Describe your business, leave with a checklist you can assign

Build a pre-transfer screening gate covering every form of outward transfer: patent assignment, patent licensing, transfer of know-how, technical cooperation, technical services and contribution of technology as capital. For each technology to be transferred, compare it against the entry descriptions and control points in the Catalogue version MOFCOM currently publishes, record a written conclusion of prohibited, restricted or free, and state in that record which Catalogue version and issue date was relied on — the annex to the 2008 Order No. 12 lapsed on 21 Dec 2023 and can no longer be used. Where the technology is military-civil dual-use, Announcement No. 38 of 2020 brings it under the export-control regime, so the dual-use lists and catch-all provisions of the Export Control Law and the Dual-Use Items Regulations must be applied at the same time.

Evidence: Technology asset inventory: name, type of right, core control points and the form in which it is embodied; Per-technology comparison against the Catalogue entries, recording the conclusion, the entry relied on, the assessor and the date; Parallel dual-use determination recording whether the technology also falls under dual-use control; Catalogue version check recording which published version was relied on and its issue date; Internal approval procedure and approval records for outbound technology transfers

A restricted technology may be contracted for and delivered only after the two-stage permit under the Technology Import and Export Administration Regulations has been completed, and the order of the stages cannot be reversed. Stage one (Arts. 34–36): file a technology export application with MOFCOM, which reviews it together with the science-and-technology authority and decides within 30 working days of receipt; if approved, a letter of intent for a technology export licence is issued, and any required confidentiality review follows national rules. ONLY AFTER OBTAINING THAT LETTER may the applicant enter substantive negotiations and sign the technology export contract — the single line in this regime most often run over by deal tempo. Stage two (Arts. 37–38): after signature, file four documents to apply for the licence itself — the letter of intent, a copy of the technology export contract, an export list of the technical materials, and proof of both parties’ legal status; MOFCOM verifies the contract’s authenticity and decides within 15 working days of receipt; where licensed, the technology export licence is issued and THE CONTRACT TAKES EFFECT ON THE DATE THE LICENCE IS ISSUED. The licence is then used to complete foreign-exchange, banking, tax and customs formalities (Art. 42); a change to the main terms requires the permit to be redone and termination must be filed (Art. 43). Free-export technologies are not a no-op either: the contract must be registered, filing a registration application, a copy of the contract and proof of both parties’ legal status, with the authority registering it and issuing a registration certificate within three working days (Arts. 40–41).

Evidence: Technology export application materials and the letter of intent for a technology export licence; The four licence-application documents: letter of intent, copy of the technology export contract, export list of the technical materials, and proof of both parties’ legal status; MOFCOM’s acceptance, decision and the original licence; Contract clause providing that it takes effect on the date the technology export licence is issued; Timeline comparing the delivery of technical materials against the date the licence was issued; Configuration evidence for the access restrictions applied to offshore entities while the permit was pending; Re-permitting records after a change to the contract’s main terms, and the filing record on termination; Contract registration application and technology export contract registration certificate for free-export technologies

Two things at once. First, treat the prohibited class as an absolute bar: Art. 32 of the Regulations says only that “technologies prohibited from export may not be exported” — no exception, no licensing route, no room to act first and regularise later. The technology asset register therefore needs a prohibited-class flag that no business process can route around: a hit ends the transaction rather than scheduling an approval. Second, widen the trigger surface to the actions that count as technology export even with no customs declaration anywhere, because Art. 2 defines technology export as “transferring technology out of the PRC by way of trade, investment or economic and technical cooperation” — the test is the act and the mode of transfer, not any movement of goods: (1) transferring technology to a wholly owned offshore subsidiary or branch — sitting inside one corporate group is not an exemption; (2) contributing technology as capital or equity into a Sino-foreign or offshore joint venture; (3) patent licensing, know-how licensing, and licensing software or models abroad; and (4) technical services, joint development and technical consulting for offshore parties, including handing domestic R&D output to an offshore affiliate to continue developing. All four sit within the three modes Art. 2 enumerates, so each needs a determination gate in the process and a failed determination must block execution. Two further cases are NOT expressly addressed by the Regulations yet carry real risk; treat them as internal risk-control gates rather than stating them as settled statutory triggers: (5) publishing model weights, training methods or core algorithm implementations as open source — whether a public release with no contract and no consideration amounts to a transfer “by way of trade, investment or economic and technical cooperation” under Art. 2 is not addressed in the text, and no official position on it was obtained in this round; and (6) offshore personnel who access technical materials in China and then use them abroad — the Regulations contain no counterpart to the “deemed export” rule of US export controls. Both should still be assessed in writing before release or licensing, with the determination retained and, where material, a query put to the commerce authority.

Evidence: Prohibited / restricted / free classification field in the technology asset register, with its update history; Decision and approval record terminating a transaction after a prohibited-class hit; Per-item determination records for technology transferred to offshore subsidiaries and branches; Technology-export determination memorandum for technology contributed as capital or equity into a joint venture; Inventory of outbound licensing and technical-service contracts with the determination reached for each; Pre-release determination record for open-source publication: scope of what is published, assessor, date and conclusion; Authorisation and scope records for offshore personnel accessing domestic technical materials

Embed the technology-export determination into outbound deal structuring: how the offshore entity sources its technology, how IP ownership and licensing run between onshore and offshore entities, where R&D output is created and who owns it, and how technology assets move in M&A and restructurings should all be compared against the Catalogue, with permit feasibility assessed, before the transaction documents are finalised. Also monitor the Catalogue and related announcements: it is administered by MOFCOM with MOST and adjusted from time to time, and an adjustment can move an existing arrangement from free to restricted, triggering a fresh determination.

Evidence: Technology flow map for the deal structure and a note on the IP ownership arrangements; Technology-export compliance memorandum prepared before the transaction documents were finalised; Description of the monitoring mechanism for the Catalogue and related announcements, with the monitoring records; Re-determination records and remediation plans following a Catalogue adjustment; Periodic review records for existing cross-border licensing arrangements

Establish a classification workflow covering everything within Art. 2, including “technical data and other data relating to the items”. Items on the export control list or subject to temporary controls require a licence from the national export control authority. Where an exporter cannot determine whether goods, technology or a service is a controlled item, it may consult the authority, which must respond promptly — a formal route to reduce uncertainty that should be exercised in writing with the reply archived.

Evidence: Classification register giving, for each product, technology or dataset, the conclusion, the list entry relied on and the assessor; Classification records for technical data and datasets: model weights, source code, datasets and design files; Archived written classification enquiries to the national export control authority and the replies received; Description of the review and refresh mechanism, including re-classification after a list adjustment

Investor ESG due diligence pack (for fundraising and pre-IPO)

For goods, technologies and services outside the control list and outside temporary controls, an exporter must apply for a licence where it knows or should know, or is notified by the national export control authority, that the items may endanger national security and interests, be used to design, develop, produce or use weapons of mass destruction or their delivery systems, or be used for terrorist purposes. “Not on the list” is therefore not a safe conclusion, and exporters must operate a red-flag identification mechanism and keep the resulting determinations.

