on the evening of 14 September 2026, the Cyberspace Administration of China (CAC) put out a short notice of the kind it now publishes every couple of months. In July and August, it said, 124 more generative AI services had completed national filing, seven of them running on phones rather than in data centres. Local offices had registered another 133 apps and features built on models that were already approved. By 31 August the running totals stood at 1,112 filed services and 731 registered applications.
Notices like this rarely make headlines outside China, yet they show how the country actually governs artificial intelligence. There is no single AI act of the kind the European Union passed. Instead there is a stack of targeted rules, most issued by the internet regulator together with a changing group of ministries. They cover recommendation algorithms, deepfakes, chatbots, content labels, AI “companions” and ethics reviews, and they are backed by national standards that sometimes specify exact percentages. Alongside them run a national drive to spread AI through the economy and a new international body headquartered in Shanghai. This piece looks at how the system was built, what it demands, how it is enforced, including through time-limited enforcement campaigns, where analysts disagree, and why the comprehensive AI law officials keep mentioning is still only a research project.
A rulebook built in layers
China’s AI rules were added one after another, each reusing the machinery of the one before. Scott Singer and Matt Sheehan of the Carnegie Endowment for International Peace, in a July 2025 paper tracing Chinese AI policy since 2017, argue that the rules follow a cycle tied to Beijing’s confidence: “when China perceives itself as technologically vulnerable, it leverages technology as an engine for economic growth; when it feels strong, it reasserts control through heavy-handed ideological measures.”
Algorithms and deepfakes first
The first rules had nothing to do with chatbots. Regulations on recommendation algorithms took effect in March 2022, aimed at the feeds on apps such as Douyin, Weibo and Taobao that decide what hundreds of millions of people read, watch and buy. They let users switch off personalised recommendations and, more importantly, set up a mandatory algorithm registry. Rules on “deep synthesis”, China’s term for deepfakes, followed on 10 January 2023. They required AI-generated media to be labelled and deepfake services to verify users’ real names. Singer and Sheehan think many of these provisions were too vague to enforce, a duty to spread “positive energy” being one example. But the registry, and the experience officials gained dealing with AI firms, carried over into everything that came later.
The chatbot rules, and how they were softened
ChatGPT’s launch in November 2022 caught Chinese regulators mid-draft. The CAC’s April 2023 draft would have required training data and outputs to meet a standard of “truth, accuracy, objectivity, and diversity”, which the Carnegie authors call effectively impossible. After pushback from scholars and companies, the final Interim Measures for the Management of Generative AI Services were much milder. They were issued by seven agencies on 10 July 2023 and took effect on 15 August. The Carnegie paper sums up the mood of the time with a phrase used by the legal scholar Zhang Linghan: “Failing to develop is the greatest threat to security.”
Those measures remain the backbone of the system. They cover public-facing services generating text, images, audio or video for users in mainland China, including services run from abroad, but not in-house research. Generated content must uphold core socialist values and must not endanger national security or promote separatism, terrorism or discrimination. Services with public-opinion properties or the capacity for social mobilisation must pass a security assessment and file their algorithms.
Filing: how a model reaches the public
Filing is where most of the regulating actually gets done. A company offering its own large model to the public takes it through national filing with the CAC. A company that simply builds an app on top of an already-filed model, for instance by calling it through an API, registers with its provincial office instead. Every live app must also show, prominently or on its product page, which filed model it uses and that model’s filing or registration number.
The register has grown quickly. The Carnegie paper records 64 generative AI services filed in 2023 and 238 in 2024. China AI Dispatch, a newsletter that follows the CAC’s bulletins, notes that at the end of 2024 there were 302 filed services against 105 registered apps, about three to one. By August 2026 the figures were 1,112 and 731, and in the latest two-month window new app registrations outnumbered new model filings for the first time. The newsletter reads this, “loosely” in its own word, as a shift from building models to building products on them. It adds that on-device models had no route through the process until July 2026.
What a model is tested against
The detail sits in a national standard, GB/T 45654-2025, the Basic Security Requirements for Generative AI Services. It was published on 25 April 2025 and took effect on 1 November 2025. Formally it is recommended rather than mandatory, but it describes the checks regulators expect, and it is precise:
- A data source should not be used if sampling finds more than 5 per cent of it contains illegal or harmful information.
- Manual checks of at least 4,000 training items per modality should find at least 96 per cent acceptable; automated checks, at least 98 per cent.
- Providers need a keyword library of at least 10,000 terms, updated weekly, and a test bank of at least 2,000 questions covering 31 listed risk categories, updated monthly.
- At least 90 per cent of generated answers in sampled tests must be acceptable.
One detail rarely noticed abroad is that the standard also penalises over-caution. Alongside at least 500 questions a model should refuse, providers must keep at least 500 it should not refuse. These cover China’s political system, beliefs, image, culture, customs, ethnic groups, geography, history and revolutionary martyrs, as well as gender, age, occupation and health. Models should decline clearly extreme or malicious prompts and should be able to answer everything else. A model that dodges every sensitive subject fails, just as one that answers everything does.
