Skip to main content

    AI by country · East Asia

    AI in China: the rules, the readiness and where to start

    Last checked: 29 October 2026

    What should a company in China know before starting with AI?

    China has no single AI law as of 29 October 2026, but it has detailed AI rules issued by the Cyberspace Administration of China (CAC). The Personal Information Protection Law (PIPL) covers personal data, automated decisions and transfers abroad, while separate measures govern generative AI services and the labelling of AI-generated content. A company should check whether its AI is offered to the public, what labels it needs, and whether any data leaves China.

    At a glance

    China at a glance

    Key facts about China
    Data protection lawPersonal Information Protection Law (PIPL), in force since 1 November 2021
    RegulatorCyberspace Administration of China (CAC), with other ministries for specific measures
    AI policyInterim Measures for Generative AI Services (2023) and Labelling Measures (2025). No single AI law as of 29 October 2026
    Time zoneCST, UTC+8 (India is 2.5 hours behind)
    CurrencyCNY (renminbi)
    Business languageMandarin Chinese

    Why now

    Why China is worth watching

    Each point links to the document it comes from.

    • The State Council's AI+ opinions of August 2025 set a target of over 70% adoption of new smart devices and AI agents by 2027, and over 90% by 2030.[6]

    • Rules on labelling AI-generated content, issued by the CAC and three other bodies, took effect on 1 September 2025 together with a mandatory national standard.[3]

    • An amended Cybersecurity Law, adopted on 28 October 2025 and in force from 1 January 2026, adds a provision on AI research, training data, ethics and safety oversight.[5]

    • Since 22 March 2024, CAC rules exempt some transfers of personal data abroad from approval, such as transfers needed to perform a contract with the individual.[4]

    • Generative AI services offered to the public in mainland China have been regulated by CAC-led interim measures since 15 August 2023.[2]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    Personal Information Protection Law (PIPL)

    In force2021Automated decisions must be transparent and fair, and a person can ask for an explanation and refuse a decision made solely by automation that has a major effect on their rights (Article 24). An impact assessment is required before automated decision-making or sending data abroad (Article 55). Serious violations can bring fines of up to RMB 50 million or 5% of the previous year's turnover (Article 66).[1]

    Interim Measures for the Management of Generative AI Services

    In force2023They apply to generative AI offered to the public in mainland China, not to internal use or development (Article 2). Training data must come from lawful sources, and personal data needs consent or another legal basis (Article 7). Services with public opinion attributes need a security assessment and algorithm filing (Article 17).[2]

    Measures for Labelling AI-Generated and Synthetic Content

    In force2025From 1 September 2025, providers must add visible labels to AI-generated text, audio, images, video and virtual scenes, and embed hidden labels in file metadata. User agreements must explain the labels, and removing or faking labels is banned.[3]

    Provisions on Promoting and Regulating Cross-Border Data Flows (CAC Order No. 16)

    In force2024A CAC security assessment is needed to send personal data of 1 million or more people, or sensitive data of 10,000 or more, abroad in a year. Between 100,000 and 1 million people needs a standard contract or certification. Non-critical operators sending data of fewer than 100,000 people (no sensitive data) are exempt.[4]

    Where AI fits first

    Where AI fits first

    Retail and e-commerce

    Product descriptions, customer service chat and demand forecasting in Chinese.

    PIPL Article 24 bans unreasonable price differences from automated decisions and requires an opt-out from personalised marketing.[1]

    Media and marketing

    Drafting copy, images and video for campaigns.

    AI-generated content needs visible and hidden labels under the 2025 Labelling Measures.[3]

    Manufacturing

    Defect detection from images and summarising maintenance logs, often with little personal data.

    Internal AI use that is not offered to the public falls outside the generative AI measures (Article 2), though data security rules still apply.[2]

    Banking and insurance

    Document processing and risk review, with people deciding on credit and claims.

    Financial account data is sensitive personal information under PIPL, and sending sensitive data abroad triggers stricter CAC thresholds.[4]

    Your first steps

    Your first steps

    1. Decide whether your AI is offered to the public in mainland China. If it is, the generative AI measures apply, and you may need a security assessment and algorithm filing.
    2. Add visible and metadata labels to AI-generated content and explain them in your user agreement.
    3. Run a personal information protection impact assessment before automated decisions or any transfer abroad, and keep the report for three years.
    4. Count how many people's data you send abroad each year, and check whether you need a CAC assessment, a standard contract, certification or an exemption.
    5. Give people a way to ask for an explanation and refuse solely automated decisions that affect their rights.
    6. Check that training data and base models come from lawful sources and respect intellectual property.
    7. If you are a foreign company serving people in China, check whether PIPL Article 53 requires an entity or representative in China.