Evidence: Red-flag checklist and the documented screening procedure; Per-transaction red-flag screening records and conclusions, including records where no flag was raised; Escalation approvals and licence applications where a flag was raised; Archived notifications from the national export control authority and the responses made; Catch-all training records for sales and commercial staff

The national export control authority maintains a control list of importers and end users that have breached end-user or end-use requirements, may endanger national security and interests, or have used controlled items for terrorist purposes, and may prohibit or restrict transactions in the relevant items or order exports suspended. Exporters must not transact with listed importers or end users in breach of the rules; where a transaction is genuinely necessary in exceptional circumstances, an application may be made to the authority. In addition, no organisation or individual may provide agency, freight, delivery, customs-clearance, third-party e-commerce platform or financial services in support of an export-control violation (Art. 20).

Evidence: Control-list screening policy and tooling documentation, naming the list sources and refresh frequency; Per-transaction screening records for counterparties and end users, with retained evidence; Handling and escalation records for hits, and archived applications and approvals for any exceptional transaction; Compliance undertakings and screening arrangements for service providers in freight, customs, payments and platforms

Supplier and subcontractor ESG and security due diligence questionnaire (for use as the buyer)

Art. 2 §3 expressly brings within export control the act by PRC citizens, legal persons and unincorporated organisations of providing controlled items to foreign organisations and individuals. On that basis, providing an item to a foreign person can be a controlled export even where the item never leaves China. Companies therefore need access-management controls covering foreign nationals and foreign entities across HR, R&D collaboration, investment due diligence, code repositories and model-weight access, applying for a licence where required. Art. 45 separately provides that transit, transhipment, through-transport, re-export and export from customs special supervision areas and bonded facilities are governed by this Law.

Evidence: Inventory of controlled technical data with classification markings; Authorisation workflow, approval records and access logs for foreign nationals and foreign entities; Screenshots of geographic and personnel access controls on code repositories, model weights and technical documentation; Approval and redaction records for technical disclosures in investment and commercial due diligence; Export licence applications and approvals where required

Consolidate into one funded, staffed, decision-empowered entity what is usually scattered across departments. First, the body and its people: set up the dedicated security management body, put its head and key-post personnel through security background vetting (with the public security and state security organs assisting), and fund and staff it; the principal bears overall responsibility for CII security protection and leads the handling of major incidents. Second, its duties: the body must discharge the eight duties in Art. 15 — establish cybersecurity management and appraisal systems and draft the security protection plan; drive protective capability building and run monitoring, testing and risk assessment; produce the organisation’s emergency plan against national and sector plans, run drills regularly and handle incidents; identify key cybersecurity posts, run appraisals and propose rewards and penalties; organise education and training; carry the responsibility for personal information and data security and build the corresponding systems; apply security management to design, construction, operation and maintenance services; and report incidents and significant matters as required. Third, decision participation: personnel of the body must take part in cybersecurity and informatisation decisions — the easiest duty to disprove in an audit, so meeting minutes need to record their attendance and views. Separately, security measures must be planned, built and brought into use simultaneously with the CII (Art. 12), so a new system’s project approval papers must show the security design moving in the same batch as the main works.

Evidence: Establishment document for the dedicated security management body, with its headcount and budget approvals; Security background vetting records for the body’s head and key-post personnel; Cybersecurity protection system and accountability documents signed off by the principal; Cybersecurity management and appraisal systems, and the CII security protection plan; Execution records for monitoring, testing and risk assessment; The organisation’s cybersecurity incident emergency plan and records of regular drills; List of key cybersecurity posts, appraisal records and reward/penalty proposals; Security education and training plan with training and assessment records; Personal information and data security protection system documents; Systems and inspection records for applying security management to design, construction, operation and maintenance services; Minutes of cybersecurity and informatisation decision meetings recording the body’s attendance and views; Project approval and acceptance documents showing security measures planned, built and used simultaneously with the main works

Two things that must leave timestamps. Testing and assessment (Art. 17): the operator must, itself or through a cybersecurity service provider, conduct at least one cybersecurity test and risk assessment of the CII each year, remediate the problems found promptly, and report as the protection department requires — all three steps are mandatory, and testing without remediation, or remediation without reporting, both fall inside the Art. 39(8) penalty. Incident reporting (Art. 18): on a major cybersecurity incident or a major threat, the operator reports to the protection department and the public security organs under the applicable rules; the Regulations separately enumerate the especially serious cases — the CII ceasing to operate as a whole or its main functions failing, leakage of national basic information or other important data, a relatively large-scale personal information leak, significant economic loss, or wide dissemination of unlawful information — which the protection department escalates to the CAC and the MPS after receiving the report. For the company this means that once any of those five appear the reporting chain escalates to ministry level immediately, so internal severity criteria have to be able to recognise them. Cooperate as well with inspections conducted by the protection department and by the public security, state security, secrecy and cryptography authorities (Art. 28).

Evidence: Annual cybersecurity test and risk assessment report, produced in-house or by an engaged provider; Contract with the cybersecurity service provider and its qualification materials; Remediation register: issue, owner, deadline, verification result; Records and acknowledgements of reports on testing, assessment and remediation made as the protection department requires; Incident severity criteria and classification records, including how the five especially serious scenarios are recognised; Reports of major incidents and major threats to the protection department and the public security organs, with timestamps; Cooperation records for authority inspections and the closed-loop remediation materials

This is where most AI companies actually meet these Regulations: the duty does not land on them directly but comes down through the customer’s procurement contract. Prepare three things in parallel. (1) The security and confidentiality agreement (Art. 20): when a CII operator procures network products and services it must sign such an agreement with the provider under the applicable national rules, specifying the provider’s technical support and security-confidentiality obligations and liabilities, and must supervise performance. The supplier should decide in advance what it can commit to: the term and response times for technical support, notification and fix windows for vulnerabilities, personnel confidentiality and vetting requirements, the boundaries of data processing and retention, limits on subcontracting and onward delegation, liability for breach, and cooperation with audits. (2) Cybersecurity review (Art. 19): operators give priority to secure and trustworthy network products and services, and procurement that may affect national security must pass cybersecurity review under national rules. The supplier needs to be able to produce, quickly, an account of its supply chain, the provenance of key components and open-source dependencies, where development and operations staff sit, data flows and storage locations, and remote-access and update mechanisms. (3) Security management of the service itself (Art. 15(7)): the operator applies security management to design, construction, operation and maintenance services, so the supplier’s implementation and operations personnel, accounts, remote access and change operations fall under the customer’s controls and appraisal — the supplier therefore needs account and operation audit capability it can hand over.