The content line, and what outsiders make of it
The political content requirement attracts the most attention abroad, and it is where sources disagree most sharply.
The Carnegie paper reports that specialised CAC teams ran compliance audits focused on getting appropriate answers to politically sensitive questions. It also suggests the Party may now see chatbots as less dangerous than social media. A chatbot answers each person separately, one to one, whereas social media broadcasts to many. A model that occasionally gives an individual an unapproved answer about Taiwan or Tiananmen does not threaten control the way a viral post does. That may help explain why filings sped up even though the rules stayed strict.
Washington’s tone is harsher. In September 2025 the Center for AI Standards and Innovation (CAISI), part of the US National Institute of Standards and Technology, compared three DeepSeek models with four American ones. It found that DeepSeek’s models “echoed four times as many inaccurate and misleading CCP narratives” as the US models, were far more vulnerable to jailbreaking, and lagged on most benchmarks. That context matters. CAISI did the work under President Trump’s AI Action Plan, which directs it to evaluate Chinese frontier models, and the Commerce Secretary presented the findings as proof that “American AI dominates”. Chinese regulators, for their part, frame content rules as protecting national security and the public interest, language that opens almost every measure discussed here.
A British view sits between the two. A July 2025 report by the Alan Turing Institute’s Centre for Emerging Technology and Security (CETaS), written with the International Institute for Strategic Studies and Adarga, says the state keeps control of the most strategic decisions but “it is an oversimplification to describe this model as entirely centrally controlled”. Regional governments and fierce private competition, which produced DeepSeek, matter a great deal. The report also notes China’s emphasis on “stringent controls on pre-training data and onerous registration requirements”. The data-sampling thresholds in GB/T 45654 are a good example.
Labels on everything
The rule ordinary users are most likely to have noticed took effect on 1 September 2025. The Measures for Labeling of AI-Generated Synthetic Content, issued by the CAC with the industry ministry (MIIT), the public security ministry and the broadcasting regulator, arrived together with a mandatory national standard, GB 45438-2025.
They require two kinds of label. An explicit label is one people can see or hear, such as a notice in text, a voice prompt in audio, a mark on images, or a mark on a video’s opening frame and during playback. An implicit label sits in the file’s metadata and records that the content is AI-generated, the provider’s name or code and a content reference number. Deliberately removing or forging labels is banned, and app stores must check apps’ labelling arrangements. Just before the deadline, WeChat told users they must declare AI-generated posts, and Douyin and Weibo added self-declaration options, platform labels for suspected AI content and ways to report unlabelled posts. The measures contain no separate fines. Enforcement goes through existing law, with each regulator acting “according to their duties”.
Companions, not assistants: the 2026 rules on humanlike AI
The most distinctive rule of 2026 deals with AI designed to act as a friend, partner or confidant. The Interim Measures for the Administration of AI Anthropomorphic Interaction Services were published in draft on 27 December 2025 and issued on 10 April 2026 as Order No. 21 of five agencies, led by the CAC. They took effect on 15 July 2026. They apply only to services that offer “continuous” emotional interaction by imitating a person’s personality, way of thinking and style of communication. Customer-service bots, question-and-answer tools, work assistants, education and research tools are excluded.
What providers must do
- No virtual intimacy for minors. “Virtual relatives” and “virtual partners” may not be offered to minors at all. Children under 14 need a guardian’s consent for other companion services, and providers must offer a minors’ mode with time limits and controls for guardians.
- Reminders and exits. Users must be told they are talking to an AI. They must get a reminder after every two hours of continuous use. Leaving must be easy, and a service may not keep chatting to stop someone leaving.
- Crisis duties. If a user threatens self-harm or suicide, or faces a major financial loss, the provider must intervene and contact a guardian or the emergency contact collected at sign-up.
- Design limits. Services must not flatter users excessively, encourage emotional dependence or use “emotional manipulation” to push unreasonable decisions. Replacing real social contact must not be a service goal.
- Data. Users must be able to copy and delete chat logs, and sensitive personal information from conversations may not be used for training without separate consent.
A security assessment is required at launch, after major changes, and once a service passes one million registered users or 100,000 monthly active users. Fines are modest by European standards: 10,000 to 100,000 yuan for serious or uncorrected breaches, and 100,000 to 200,000 yuan where harm to life or health results.
Enforcement by campaign
Rules in China are often enforced through time-limited campaigns. On 30 April 2026 the Office of the Central Cyberspace Affairs Commission announced a four-month “Qinglang” (“clear and bright”) campaign against chaotic AI applications. The first phase targeted unfiled services, weak safety review, training-data security, “data poisoning” and poor labelling. The second targeted AI-generated false information, vulgar content, impersonation, harm to minors, comment farms and what the regulator calls shùzì gānshuǐ, roughly “digital slop”.