    AI services for China

    AI consulting and development for teams in China

    We work remotely with companies in China, in your time zone, and keep your data under the rules described above.

    AI agents and automation

    Agents that finish multi-step work across your tools, with people approving what matters.
    Learn more

    Document Q&A (RAG)

    Answers from your own documents, with the source shown for every answer.
    Learn more

    AI governance and data protection

    Policies, review steps and audit trails that fit your local data law.
    Learn more

    Software and cloud engineering

    Web apps, integrations and cloud platforms built around your AI use case.
    Learn more

    How we work with you

    How we work with you

    We work remotely with clients worldwide, in the client's time zone. China is on UTC+8 and India on UTC+5:30, a 2.5 hour gap, so a 9:00 to 18:00 day in China and 9:30 to 18:30 in India overlap for about 6 hours, from 12:00 to 18:00 China time. PIPL and the CAC cross-border data rules apply to any personal data sent to a provider in India, and the generative AI measures govern services offered to the public in China, so these rules shape what data we can receive and which services a foreign provider can run.

    Questions

    Common questions about AI in China

    Does China have an AI law?

    Not a single comprehensive one as of 29 October 2026. AI is governed by CAC measures on generative AI, deep synthesis and labelling, by PIPL, and by the Cybersecurity Law, which since 1 January 2026 includes an AI provision.

    Do the generative AI measures apply to internal tools?

    Article 2 says they cover services offered to the public in mainland China. Developing or using generative AI without offering it to the public is not covered, but PIPL and data security rules still apply.

    Can we use an overseas AI model with customer data?

    Only if the transfer meets PIPL Article 38 and the 2024 CAC thresholds. Depending on volume, you may need a security assessment, a standard contract, certification, or you may fall under an exemption.

    What are the penalties under PIPL?

    For serious violations, fines of up to RMB 50 million or 5% of the previous year's turnover, plus possible suspension of business. Responsible managers can face personal fines.

    Complimentary tools

    Try these first

    Three complimentary tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 29 October 2026. Numbers in square brackets above match this list.
    1. [1] Cyberspace Administration of China (text of the NPC Standing Committee law), 2021-08-20. Personal Information Protection Law of the People's Republic of China(cac.gov.cn)
      Full title and what we used it for

      Personal Information Protection Law of the People's Republic of China. Primary, Chinese text. Used for the adoption and commencement dates and Articles 3, 24, 38, 40, 53, 55 to 57 and 66.

    2. [2] Cyberspace Administration of China and six other bodies, 2023-07-10. Interim Measures for the Management of Generative Artificial Intelligen…(cac.gov.cn)
      Full title and what we used it for

      Interim Measures for the Management of Generative Artificial Intelligence Services (Order No. 15). Primary, Chinese text. Used for scope (Article 2), training data (Article 7), labelling (Article 12), assessment and filing (Article 17), services from abroad (Article 20) and the 15 August 2023 start date.

    3. [3] Cyberspace Administration of China, 2025-03-14. Q&A on the Measures for Labelling AI-Generated and Synthetic Content(cac.gov.cn)
      Full title and what we used it for

      Q&A on the Measures for Labelling AI-Generated and Synthetic Content. Primary, the CAC's official explanation of the measures. Used for issuing bodies, the 1 September 2025 start date and the labelling duties.

    4. [4] Cyberspace Administration of China, 2024-03-22. Provisions on Promoting and Regulating Cross-Border Data Flows (Order N…(cac.gov.cn)
      Full title and what we used it for

      Provisions on Promoting and Regulating Cross-Border Data Flows (Order No. 16). Primary, Chinese text. Used for the exemptions (Article 5) and thresholds (Articles 7 and 8).

    5. [5] Xinhua, 2025-10-28. Cybersecurity Law amendment completed to guide AI development(news.cn)
      Full title and what we used it for

      Cybersecurity Law amendment completed to guide AI development. State news agency report. Used for the adoption date, the 1 January 2026 start date and the AI provision. We did not read the full amended law text.

    6. [6] State Council of the People's Republic of China, 2025-08-26. Opinions of the State Council on Further Implementing the AI+ Initiativ…(gov.cn)
      Full title and what we used it for

      Opinions of the State Council on Further Implementing the AI+ Initiative (Guo Fa [2025] No. 11). Primary. Used for the 2027 and 2030 adoption targets.

    This is general information, not legal advice. Chinese AI and data rules change often, and we read the Chinese texts through translation. Check with a qualified lawyer in China before you act. Facts checked on 29 October 2026.

    Other country guides

    Starting with AI in China?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score