China-side readiness before going global: algorithm and LLM filings, content labelling and the outbound data route

Stages (26–46 weeks, estimate)

1. 1. Stage 1 — Data asset inventory, classification and grading

   3–5 weeks

   Establish exactly what data you hold and what each category is — the input to every later determination. Build the classification and grading register and identify important data. One practically crucial rule applies here: where the relevant authorities or region have not notified you, or publicly published a determination, that data is important data, the handler need not declare it as important data for outbound transfer. Many companies, unaware of this, push themselves into the security assessment channel unnecessarily. In parallel, carry out personal information protection impact assessments for processing involving personal information and check the lawful conditions for providing personal information abroad item by item.

   Obligations in this stage

   • Build a classification-and-grading register and identify important dataData Security Law · 第二十一条；《促进和规范数据跨境流动规定》第二条 · Severity High
   • Apply the identify-and-declare rule: undeclared data is not treated as important dataProvisions on Promoting and Regulating Cross-border Data Flows · 第二条；《网络数据安全管理条例》第三十七条 · Severity High
   • Check each outbound transfer against the lawful bases in Art. 35Regulations on Network Data Security Management · 第三十五条、第三十七条、第三十八条 · Severity Critical
   • Personal information protection impact assessment (PIPIA), retained for three yearsPersonal Information Protection Law · 第五十五条、第五十六条 · Severity Critical

   Deliverables

   Personal Information Protection Impact Assessment (PIPIA) report

   Evidence to retain

   • · Data classification and grading register (category × grade × storage location × purpose × whether transferred abroad)
   • · Important-data determinations and their basis, recording whether a notification was received or a public catalogue entry exists
   • · Personal information protection impact assessment reports and the three-year retention arrangement
   • · Item-by-item checklist of the lawful conditions for providing personal information abroad
   • · Data-flow diagram (onshore systems, offshore systems, who accesses them and by what route)

   Common blockers

   • · Self-designating all sensitive data as important data: this pushes legs that could have used the standard contract or an exemption into the security assessment channel, costing months for nothing.
   • · Inventorying business databases but not logs and backups: logs, backups, monitoring and data warehouses are the hidden conduits most often questioned in outbound review.
   • · Completing impact assessments without retaining them: the law requires three-year retention, and missing records read as never having done the assessment in both inspections and diligence.

2. 2. Stage 2 — Algorithm filing, generative AI filing and security assessment

   6–12 weeks

   Services with public-opinion or social-mobilisation capability must undergo a security assessment and complete algorithm filing; algorithm recommendation service providers should file within ten working days of starting to provide the service and publish the filing number; deep synthesis services carry their own filing plus a security assessment for new products, applications and functions. The substance of a filing package is explaining the lawfulness of training-data sources, data annotation governance and content safety mechanisms, so this stage also organises the lawful-source and IP chain for training data, the annotation rules and the annotator training records into submittable form. Filing is not one-off: material changes in model capability or functional scope require the process to be run again.

   Obligations in this stage

   • Security assessment and algorithm filing for services with public-opinion attributes or social-mobilisation capabilityInterim Measures for the Management of Generative AI Services · 第十七条；《互联网信息服务算法推荐管理规定》第二十四条、第二十六条；《人工智能生成合成内容标识办法》第十二条 · Severity Critical
   • Lawful sources, IP clearance and personal-information compliance for training dataInterim Measures for the Management of Generative AI Services · 第七条 · Severity Critical
   • Annotation rules, quality evaluation and annotator trainingInterim Measures for the Management of Generative AI Services · 第八条 · Severity High
   • File the algorithm within ten working days, publish the filing number and run the security assessmentProvisions on the Administration of Algorithmic Recommendation in Internet Information Services · 第二十四条、第二十五条、第二十六条、第二十七条 · Severity Critical
   • Assume primary responsibility for algorithm security with eight management systemsProvisions on the Administration of Algorithmic Recommendation in Internet Information Services · 第七条 · Severity High
   • Algorithm filing and security assessment for new products, applications and featuresProvisions on the Administration of Deep Synthesis in Internet Information Services · 第十九条、第二十条 · Severity Critical

   Deliverables

   Filing pack for generative AI services and algorithm filing, including the security assessment reportData Card — datasheet for a training, validation or test dataset