Evidence: Executed security and confidentiality agreements with CII operators and the signing records; Technical support commitments: support term, response times, vulnerability notification and fix windows; Cybersecurity review pack: supply chain composition, provenance list for key components and open-source dependencies, locations of development and operations staff, data flows and storage locations, remote-access and update mechanisms; Personnel confidentiality undertakings and records of the vetting requirements applied; Approval records for subcontracting and onward delegation, with the terms binding the subcontractor; Register of implementation and operations accounts, remote-access approvals and operation audit logs; Self-inspection of performance under the security and confidentiality agreement and records of cooperation with the customer’s supervision

Customer security and privacy questionnaire answer bank (grouped by CAIQ / CCM domains)

Open tool: RFP Model Answers

Art. 31 binds every individual and organisation regardless of operator status: without approval from the CAC or the MPS, or authorisation from the protection department or the operator, no one may carry out vulnerability probing, penetration testing or other activities that could affect or endanger the security of critical information infrastructure; such activities against basic telecommunications networks must be reported to the telecommunications authority in advance. For teams building security testing, red-teaming, attack-surface mapping, automated vulnerability scanning, or AI agents capable of network probing, this constrains product design directly: default scan scope needs a hard allowlist and a do-not-scan list; the authorisation document from the operator or protection department should be a precondition checked before a scan starts rather than paperwork produced afterwards; demo and load-test environments must not point at real CII; and probing initiated by third-party users of the product has to be constrained in the service agreement and in the product at the same time. Individuals given a public-security penalty for a breach are barred for five years from cybersecurity management and key network-operation posts, and for life if criminally punished (Art. 43 §3).

Evidence: Scanning and testing authorisation policy: where authorisation comes from, how it is verified, retention requirements; Written authorisation or approval from the operator or the protection department; Configuration evidence for the product’s target allowlist and do-not-scan list; Design note and sample logs for the pre-scan authorisation check; Proof that demo and load-test environments are isolated from real targets; Service-agreement clauses restricting unauthorised probing by users, with the technical controls that enforce them; Records of advance reports for such activities against basic telecommunications networks, where applicable

Do not decide for yourself whether you are CII, and do not treat “no notice received” as a settled answer. Three things: keep a register recording whether a CII identification notice has ever been received from a protection department, which network facilities and information systems it covers, and the date and reference of the notice; write the trigger for a “material change” into change management — major system rebuilds, a change in the business carried, architecture or hosting changes, moving to or off cloud, and large data migrations should all trigger an assessment and a prompt report to the protection department, which completes a re-identification and notifies the operator within three months of receiving the report; and report any merger, division or dissolution promptly and handle the CII as the protection department requires. As a supplier, the same register should run the other way: which customers are CII operators and which part of their systems you carry, because the customer’s identification status determines which duties land in your contract.

Evidence: Original CII identification notice and the register: systems covered, identification date, notice reference; Procedure document establishing the “material change that may affect identification” gate in change management; Assessment records for material changes and the acknowledgement of the report to the protection department; Re-identification result notice and the corresponding register update; Reporting records and the CII handling plan for a merger, division or dissolution; Customer-side CII status register: which customers are operators and what scope you carry for them

No organisation or individual in China may supply data stored in the PRC to a foreign judicial or law-enforcement body without approval from the competent PRC authority. Businesses need a standing intake-freeze-assess-escalate process for foreign authority requests so that legal or business staff do not hand data over directly under discovery or regulatory pressure.

Evidence: Documented handling procedure for foreign authority requests, including freeze and escalation paths; Intake register recording date, requesting body, data scope and disposition; Approval application filed with the PRC authority and the decision received; Negotiation records or reservations logged against extraterritorial disclosure clauses in offshore customer contracts

Transfer Impact Assessment (TIA) — supporting Clause 14 of the EU Standard Contractual Clauses

Grade every data category against the national classification-and-grading regime and the specific important-data catalogues published by your sector and regional authorities, and determine whether any of it is important data or national core data. Data that has not been notified or publicly designated as important data by the relevant authority need not be declared as such in an outbound security assessment, but the identification exercise itself must leave a written conclusion available for inspection.

Evidence: Data asset inventory and grading register covering data items, sources, grades and owners; Written important-data determination, citing the sector catalogue relied on or recording that no designation was received; The grading policy document and minutes of the review meeting; Change log for grade reclassifications

Outbound Data Transfer Risk Self-Assessment Report (per the CAC filing guide template)

Build whole-lifecycle data security management systems as required by law, run data-security training, and adopt technical and other necessary measures to protect the data. Where processing runs over the internet or other information networks, these duties sit on top of the multi-level protection scheme (MLPS). Important-data processors must in addition designate a data security officer and a data security management body.

Evidence: Data security policy set covering collection, storage, use, processing, transmission, provision, disclosure and deletion; MLPS grading filing certificate and assessment report; Attendance sheets and test records for data security training; Appointment letter for the data security officer and terms of reference for the management body, where important data is processed

Important-data processors must run periodic risk assessments of their processing activities and file the report with the competent authority. The report must cover the categories and volumes of important data handled, the processing activities, the data security risks faced and the countermeasures taken. Art. 33 of the Network Data Security Management Regulations specifies this as an annual exercise filed with a provincial-level or higher authority. From 20 Aug 2026 the Network Data Security Risk Assessment Measures (Order No. 24) make the process concrete: Art. 5 restates the annual cadence for important-data processors and encourages ordinary-data processors to assess at least every three years; Art. 7 allows the assessment to be done in-house or by a third-party assessor; Art. 15 requires the report to be kept for at least three years; Art. 16 requires it to be filed within 20 working days of completing the annual assessment, with the provincial or national cyberspace authority where no competent authority is identified; and Art. 18(4) requires a remediation report within 15 working days where the assessment was mandated through an accredited assessor.

Evidence: Annual important-data risk assessment report covering categories, volumes, risks and countermeasures, archived for at least three years; Filing receipt or submission record from the competent authority, with a timeline comparing the assessment completion date and the filing date to evidence the 20-working-day window; Risk treatment log with closure evidence; Records of the transaction-level risk assessments run before providing, entrusting or jointly processing important data

Outbound Data Transfer Risk Self-Assessment Report (per the CAC filing guide template)

Data that constitutes a controlled item and relates to safeguarding national security and interests or performing international obligations is subject to export control. Businesses should fold the question “is this data a controlled item?” into their export-control classification workflow and connect it to the licensing and end-user screening steps under the Export Control Law and the Dual-Use Items Regulations, rather than treating it purely as a personal-information transfer.

Evidence: Export-control classification worksheet giving a per-dataset conclusion on controlled-item status and the reasoning; Note describing how this ties into the internal export-control compliance programme; Approval records for transfers involving controlled data; Correspondence with MOFCOM and any reply received, where a classification enquiry was raised

Processing personal information requires the individual consent or another statutory basis. Where personal information outside the vehicle is collected for driving safety and cannot be consented to but is provided outside the vehicle, it must be anonymised, including by deleting frames that can identify a natural person or by applying local contouring to facial information. For sensitive personal information the processor must additionally: have a purpose directly serving the individual, including enhancing driving safety, intelligent driving or navigation; conspicuously inform of the necessity and the impact on the individual; obtain separate consent, with the individual free to set the consent period; indicate the collection status in an appropriate manner while preserving driving safety and make it easy to terminate collection; and delete the information within ten working days where the individual so requests. Fingerprint, voiceprint, facial and heart rhythm biometric data may be collected only where there is a driving safety purpose and sufficient necessity.

