Assume primary responsibility for algorithm security with eight management systems
Severity High第七条
Establish management systems and technical measures for reviewing algorithm mechanisms, science and technology ethics review, user registration, content-publication review, data security and personal information protection, anti-telecom-fraud, security assessment and monitoring, and incident response; adopt and publish the rules governing the recommendation service; and resource it with specialist staff and technical support proportionate to its scale.
- Applies when
- All algorithmic recommendation service providers. Inspections ask for headcount and role descriptions to evidence “specialist staff proportionate to scale”; policy documents alone are not enough.
- Evidence to retain
- · The eight management policies with issuance records
- · Screenshot of the publicly published recommendation-service rules
- · Org chart and qualification summary for the algorithm security team
- · Ethics review records, with a note on the joint build with the Science and Technology Ethics Review Measures
Estimated first-time effort: 20–45 person-days (estimate, not a commitment)
Periodically review, evaluate and validate algorithm mechanisms, models, data and outcomes
Severity High第八条
Periodically review, evaluate and validate the algorithm’s mechanisms, models, data and application outcomes, and do not deploy models that induce addiction or excessive consumption or otherwise breach the law or ethics. The review should cover both offline metrics and live outcomes, focusing on whether the system induces addiction or excessive spending and whether outcomes discriminate against particular groups.
- Applies when
- All algorithmic recommendation providers. Products optimised on engagement time or paid conversion must be able to show that constraints against addiction and excessive spending are built into the objective.
- Evidence to retain
- · Plan for periodic algorithm review, evaluation and validation, stating cadence, scope, metrics, method and owner
- · Successive review reports covering the model, the data and live outcomes
- · Dedicated assessment conclusions on addiction and excessive-consumption risk
- · Remediation records for findings and the re-validation results
Estimated first-time effort: 12–30 person-days (estimate, not a commitment)
Manage user models and tags, and keep unlawful or harmful terms out of interest profiles
Severity High第九条、第十条
Strengthen user-model and user-tag management, refine the rules for what interests enter the user model and how tags are managed, and do not record unlawful or harmful keywords as user interests or tags, nor push content on that basis. Also strengthen information-security management by building a feature library for identifying unlawful and harmful information with sound inclusion standards, rules and procedures; where algorithmically generated or synthetic information is found without a conspicuous label, apply the label before transmission continues.
- Applies when
- All algorithmic recommendation providers. The requirement in Art. 9 §2 to label unlabelled generated or synthetic content before continuing transmission is a hard technical requirement for content-distribution platforms and community-style AI products, mirroring Art. 6 of the Labelling Measures.
- Evidence to retain
- · User-tag taxonomy documentation and the rules governing what enters the interest profile
- · Blocklist of unlawful and harmful keywords and its enforcement configuration in the tagging system
- · Inclusion standards, rules and procedures for the feature library, with version history
- · Technical design and operating statistics for detecting and re-labelling unlabelled generated content
Estimated first-time effort: 12–30 person-days (estimate, not a commitment)
Algorithm transparency disclosure plus a non-profiled option or one-click off switch
Severity High第十六条、第十七条
Give users prominent notice that an algorithmic recommendation service is being provided, and publish in an appropriate manner the basic principles, purpose and main operating mechanism of that service. Provide an option that is not targeted at the user’s personal characteristics, or a convenient option to switch the recommendation service off; where the user switches it off, stop providing the service immediately. Both articles are named in Art. 31 as penalty triggers and are frequent inspection items in practice.
- Applies when
- All algorithmic recommendation providers. “Immediately” means the off switch cannot be designed to take effect after a delay or only on restart.
- Evidence to retain
- · Screenshots of the notice and published disclosure, covering the basic principles, purpose and main operating mechanism
- · Product screenshots and navigation path for the non-profiled option or the off switch
- · Technical verification that switching off takes immediate effect
- · Reconciliation between the published disclosure and the “content to be published” submitted in the algorithm filing
Estimated first-time effort: 8–20 person-days (estimate, not a commitment)
Specific protections for minors, the elderly, workers and consumers
Severity High第十八条、第十九条、第二十条、第二十一条
Where the service reaches minors, perform the statutory duties of online protection for minors and make it easier for them to access information beneficial to their physical and mental health, including through a minors mode and age-appropriate services. Where it reaches the elderly, safeguard their lawful rights, provide age-friendly intelligent services under the applicable national rules, and monitor, identify and handle telecom-fraud content. Where algorithms dispatch work to labourers, protect their rights to remuneration and rest, and build sound algorithms for order allocation, pay composition and payment, working hours and incentives and penalties. Where goods or services are sold to consumers, protect fair-dealing rights and do not use algorithms to impose unreasonable differential treatment on price or other terms based on consumers’ preferences or transaction habits.
- Applies when
- Consumer-facing AI products, on-demand delivery and mobility dispatch platforms, and AI pricing and marketing systems. Art. 21 is the prohibition on profiling-based price discrimination, a frequent source of consumer complaints and market-regulation enforcement.
- Evidence to retain
- · Design documentation and release evidence for the minors mode
- · Age-friendly adaptation plan and records of monitoring and handling fraud-related content
- · Documented and published rules for order allocation, remuneration, working hours and incentives in work-dispatch algorithms
- · Fairness test report on price differentiation, analysing price distribution for the same item across user profiles
Estimated first-time effort: 15–35 person-days (estimate, not a commitment)
File the algorithm within ten working days, publish the filing number and run the security assessment
Severity Critical第二十四条、第二十五条、第二十六条、第二十七条
A provider with public-opinion attributes or social-mobilisation capability must, within ten working days of starting the service, file through the internet information service algorithm filing system its name, service form, application field, algorithm type, algorithm self-assessment report and the content to be published. Where the materials are complete the authority grants the filing, issues a filing number and publishes it within thirty working days; where incomplete, it notifies the applicant with reasons within thirty working days. Once filed, the provider must display the filing number prominently on the website or application through which the service is offered, with a link to the published information. It must also carry out a security assessment under the applicable national rules.
- Applies when
- Providers of algorithmic recommendation services with public-opinion attributes or social-mobilisation capability, plus the generative AI and deep synthesis providers routed into this regime by Art. 17 of the Generative AI Interim Measures and Art. 19 of the Deep Synthesis Provisions. The ten working days run from the day the service starts, so filing must be scheduled alongside the launch plan.
- Deadline: File within ten working days of starting the service; the authority grants the filing or notifies refusal within thirty working days.
- Evidence to retain
- · Submission record from the algorithm filing system and the filing number
- · Algorithm self-assessment report
- · Text of the content to be published and a reconciliation against the live disclosure page
- · Screenshots showing the filing number and the link to the published information in a prominent product location
- · Timeline comparing the service launch date with the filing submission date to evidence the ten-working-day window
- · Records of amendment and cancellation filings
Estimated first-time effort: 15–40 person-days (estimate, not a commitment)