   Evidence to retain

   • · Filing package (service and algorithm particulars, security assessment report, content safety mechanism description)
   • · Lawful-source statement for training data and the chain of authorisations
   • · Data annotation rules, quality assessment records and annotator training records
   • · Filing receipt and screenshots showing where the filing number is published
   • · Algorithm security management system documentation addressing the eight required internal systems
   • · Security assessment records for new products, applications and functions

   Common blockers

   • · Treating filing as submitting paperwork: the package must be backed by a content safety mechanism that actually runs, and spot checks and follow-up enquiries verify that it does.
   • · A broken authorisation chain for training data: missing authorisation documents for purchased datasets, crawled data and partner data is the most common reason for supplementary-filing requests.
   • · Not re-assessing after model iteration: material changes in capability or function without re-running the process are treated during listing or diligence as a filing status inconsistent with reality.

3. 3. Stage 3 — Implementing AI-generated content labelling

   3–5 weeks

   The labelling measures require two layers: an explicit label placed per modality in the specified position (and preserved in exported files), and an implicit label in the file metadata. The service agreement must explain the labelling rules, and outputs without an explicit label require logs retained for at least six months. Labelling material is submitted with filings and security assessments and must conform to the mandatory national standard. For a company preparing to go global the value here is double: it is a statutory duty onshore and it maps neatly onto the EU’s Article 50(2) machine-readable marking and California’s latent/manifest disclosure requirements, so one implementation serves three markets — while noting that the technical bases and placement requirements are not identical.

   Obligations in this stage

   • Add the explicit label at the specified position for each modality, and keep it in exported filesMeasures for Labelling AI-Generated and Synthetic Content · 第四条 · Severity Critical
   • Add the implicit label to file metadataMeasures for Labelling AI-Generated and Synthetic Content · 第五条、第十一条 · Severity Critical
   • Explain the labelling rules in the service agreement and log unlabelled outputs for at least six monthsMeasures for Labelling AI-Generated and Synthetic Content · 第八条、第九条 · Severity High
   • Submit labelling materials at filing and assessment, and conform to the mandatory national standardMeasures for Labelling AI-Generated and Synthetic Content · 第十一条、第十二条 · Severity High
   • Label generated content under the Deep Synthesis Provisions and the Labelling MeasuresInterim Measures for the Management of Generative AI Services · 第十二条；《人工智能生成合成内容标识办法》第四条、第五条 · Severity Critical
   • Label generated or edited content and retain log informationProvisions on the Administration of Deep Synthesis in Internet Information Services · 第十六条、第十七条、第十八条 · Severity Critical

   Deliverables

   Model Card

   Evidence to retain

   • · Implementation note for explicit labels per modality, with interface and exported-file examples
   • · Field specification for implicit (metadata) labels and sampling results
   • · Text of the labelling clauses in the service agreement
   • · Log retention configuration for outputs without an explicit label (at least six months)
   • · Conformity mapping against the mandatory national standard
   • · Comparison table of labelling bases across China, the EU and California

   Common blockers

   • · Applying the label only in the preview interface so it is lost on export: the measures expressly require exported files to retain the label.
   • · Defining implicit label fields ad hoc instead of against the mandatory national standard: this draws a remediation request at filing.
   • · Assuming the domestic labelling implementation satisfies EU and California requirements: the technical bases and presentation requirements differ across the three, and each must be mapped rather than assumed equivalent.

4. 4. Stage 4 — Outbound data route triage, filing and registration

   8–16 weeks

   Triage first, then choose the route, then file. Triage each leg against the thresholds in Articles 7 and 8 of the Provisions on Promoting and Regulating Cross-Border Data Flows, checking the exemptions first — and any reliance on an exemption must leave a checkable written basis rather than an oral judgement. On the security assessment route, complete the outbound risk self-assessment, file through the provincial cyberspace administration to the national authority, and track the review period and validity. On the standard contract route, complete the contract-specific personal information protection impact assessment, execute the contract strictly on the template annexed to the measures, and register within ten working days. On the certification route, define the certification scope and complete notification, separate consent and the impact assessment. Whichever route is used, notification, separate consent and the impact assessment cannot be skipped. Free trade zone negative lists may offer simplification and are worth assessing separately.