Evidence: Interaction design and stored consent records for separate consent, including the user-set consent period; Necessity justification for collecting biometric characteristics; Anonymisation scheme for off-vehicle personal information and its effectiveness validation report; Test records for the collection status indicator and the terminate-collection function; Deletion request ledger showing performance against the ten-working-day deadline

Personal Information Protection Impact Assessment (PIPIA) report

An automotive data processor carrying out important data processing must conduct a risk assessment as prescribed and file the risk assessment report with the provincial cyberspace administration and relevant departments. The report must cover the types, volumes, scope, storage location and period and use of the important data processed, the data processing activities and whether the data is provided to third parties, the data security risks faced and the response measures. Companies must first map their data against the six enumerated categories, the two most easily missed being off-vehicle video and images containing faces or licence plates, and personal information involving more than 100,000 subjects.

Evidence: Item-by-item identification and determination record against the six important data categories; Important data inventory (types, volumes, scope, storage location and period, use); Risk assessment report and the filing acknowledgement from the provincial cyberspace administration; Register of provision to third parties with the underlying agreements

Outbound Data Transfer Risk Self-Assessment Report (per the CAC filing guide template)

Important data must be stored within China. Where a genuine business need requires providing it abroad, it must pass the security assessment organised by the national cyberspace department together with the relevant State Council departments; outbound management of personal information data not classified as important data follows the applicable laws and administrative regulations. Where an international treaty or agreement concluded or acceded to by China provides otherwise, that treaty or agreement applies, except for reserved clauses. Outbound provision of important data must not exceed the purpose, scope, means, data types and volumes confirmed in the security assessment; the authorities verify this by spot checks and the processor must cooperate and present the data in a readable and convenient form.

Evidence: Outbound data transfer security assessment filing and the assessment outcome; Domestic storage architecture description and data flow diagrams; Control checklist implementing the approved purpose, scope, means, data types and volumes; Demonstration record of the readable presentation capability for spot checks; Data processing agreement with the overseas recipient and onward transfer restrictions

Outbound Data Transfer Risk Self-Assessment Report (per the CAC filing guide template)

Open tool: Transfer Matrix

When processing personal information the processor must inform individuals, through conspicuous means such as the user manual, in-vehicle display panel, voice prompts or the vehicle app, of: the categories of personal information processed, including trajectory, driving habits, audio, video, images and biometric characteristics; the specific contexts in which each category is collected and how to stop collection; the purposes, uses and methods of processing; the storage location and retention period or the rules determining them; how to access and copy the personal information and to delete it in the vehicle or request deletion of information already provided outside the vehicle; the name and contact details of the user rights contact person; and any other matters required by law or administrative regulation.

Evidence: Copy and placement inventory covering the seven notice items across manual, head unit, voice and app; Archived screenshots of the in-vehicle and app notices; Appointment document for the user rights contact person and the record of publishing the details; Functional test records for the stop-collection control

Personal Information Protection Impact Assessment (PIPIA) report

Automotive data processors carrying out important data processing must report to the provincial cyberspace administration and relevant departments by 15 December each year: the names and contact details of the automotive data security management officer and the user rights contact person; the types, scale, purposes and necessity of the automotive data processed; the security protection and management measures including storage location and period; the provision of automotive data to domestic third parties; automotive data security incidents and how they were handled; user complaints relating to automotive data and their handling; and other matters specified by the authorities. Processors providing important data abroad must additionally report the basic situation of the recipient, the types, scale, purpose and necessity of the outbound data, the storage location, period, scope and means abroad, user complaints relating to outbound provision and their handling, and other matters specified by the authorities.

Evidence: Annual automotive data security management report and the filing acknowledgement; Appointment documents for the data security management officer and the user rights contact person; Register of provision to domestic third parties; Ledger of data security incidents and user complaint handling; For outbound transfers, documentation of the recipient and of the storage location, period, scope and means abroad

Automotive data processors must set up complaint and reporting channels with a convenient entry point and handle user complaints and reports promptly, and bear liability where lawful user rights or the public interest are harmed. The national cyberspace department and the development and reform, industry and information technology, public security and transport departments conduct data security assessments of automotive data processors according to their remits and the data processing situation, and the processor must cooperate; institutions and personnel taking part in the assessment owe confidentiality obligations for trade secrets and undisclosed information learned during it.

Evidence: Complaint and reporting entry point and the response time policy; Complaint handling ledger and case closure records; Named liaison and document checklist for cooperating with authority data security assessments; Records of trade secret protection handling during the assessment

Pin each processing activity to one of the lawful bases in Art. 13 (consent; necessity for a contract to which the individual is a party; a statutory duty; public-health emergencies; news reporting in the public interest; reasonable handling of lawfully published information, etc.), and before processing give prominent, plain-language notice of the processor’s name and contact details, the purposes and methods, the categories of data and the retention period, and how to exercise rights; re-notify when any of this changes. Where notice is given through a processing rule (privacy policy), that rule must be public and easy to consult and retain.

Evidence: Register of processing activities, each tagged with its Art. 13 lawful basis; Public privacy policy / processing rules with version history and effective dates; Screenshots of the consent interface and consent logs (timestamp, policy version); Records of re-notification when notified items changed

Personal Information Protection Impact Assessment (PIPIA) report

For biometric data (face, voiceprint, fingerprint), medical and health data, financial accounts, location traces and the data of minors under 14, first document a “specific purpose + sufficient necessity + strict protective measures” justification, then obtain separate consent that is not bundled into a blanket consent, and additionally disclose the necessity of the processing and its impact on the individual. Where a law or administrative regulation requires written consent, that requirement prevails.

Evidence: Written necessity justification for sensitive processing, naming the specific purpose and the alternatives considered; Design note and captured screens showing how separate consent is collected; Separate-consent logs kept distinct from general consent records; Guardian consent records and the age-assurance approach for under-14 users; Inventory of strict protective measures (encryption, de-identification, least-privilege access)

Personal Information Protection Impact Assessment (PIPIA) report

Run a prior impact assessment and keep a record of the processing in five situations: processing sensitive personal information; automated decision-making; entrusting processing to, providing data to, or publicly disclosing data to another processor; transferring data abroad; and any other processing with a significant effect on individuals. The assessment must at minimum cover the lawfulness, legitimacy and necessity of the purpose and method, the impact on individuals and the security risks, and whether the protective measures are lawful, effective and proportionate to the risk. The report and processing records must be kept for at least three years.

Evidence: PIPIA report structured around the three elements of Art. 56; Trigger-mapping table showing which limb prompted which assessment; Processing records covering data flows, recipients and retention periods; Remediation log arising from the assessment, with closure evidence; Archive index demonstrating the three-year retention

Outbound Data Transfer Risk Self-Assessment Report (per the CAC filing guide template)Personal Information Protection Impact Assessment (PIPIA) reportCustomer security and privacy questionnaire answer bank (grouped by CAIQ / CCM domains)

Where personal information is or may have been leaked, tampered with or lost, take remedial action immediately and notify both the competent authority and the affected individuals. The notice must state the categories of data, the cause and the likely harm; the remedial measures taken and the steps individuals can take to mitigate harm; and the processor’s contact details. Individual notice may be omitted where the measures taken effectively avert harm, but the authority may still require it.