On 2 September 2026 the regulator reported that more than 5.61 million items of content had been removed, more than 49,000 accounts dealt with and more than 2,400 websites and apps handled. The published examples include accounts using AI to rewrite classics such as Journey to the West for clicks, fake disaster footage, AI presenters selling to elderly viewers, face-swapped videos of public figures and disturbing animations involving children.
Counting problems
Campaign figures deserve caution. A briefing from the Beijing law firm JT&N gives first-phase figures of more than 14,000 AI products handled and more than six million items removed. That content figure is higher than the CAC’s later cumulative total for the whole campaign, which should not be possible if both counted the same thing. Definitions or reporting periods may explain the gap, but these are announcements, not audited statistics.
Ethics reviews and safety frameworks
China’s industry and science ministries run a separate track. In spring 2026, MIIT and nine other departments issued trial measures on ethics review for AI research. Universities, institutes, hospitals and companies doing AI work with ethical risks must set up ethics committees or use accredited review centres, decide applications within 30 days and re-review approved projects at least yearly. Three kinds of research also need expert re-review and follow-up every six months. They are human-machine integration systems with strong effects on behaviour, emotions or health; algorithms capable of shaping public opinion or mobilising society; and highly autonomous decision-making systems in risky settings. Projects already covered by the filing regimes can skip that step.
On 15 September 2025 the cybersecurity standards body TC260 published version 2.0 of its AI Safety Governance Framework. It proposes grading AI applications by use case, capability and scale of deployment, the closest official Chinese documents have come to the EU’s tiered risk approach. Abroad, China presents the China AI Safety and Development Association (CnAISDA), launched in February 2025, as its counterpart to AI Security Institutes such as Britain’s. The Carnegie authors say it “credibly claims strong support from the Chinese government”. CETaS says it “does not appear to carry out independent AI testing and evaluation”.
The AI law that has not arrived
A draft AI law first appeared on the State Council’s legislative plan in 2023, and academics have drafted model laws, including one led by the Chinese Academy of Social Sciences that proposes a dedicated regulator. By late September 2026, however, no draft had gone to the national legislature.
AI entered statute in a smaller way. Amendments to the Cybersecurity Law, passed on 28 October 2025 and in force from 1 January 2026, added an Article 20. In China Law Translate’s rendering, it commits the state to “improve ethical regulation for AI, strengthen risk monitoring and assessment, and security regulation, and promote the application and healthy development of AI”, alongside support for research, data and computing power. It is a statement of direction, not a rulebook.
What the 2026 plans actually say
Here the sources clash most directly. The State Council’s 2026 legislative plan, published in May, calls for “accelerating comprehensive legislation for the healthy development of artificial intelligence”, and at the end of July an NDRC spokesperson said the government would speed up work on an AI law. Some Chinese legal commentary describes the National People’s Congress Standing Committee’s 2026 plan as listing AI among its “preparatory review” projects.
NPC Observer’s reading of that plan is more cautious. AI appears neither among the 34 bills scheduled for review nor among the 22 named backup projects, only in a line directing research into issues including “the healthy development of artificial intelligence”. Mason AI Lab, based in Taiwan, notes that the State Council did not list an AI bill for submission either, and warns that headlines announcing a Chinese AI law run ahead of the facts. The AI Safety China newsletter expects continued “incremental integration of AI-related provisions into existing legislation”. The political signal is stronger than for years, but the procedural evidence still points to research rather than review.
Control and promotion in the same breath
None of this means Chinese AI policy is only about restriction. The State Council’s “AI Plus” opinion of August 2025 targets penetration of more than 70 per cent for intelligent devices and AI agents by 2027 and more than 90 per cent by 2030. It encourages open-source communities, even suggesting universities give credit for open-source contributions, and asks officials to optimise the safety assessment and filing systems. According to AI Safety China, Premier Li Qiang’s 2026 government work report praised Chinese models’ lead in open source and was the first to call explicitly for “improving AI governance”.
Beijing is also exporting its approach. At the World Artificial Intelligence Conference in July 2025, Li proposed a global cooperation body, and on 16 July 2026, 29 countries, including Russia, Pakistan, Indonesia, Kazakhstan and Laos, signed an agreement founding the World Artificial Intelligence Cooperation Organization, headquartered in Shanghai. UN Secretary-General António Guterres attended. No major Western economy is a founding member.
What this adds up to
China’s AI governance is often described either as a censorship machine that will strangle its own industry or as a seamless state plan. The evidence fits neither picture. The filing register grew more than tenfold in under three years while the rules stayed demanding. The key standard penalises excessive caution as well as political slips. The humanlike-AI rules tackle problems Western regulators are only starting to discuss. At the same time, the content requirements are real and show up in the models, as even analysts wary of American government framing accept.
What stands out is the method. Regulators issue a draft, listen to industry and academics, drop what cannot work, and let standards bodies turn principles into measurable tests. Enforcement comes in bursts through campaigns whose numbers deserve scepticism, and the comprehensive law remains a promise. When the next short CAC bulletin appears, the figure to watch is whether registered apps keep outpacing filed models. If they do, China’s AI industry will have moved from building models to using them, within rules designed to keep that shift in bounds.