   Obligations in this stage

   • Triage every outbound flow against the thresholds in Arts. 7 and 8Provisions on Promoting and Regulating Cross-border Data Flows · 第七条、第八条 · Severity Critical
   • Document every exemption relied on so it can be checkedProvisions on Promoting and Regulating Cross-border Data Flows · 第三条、第四条、第五条 · Severity High
   • Complete notice, separate consent and the impact assessment whatever route is usedProvisions on Promoting and Regulating Cross-border Data Flows · 第十条、第十一条；《个人信息保护法》第三十九条、第五十五条 · Severity Critical
   • Assess the simplification available through a free-trade-zone negative listProvisions on Promoting and Regulating Cross-border Data Flows · 第六条 · Severity Medium
   • Complete the outbound-transfer risk self-assessment before applyingMeasures for Security Assessment of Outbound Data Transfers · 第五条 · Severity Critical
   • File through the provincial authority to the CAC and track the review clockMeasures for Security Assessment of Outbound Data Transfers · 第六条、第七条、第十二条、第十三条 · Severity Critical
   • The legal instrument with the offshore recipient must contain six mandatory termsMeasures for Security Assessment of Outbound Data Transfers · 第九条 · Severity High
   • Confirm all four conditions for using the standard-contract routeMeasures on the Standard Contract for Outbound Transfer of Personal Information · 第四条；《促进和规范数据跨境流动规定》第七条、第八条 · Severity Critical
   • Execute the standard contract strictly on the annexed templateMeasures on the Standard Contract for Outbound Transfer of Personal Information · 第六条 · Severity Critical
   • File within ten working days and re-assess and re-file on a triggerMeasures on the Standard Contract for Outbound Transfer of Personal Information · 第七条、第八条 · Severity High
   • Confirm eligibility and define the certification scopeMeasures on Certification for Outbound Transfer of Personal Information · 第五条、第十条 · Severity High

   Deliverables

   Outbound Data Transfer Risk Self-Assessment Report (per the CAC filing guide template)Personal Information Protection Impact Assessment (PIPIA) reportTransfer Impact Assessment (TIA) — supporting Clause 14 of the EU Standard Contractual Clauses

   Evidence to retain

   • · Outbound leg inventory and threshold triage conclusions (leg × data category × order of magnitude of data subjects × route)
   • · Written basis for any exemption relied upon
   • · Outbound data risk self-assessment report (security assessment route)
   • · Filing materials plus acceptance, review and decision records, including validity and re-filing triggers
   • · Standard contract executed on the official template and the registration receipt
   • · Notification text, separate consent records and the impact assessment report
   • · Mapping table of the mandatory clauses in the legal instrument with the overseas recipient

   Common blockers

   • · Letting the business pick the route by “which is fastest”: threshold triage is a legal determination, not an option, and the wrong route means the transfer is not compliant at all.
   • · Relying on an exemption with no written basis: exemptions are conditional, and an oral judgement is treated on inspection as no reliance at all.
   • · Scheduling the security assessment filing at the end of the project: the review runs in months, and validity plus re-filing triggers need long-term management, so a late start directly blocks the overseas launch date.
   • · Editing the standard contract clauses: the measures require execution on the annexed template, and substantive changes cause registration to fail.

5. 5. Stage 5 — Technology export screening and science & technology ethics review

   3–6 weeks

   Two things that are easy to overlook entirely and costly when missed. First, any outbound technology transfer — establishing an overseas R&D centre, moving models and algorithms to an offshore subsidiary, technology licensing, and share reorganisations in going-global transactions — should first be checked against the Catalogue of Technologies Prohibited or Restricted from Export; restricted-category transfers require a technology export licence first. Identify at the same time whether any data is itself a controlled item. Second, science and technology activities involving human subjects, and listed activities, require ethics review: the company should establish a science and technology ethics (review) committee, listed activities additionally require expert re-review organised by the competent authority, and an annual report must be submitted to the national science and technology ethics management information registration platform.