Evidence: Personal-data incident response plan and drill records; Severity classification records, including whether the notification threshold was met and why; Text of the notice to the authority and the filing receipt; Text of the notice to individuals, the channels used and delivery statistics; or the justification for withholding individual notice; Post-incident review report and closure evidence for remediation items

AI incident and serious incident reporting record (register plus report drafts)

Automated decision-making must be transparent and fair in outcome, and must not impose unreasonable differential treatment on transaction terms such as price. Where automated decision-making is used to push information or marketing, the processor must at the same time offer an option not based on the individual’s characteristics, or a convenient way to refuse. Where an automated decision has a significant effect on an individual’s rights, the individual may demand an explanation and may refuse a decision made solely by automated means.

Evidence: Inventory of automated decisions (scenario, input features, output impact, whether significant); Self-assessment report on differential treatment, with fairness test results across price, limit and exposure; Product screenshots and release records for the non-profiled option or one-click off switch; Explanation template and human-review workflow for decisions with significant effect

Personal Information Protection Impact Assessment (PIPIA) report

Stand up an intake-and-response mechanism covering access, copies, correction, supplementation, deletion, restriction or refusal of processing, withdrawal of consent and account closure, and satisfy requests promptly. Where a transfer request meets the conditions set by the CAC, provide a channel to move the data to a processor named by the individual. Delete proactively where the purpose has been achieved, the product or service has ceased, the retention period has expired, consent has been withdrawn, or the processing breached the law or the contract; where deletion is technically infeasible, stop all processing other than storage and necessary security measures.

Evidence: Documented intake workflow for rights requests with a response-time SLA; Ticket log for requests, recording identity verification, outcome and completion time; Technical note on deletion and anonymisation, including how vector stores and training sets are traced back; Specification of the portability interface, or a record of the reasons for refusal

Personal Information Protection Impact Assessment (PIPIA) report

A processor handling personal information above the volume set by the CAC must appoint a personal information protection officer, publish the officer’s contact details and report the officer’s name and contact details to the competent authority. The Compliance Audit Measures put numbers on this: processors handling more than 1 million individuals’ data must appoint such an officer, who owns the audit work; processors handling more than 10 million individuals’ data must run a compliance audit at least once every two years. The authority may also require an audit by an accredited external firm, after which the report must be filed and a remediation report submitted within 15 working days of completing the fixes.

Evidence: Appointment letter for the protection officer and a screenshot of the public disclosure page; Filing receipt for reporting the officer’s name and contact details to the authority; Compliance audit report (in-house or by an accredited firm); Remediation log for audit findings and the receipt for the remediation report; Methodology note and monthly counts for the number of individuals whose data is processed

Personal Information Protection Impact Assessment (PIPIA) reportSOC 2 Type II readiness checklist (Trust Services Criteria)Investor ESG due diligence pack (for fundraising and pre-IPO)

A provider with public-opinion attributes or social-mobilisation capability must, within ten working days of starting the service, file through the internet information service algorithm filing system its name, service form, application field, algorithm type, algorithm self-assessment report and the content to be published. Where the materials are complete the authority grants the filing, issues a filing number and publishes it within thirty working days; where incomplete, it notifies the applicant with reasons within thirty working days. Once filed, the provider must display the filing number prominently on the website or application through which the service is offered, with a link to the published information. It must also carry out a security assessment under the applicable national rules.

Evidence: Submission record from the algorithm filing system and the filing number; Algorithm self-assessment report; Text of the content to be published and a reconciliation against the live disclosure page; Screenshots showing the filing number and the link to the published information in a prominent product location; Timeline comparing the service launch date with the filing submission date to evidence the ten-working-day window; Records of amendment and cancellation filings

Filing pack for generative AI services and algorithm filing, including the security assessment report

Establish management systems and technical measures for reviewing algorithm mechanisms, science and technology ethics review, user registration, content-publication review, data security and personal information protection, anti-telecom-fraud, security assessment and monitoring, and incident response; adopt and publish the rules governing the recommendation service; and resource it with specialist staff and technical support proportionate to its scale.

Evidence: The eight management policies with issuance records; Screenshot of the publicly published recommendation-service rules; Org chart and qualification summary for the algorithm security team; Ethics review records, with a note on the joint build with the Science and Technology Ethics Review Measures

Filing pack for generative AI services and algorithm filing, including the security assessment report

Periodically review, evaluate and validate the algorithm’s mechanisms, models, data and application outcomes, and do not deploy models that induce addiction or excessive consumption or otherwise breach the law or ethics. The review should cover both offline metrics and live outcomes, focusing on whether the system induces addiction or excessive spending and whether outcomes discriminate against particular groups.

Evidence: Plan for periodic algorithm review, evaluation and validation, stating cadence, scope, metrics, method and owner; Successive review reports covering the model, the data and live outcomes; Dedicated assessment conclusions on addiction and excessive-consumption risk; Remediation records for findings and the re-validation results

Filing pack for generative AI services and algorithm filing, including the security assessment report

Strengthen user-model and user-tag management, refine the rules for what interests enter the user model and how tags are managed, and do not record unlawful or harmful keywords as user interests or tags, nor push content on that basis. Also strengthen information-security management by building a feature library for identifying unlawful and harmful information with sound inclusion standards, rules and procedures; where algorithmically generated or synthetic information is found without a conspicuous label, apply the label before transmission continues.

Evidence: User-tag taxonomy documentation and the rules governing what enters the interest profile; Blocklist of unlawful and harmful keywords and its enforcement configuration in the tagging system; Inclusion standards, rules and procedures for the feature library, with version history; Technical design and operating statistics for detecting and re-labelling unlabelled generated content

Give users prominent notice that an algorithmic recommendation service is being provided, and publish in an appropriate manner the basic principles, purpose and main operating mechanism of that service. Provide an option that is not targeted at the user’s personal characteristics, or a convenient option to switch the recommendation service off; where the user switches it off, stop providing the service immediately. Both articles are named in Art. 31 as penalty triggers and are frequent inspection items in practice.

Evidence: Screenshots of the notice and published disclosure, covering the basic principles, purpose and main operating mechanism; Product screenshots and navigation path for the non-profiled option or the off switch; Technical verification that switching off takes immediate effect; Reconciliation between the published disclosure and the “content to be published” submitted in the algorithm filing

Filing pack for generative AI services and algorithm filing, including the security assessment report

Where the service reaches minors, perform the statutory duties of online protection for minors and make it easier for them to access information beneficial to their physical and mental health, including through a minors mode and age-appropriate services. Where it reaches the elderly, safeguard their lawful rights, provide age-friendly intelligent services under the applicable national rules, and monitor, identify and handle telecom-fraud content. Where algorithms dispatch work to labourers, protect their rights to remuneration and rest, and build sound algorithms for order allocation, pay composition and payment, working hours and incentives and penalties. Where goods or services are sold to consumers, protect fair-dealing rights and do not use algorithms to impose unreasonable differential treatment on price or other terms based on consumers’ preferences or transaction habits.

Evidence: Design documentation and release evidence for the minors mode; Age-friendly adaptation plan and records of monitoring and handling fraud-related content; Documented and published rules for order allocation, remuneration, working hours and incentives in work-dispatch algorithms; Fairness test report on price differentiation, analysing price distribution for the same item across user profiles

Before applying, run a self-assessment covering six points: the lawfulness, legitimacy and necessity of the purpose, scope and method of the transfer and of the recipient’s processing; the volume, scope, categories and sensitivity of the data and the risks the transfer may create; whether the recipient’s undertakings and its management and technical capability can secure the data; the risk of tampering, destruction, leakage, loss, transfer or unlawful acquisition or use during and after the transfer, and whether individuals have a workable channel to protect their rights; whether the draft legal instrument adequately allocates data-security responsibilities; and any other matter bearing on the security of the transfer.