   Obligations in this stage

   • Check the prohibited and restricted technology Catalogue before any outbound technology transferTechnology export administration: the prohibited/restricted technology Catalogue and the Technology Import and Export Regulations · 《技术进出口管理条例》第二条、第三十一条至第三十三条；商务部 科技部公告2020年第38号 · Severity Critical
   • Build technology-export compliance into outbound deal structures and monitor Catalogue adjustmentsTechnology export administration: the prohibited/restricted technology Catalogue and the Technology Import and Export Regulations · 商务部 科技部公告2020年第38号 · Severity High
   • Identify data that qualifies as a controlled item and route it through export controlData Security Law · 第二十五条；《出口管制法》第二条 · Severity High
   • Establish a science and technology ethics (review) committee and secure its independenceMeasures for Science and Technology Ethics Review (for Trial Implementation) · 第四条、第五条 · Severity High
   • Run an ethics risk assessment before the activity and file the review applicationMeasures for Science and Technology Ethics Review (for Trial Implementation) · 第九条、第十五条、第十六条 · Severity High
   • Listed activities must clear expert re-review organised by the competent authorityMeasures for Science and Technology Ethics Review (for Trial Implementation) · 第二十五条、第二十六条、第二十七条、第三十条、第三十一条、第三十二条；附件《需要开展伦理审查复核的科技活动清单》 · Severity Critical
   • File the annual report with the national ethics management information platform by 31 MarchMeasures for Science and Technology Ethics Review (for Trial Implementation) · 第四十五条 · Severity Medium

   Evidence to retain

   • · Outbound technology transfer inventory and catalogue comparison records, covering overseas R&D centres and intra-group transfers
   • · Technology export licence application and decision, where restricted-category technology is involved
   • · Determination of whether any data constitutes a controlled item
   • · Establishment document and membership of the science and technology ethics (review) committee
   • · Ethics risk assessment and review application records; expert re-review records for listed activities
   • · Receipt for the annual report submission (due by 31 March each year)

   Common blockers

   • · Treating an overseas R&D centre as purely an HR and tax question: technology and people leave together, and technology-export compliance belongs up front.
   • · Believing only “selling technology” counts as technology export: licensing, equity investment and joint development can equally constitute outbound technology transfer.
   • · Running ethics review only when applying for research grants: activities involving human subjects conducted by the company itself are equally in scope and carry an annual reporting duty.

6. 6. Stage 6 — Steady-state operation, incident reporting and annual upkeep

   3–5 weeks

   Freeze the domestic steady-state duties: appoint a personal information protection officer and conduct compliance audits as required; carry out and report periodic risk assessments as an important-data handler; report within 24 hours where a product or service security defect endangers national security or the public interest; remediate personal information breaches and notify both the authority and individuals; and retain network logs for at least six months. These duties share one characteristic — invisible day to day, decisive when something happens — and they are checked item by item in overseas customer diligence and listing review, so put them on the annual compliance calendar with named owners.

   Obligations in this stage

   • Appoint a personal information protection officer and run periodic compliance auditsPersonal Information Protection Law · 第五十二条、第五十四条；《个人信息保护合规审计管理办法》第四条、第十一条、第十二条 · Severity High
   • Remediation and dual notification for personal information leakage, tampering or lossPersonal Information Protection Law · 第五十七条 · Severity Critical
   • Periodic risk assessment and filing by important-data processorsData Security Law · 第三十条；《网络数据安全管理条例》第三十一条、第三十三条；《网络数据安全风险评估办法》第五条、第七条、第十五条、第十六条、第十八条 · Severity High
   • Report within 24 hours where a product or service defect endangers national security or the public interestRegulations on Network Data Security Management · 第十条 · Severity Critical
   • Contract terms for provision and entrustment, with three years of processing recordsRegulations on Network Data Security Management · 第十二条 · Severity High
   • Retain network logs for no less than six monthsCybersecurity Law · 第二十三条第（三）项 · Severity High
   • Maintain a cybersecurity incident response plan and report as requiredCybersecurity Law · 第二十七条 · Severity High

   Deliverables

   AI incident and serious incident reporting record (register plus report drafts)Personal Information Protection Impact Assessment (PIPIA) report

   Evidence to retain

   • · Appointment document and published particulars for the personal information protection officer
   • · Compliance audit plan and audit reports
   • · Important-data risk assessment report and submission receipt, where applicable
   • · Cybersecurity incident response plan and rehearsal records
   • · Log retention configuration evidence (at least six months)
   • · Contracts and processing records for outbound provision and entrusted processing, retained for three years
   • · Annual compliance calendar (duty × due date × owner × last completion)

   Common blockers

   • · Stopping once the outbound route is approved: security assessment results have a validity period, and defined events require re-assessment and re-filing.
   • · Purging contracts and processing records before three years: the regulations require three-year retention, and early deletion cannot be remedied at inspection.
   • · Writing the 24-hour reporting duty into a policy without rehearsing it: when it happens there is no time to work out the decision chain and reporting basis from scratch.