Evidence: Self-assessment report addressing each of the six points in Art. 5; Field-level inventory of the data to be transferred, tagged with category, volume and sensitivity; Due-diligence pack on the offshore recipient covering its jurisdiction’s legal environment, security capability and incident history; Register of risk-mitigation measures tied to the self-assessment conclusions; Internal approval records signed by legal, security and the business owner

Outbound Data Transfer Risk Self-Assessment Report (per the CAC filing guide template)

Open tool: Transfer Matrix

Submit the application form, the self-assessment report, the draft legal instrument with the offshore recipient and any other materials the assessment requires (Art. 6). The provincial authority completes the completeness check within five working days of receipt, forwarding a complete pack to the CAC and returning an incomplete one with a single consolidated list of what is missing (Art. 7). Once the CAC accepts the filing it issues a written acceptance notice, and the assessment must be completed within 45 working days of that notice, extendable with notice where the case is complex or materials need correction (Art. 12). A party disputing the outcome may apply for re-assessment within 15 working days of receiving it, and the re-assessment result is final (Art. 13). The Measures themselves set no “decide on acceptance within N working days” rule; the acceptance-stage timetable sits in the CAC’s Application Guide for the Security Assessment of Outbound Data Transfers, whose text was not retrieved in this round, so no day count is stated here.

Evidence: Archived application form and the complete submission pack; Completeness-check receipt from the provincial authority and the CAC’s written acceptance notice; Correspondence on any supplementary or corrected materials; Written notice of the assessment result and, if re-assessment was sought, the application and final conclusion

Outbound Data Transfer Risk Self-Assessment Report (per the CAC filing guide template)

Open tool: Transfer Matrix

The legal instrument must at minimum address: the purpose, method and scope of the transfer and the recipient’s use and method of processing; where and for how long the data is stored abroad, and how it is handled once the retention period ends, the agreed purpose is achieved or the instrument terminates; binding restrictions on onward transfers by the recipient; the security measures to be taken if the recipient’s actual control or business scope materially changes, if the data-security laws or cybersecurity environment of its jurisdiction change, or if another force majeure makes security hard to assure; remedies, liability for breach and dispute resolution; and the emergency-response requirements and the routes by which individuals can protect their rights if the data is tampered with, destroyed, leaked, lost, transferred or unlawfully acquired or used.

Evidence: Executed legal instrument with the offshore recipient, in a bilingual version; Mapping table from the six mandatory matters to the specific clause numbers; Onward-transfer approval process and the list of approved onward recipients; Monitoring and trigger-response records for changes in the recipient’s control or legal environment

Outbound Data Transfer Risk Self-Assessment Report (per the CAC filing guide template)

An approval is valid for three years (Art. 9 of the Cross-border Data Flow Provisions supersedes the original two-year period). To continue transferring after expiry without a re-application trigger, apply through the provincial authority within 60 working days before expiry; once approved the validity extends by a further three years. Re-application is required during the validity period where the purpose, method, scope or categories of the transfer, or the recipient’s use or method, change in a way that affects security, or the offshore retention period is extended; where the data-security laws or cybersecurity environment of the recipient’s jurisdiction change, force majeure occurs, actual control of either party changes, or the legal instrument is amended in a way that affects security; or in any other circumstance affecting the security of the transfer.

Evidence: Register of approvals and validity periods, with expiry reminders configured; Extension application materials and the approval document; Change log for transfer parameters (fields, recipients, regions, purposes); Records of re-application trigger assessments and the conclusions reached

Outbound Data Transfer Risk Self-Assessment Report (per the CAC filing guide template)

Art. 16: apply technical measures to add a label that does not impede use to any content generated or edited through the service, and retain log information as required by law and national rules. Art. 17: where the service provides intelligent dialogue or intelligent writing that simulates a natural person generating or editing text; synthetic or imitative voice generation or editing that significantly alters personal identity characteristics; face generation, face swapping, face manipulation or pose manipulation in images and video, or editing that significantly alters personal identity characteristics; immersive realistic scene generation or editing; or any other function that generates or significantly alters content — and the output may cause the public to confuse or mistake it — a conspicuous label must be placed at a reasonable position or area within the content. For deep synthesis services outside that list, the provider must offer a conspicuous-labelling function and remind users that they may use it.

Evidence: Mapping table comparing each service function against the five categories in Art. 17 §1; Implementation note for conspicuous and implicit labels, with samples for each modality; Design justification that the label does not impede use; Log retention policy and screenshots of the retention configuration; Description of the mechanism for detecting and responding to deleted, altered or concealed labels

Filing pack for generative AI services and algorithm filing, including the security assessment report

A deep synthesis service provider with public-opinion attributes or social-mobilisation capability must complete algorithm filing, and amendment and cancellation filings, under the Algorithmic Recommendation Provisions. Where it develops and launches a new product, application or feature with such attributes, it must carry out a security assessment under the applicable national rules. The assessment is therefore not a one-off but recurs with each significant launch.

Evidence: Algorithm filing pack and a screenshot of the published filing number; Records of amendment and cancellation filings; Trigger-determination table and release checklist for new products, applications and features; Successive security assessment reports and submission records

Filing pack for generative AI services and algorithm filing, including the security assessment report

Assume primary responsibility for information security by establishing management systems for user registration, review of algorithm mechanisms, science and technology ethics review, content-publication review, data security, personal information protection, anti-telecom-fraud and emergency response, backed by secure and controllable technical safeguards. Also adopt and publish management rules and a platform convention, refine the service agreement, and prominently remind technical supporters and users of their information-security duties.

Evidence: The eight management policies with their issuance and effective-date records; Establishment documents and review records for the science and technology ethics committee, with a note on the joint build with the Ethics Review Measures; Screenshots of the published management rules and platform convention; Information-security notice clauses in the service agreement and evidence of how they are displayed; Description of the technical safeguards, with a security and controllability justification

Filing pack for generative AI services and algorithm filing, including the security assessment report

Authenticate users’ real identity through their mobile number, identity-document number, unified social credit code or the national network identity authentication public service, and do not provide information-publishing services to users who have not been authenticated. Where an enterprise customer is authenticated by its unified social credit code, the individual operating accounts underneath must still be traceable.

Evidence: Real-identity authentication design: factors used, verification channel and failure handling; Product evidence that publishing is blocked for unauthenticated users; Mapping and audit records linking enterprise customer accounts to the individuals operating them; Note on data minimisation and encrypted storage of authentication data

Strengthen content management by reviewing users’ input data and synthetic outputs, whether by technical means or manually. Maintain a rumour-refutation mechanism: on finding that the service has been used to create, copy, publish or spread false information, take refutation measures promptly, retain the records, and report to the cyberspace authority and other competent departments. Also provide convenient entry points for user appeals and public complaints and reports, publishing the handling process and response times.

Evidence: Input and output review policy covering technical rules and the manual escalation path; Verification workflow for likeness and voice authorisation, with sample authorisations; Description of the rumour-refutation mechanism, refutation records and receipts for reports to the authority; Screenshots of the appeal and complaint entry points and the published process and response times; Retention policy for review records

Filing pack for generative AI services and algorithm filing, including the security assessment report

Deep synthesis service providers and technical supporters must strengthen training-data management and take the necessary measures to keep training data secure; where training data contains personal information, the personal-information rules apply. They must also strengthen technical management by periodically reviewing, evaluating and validating the mechanisms of their generative and synthetic algorithms. Both duties bind technical supporters, that is base-model and SDK vendors.

Evidence: Training-data security policy with grading and access-control records; Lawful basis and processing records for personal information within training data; Plan for periodic algorithm review, evaluation and validation, stating cadence, metrics and method; Successive review reports and the remediation records for findings; Agreement allocating duties between the technical supporter and the provider

Data Card — datasheet for a training, validation or test datasetFiling pack for generative AI services and algorithm filing, including the security assessment report

Before settling on the standard-contract route, confirm in writing that all four conditions in Art. 4 are met: not a CIIO; processing the personal information of fewer than 1 million individuals; cumulative outbound transfers of fewer than 100,000 individuals’ personal information; and cumulative outbound transfers of fewer than 10,000 individuals’ sensitive personal information. Failing any one of them forces the security-assessment route, and retrofitting is expensive. Volumes are counted cumulatively from 1 January of the current year under Arts. 7 and 8 of CAC Order No. 16, which supersede the “since 1 January of the preceding year” wording in Art. 4 of these Measures. Separately confirm that the export contains no important data: important data must go through the security assessment (Art. 37 of the Network Data Security Management Regulations). That is not one of the four Art. 4 conditions, but it must be ruled out before the route is chosen.

Evidence: Route-selection memo setting out the conclusion and basis for each of the four Art. 4 conditions; Statement on CIIO status, recording whether a designation notice was received; Counts of individuals processed and cumulatively transferred, with the counting methodology; Important-data determination showing the export contains no important data

Outbound Data Transfer Risk Self-Assessment Report (per the CAC filing guide template)

Open tool: Transfer Matrix

Art. 6 §1 requires the standard contract to be executed strictly in the form annexed to the Measures; §2 allows the parties to add other terms provided they do not conflict with the standard clauses; and §3 provides that the outbound transfer may only begin once the standard contract has taken effect. The CAC may adjust the annex, so confirm you are using the current version before signing. Note the sequencing in §3: sign, let the contract take effect, then transfer, then file within ten working days — the contract cannot be papered over while data is already moving.

Evidence: Executed standard contract including the signature pages and annexes; Note on the provenance of the template version used and the version check performed; Schedule of supplementary terms and a legal opinion that they do not conflict with the standard clauses; Evidence of the offshore recipient’s internal signing authority

Before the transfer, run a personal information protection impact assessment focused on the matters enumerated in Art. 5 of the Measures, produced together with the assessment required by PIPL Arts. 55–56. The report is filed alongside the standard contract and is the principal document examined in any subsequent supervisory check.

Evidence: Outbound transfer impact assessment report including an analysis of the recipient jurisdiction’s legal environment; Field-level inventory of the personal information transferred, with a minimisation and necessity justification; Due-diligence pack on the recipient’s security capability; Risk-mitigation measures arising from the assessment, with evidence of implementation

Personal Information Protection Impact Assessment (PIPIA) report

File with the provincial cyberspace authority within ten working days of the standard contract taking effect, submitting the contract and the impact assessment report among other materials. Where any circumstance listed in Art. 8 arises during the term, re-run the impact assessment, supplement or re-execute the standard contract, and complete the corresponding filing.

Evidence: Filing receipt or system submission record from the provincial authority, with the submission timestamp; Archived filing pack (standard contract plus impact assessment report); Timeline record comparing the contract effective date with the filing date to evidence the ten-working-day window; Trigger determinations and execution records for re-assessment and re-filing

Personal Information Protection Impact Assessment (PIPIA) reportOutbound Data Transfer Risk Self-Assessment Report (per the CAC filing guide template)

Conduct pre-training, fine-tuning and other training-data processing lawfully: use data and foundation models from lawful sources; do not infringe others’ intellectual property rights; where personal information is involved, obtain the individual’s consent or rely on another statutory basis; take effective measures to improve training-data quality, strengthening its authenticity, accuracy, objectivity and diversity; and comply with the other requirements of the Cybersecurity Law, the Data Security Law, the Personal Information Protection Law and the supervisory requirements of the competent authorities.

Evidence: Training-data provenance register covering dataset name, source, acquisition method, licence or authorisation, and usage restrictions; Foundation-model licences and a compliance note comparing open-source licence terms against actual use; IP risk screening records (copyright, trade marks, database rights) and the removal list; Statement of the lawful basis for personal information in the corpus, with de-identification and cleaning records; Training-data quality evaluation report across authenticity, accuracy, objectivity and diversity

Filing pack for generative AI services and algorithm filing, including the security assessment reportData Card — datasheet for a training, validation or test dataset

Protect users’ inputs and usage records as required by law: do not collect unnecessary personal information; do not unlawfully retain inputs and usage records capable of identifying the user; and do not unlawfully provide users’ inputs and usage records to others. Promptly handle individuals’ requests to access, copy, correct, supplement or delete their personal information. This directly constrains the practice of feeding user conversations into training sets by default, which needs separate, revocable authorisation and a deletion path that actually works.

Evidence: Field inventory, retention periods and minimisation justification for inputs and usage records; Product evidence of a separate, revocable authorisation for using conversations in training; De-identification design for identity-revealing content and a technical verification report; End-to-end records showing rights requests executed across conversation logs, training sets and vector stores

Personal Information Protection Impact Assessment (PIPIA) report

On discovering unlawful content, promptly stop generation, stop transmission and remove it, remediate through measures such as model optimisation and retraining, and report to the competent authority. On discovering a user engaging in unlawful activity through the service, issue warnings, restrict features, or suspend or terminate the service under law and contract, retain the relevant records, and report to the competent authority. Also maintain a complaints and reporting mechanism with a convenient entry point, publish the handling process and response times, and deal with and respond to reports promptly.

Evidence: Content-safety review policy and the criteria for identifying unlawful content; Ticket log for unlawful content, recording detection time, action taken and completion time; Model remediation records: alignment data, safety fine-tuning, and before-and-after evaluation results; Records of reports to the competent authority and the receipts; Screenshots of the complaints entry point, the published process and response times, and the disposition log

AI incident and serious incident reporting record (register plus report drafts)

A provider of generative AI services with public-opinion attributes or social-mobilisation capability must carry out a security assessment under the applicable national rules and complete algorithm filing, together with amendment and cancellation filings, under the Algorithmic Recommendation Provisions. Art. 24 of those Provisions sets the filing deadline at ten working days from the start of the service, and once filed the provider must display the filing number prominently on its website or application with a link to the published information. From 1 September 2025, filing and assessment submissions must also include the labelling materials required by Art. 12 of the Labelling Measures.

Evidence: Determination record and reasoning on public-opinion attributes or social-mobilisation capability; Security assessment report with submission and feedback records; Algorithm filing pack: provider name, service form, application field, algorithm type, algorithm self-assessment report and the content to be published; Screenshots showing the filing number and the link to published information in a prominent product location; Records of amendment and cancellation filings; The labelling documentation included in the filing and assessment submissions

Filing pack for generative AI services and algorithm filing, including the security assessment reportISO/IEC 42001 AI management system implementation and certification readiness checklistInvestor ESG due diligence pack (for fundraising and pre-IPO)

Providers must label generated images, video and similar content as required by the Deep Synthesis Provisions. From 1 September 2025 the method is set by the AI Content Labelling Measures and mandatory national standard GB 45438-2025: content falling within Art. 17 §1 of the Deep Synthesis Provisions requires an explicit label, and all generated and synthetic content requires an implicit label in the file metadata.

Evidence: Labelling design note covering explicit label placement and style and the implicit metadata fields; API documentation showing metadata carried in outputs, plus captured traffic or sample files; Labelled samples retained for each modality: text, image, audio, video and virtual scenes; Self-assessment records against GB 45438-2025

Filing pack for generative AI services and algorithm filing, including the security assessment report

Where data is annotated during technical development, adopt clear, specific and operable annotation rules that meet these Measures; run annotation quality evaluation with sampling checks on accuracy; and provide the necessary training to annotators to raise their awareness of legal compliance, supervising and guiding them in performing the work properly. Outsourcing annotation does not transfer these duties away from the provider.

Evidence: Annotation rulebook, including criteria for unlawful and harmful information and rules for handling discriminatory content; Sampling plan for annotation quality and successive evaluation reports, showing sampling rate, accuracy and rework records; Annotator training materials, attendance records and test results; Vendor qualification review, contract and oversight records for outsourced annotation

Filing pack for generative AI services and algorithm filing, including the security assessment reportData Card — datasheet for a training, validation or test dataset

Assume the responsibilities of a network information content producer and the duties of network information security, and where personal information is involved, the responsibilities of a personal information processor. Execute a service agreement with registered users that sets out both parties’ rights and obligations; state and publish the intended user groups, settings and uses of the service, guiding users towards an informed and lawful understanding of generative AI; and adopt effective measures to prevent minors from becoming over-reliant on, or addicted to, the service.

Evidence: User service agreement covering rights and obligations, usage limits and notice of labelling duties; Screenshots of the published statement of intended user groups, settings and uses; Design documentation and release evidence for anti-addiction measures (time limits, content grading, guardian controls); Captured screens for usage guidance and risk warnings

Filing pack for generative AI services and algorithm filing, including the security assessment report

The pilot manufacturer must refine the access testing and safety assessment scheme for the ICV product; after MIIT and the Ministry of Public Security confirm it, testing and safety assessment are carried out under the supervision of the provincial authorities and the city government where the vehicles operate, while MIIT commissions technical service institutions to assess the scheme, its execution and its results. The manufacturer must connect the vehicles to the MIIT pilot management system in accordance with the monitoring requirements. Only after passing may the product access application be filed with MIIT, which decides after acceptance, examination and public notice and then announces the approved product together with the validity period, area of operation and other restrictions.

Evidence: Access testing and safety assessment scheme with the confirmation record from the two ministries; Execution records of the testing and safety assessment, with proving-ground and road test reports; Technical service institution assessment report and issue closure records; Integration plan and data submission records for connecting vehicles to the MIIT pilot management system; Product access application dossier and the access announcement stating validity period and area of operation

During the pilot, for traffic accidents, cyber and data security incidents, or emergencies caused by failure of the vehicle automated driving system, the pilot user entity, the pilot manufacturer and the city government department must respond in accordance with the relevant emergency plans and report the response process and results to the provincial authority in good time, which in turn reports to MIIT, the Ministry of Public Security, MOHURD and the Ministry of Transport.

Evidence: Dedicated emergency plans for traffic accidents and for cyber and data security incidents; Emergency drill records and improvement items; Incident response ledger with timeline, measures and outcome; Submission records and acknowledgements of reports to the provincial authority

AI incident and serious incident reporting record (register plus report drafts)

The vehicle manufacturer and the user entity form a consortium and prepare an application scheme following the trial Implementation Guide (template in Annex 2). After the government of the city where the vehicles are to operate (including districts of municipalities) consents and affixes its seal, the consortium applies voluntarily to the provincial industry and information technology department; the city must have the necessary policy, infrastructure and safety management conditions. The provincial department reviews it together with the traffic management and cybersecurity police, housing and urban-rural development, transport and communications administrations, then submits it to MIIT, where the four ministries organise an expert preliminary review and select the consortia admitted to the pilot.

Evidence: Consortium agreement and allocation of responsibilities; Pilot application scheme prepared to the official template; Consent letter from the city government with official seal; Joint review opinion of the five provincial authorities and the submission record

Approved ICV products operate on the road within a defined area. The pilot user entity must insure the vehicles as required, apply for registration, monitor their operating status and strengthen operational safety; where a change of pilot user entity is requested before registration, supplementary materials must be submitted. Where the vehicles are used for commercial transport, the user entity must also hold the corresponding transport business qualification and meet operational management requirements.

Evidence: Vehicle insurance policies and an adequacy justification; Registration certificates and documentation of the permitted operating area; Design and duty records of the vehicle operating status monitoring platform; Transport business licences and operational management rules; Supplementary materials and approval for any change of pilot user entity

The pilot manufacturer bears primary responsibility for product quality and production consistency, must not change automated driving functions without authorisation, and must strictly comply with software update management and filing commitments. The pilot user entity must discharge primary responsibility for road traffic safety, cybersecurity and data security and establish sound safety management rules to ensure safe operation. In practice the OTA release process must be tied to a documented test of whether a change alters the automated driving function and to the filing triggers.

Evidence: Criteria for determining a change to the automated driving function and the per-release determination records; Software update management rules and records evidencing compliance with the filing commitments; Production consistency control plan and inspection records; Road traffic safety, cybersecurity and data security management rules of the user entity

For an activity on the managed list, after clearing the committee’s initial review the entity applies to its local or sector authority to organise an expert re-review; where several entities participate, the lead entity consolidates the application. The submission comprises the Art. 9 materials, the committee’s initial opinion and anything else the organising body requires. The expert panel issues an agree or disagree opinion requiring at least a two-thirds majority of all panel experts; the local or sector authority should normally respond within 30 days of receiving the application; and the entity’s committee then makes its review decision in light of that opinion. The list is published and dynamically adjusted by MOST, and its three AI-relevant items are: research and development of human-machine integrated systems with a strong influence on human subjective behaviour, psychological emotions and life and health; research and development of algorithmic models, applications and systems capable of mobilising public opinion and society and guiding social consciousness; and research and development of highly autonomous automated decision systems for scenarios involving safety or personal-health risks.

Evidence: Determination records mapping each R&D project against the seven annexed items; The committee’s initial review opinion; Re-review application submitted to the local or sector authority and the acceptance record; The expert panel’s written opinion and voting record; The final review decision made in light of that opinion, with records of any required changes; Monitoring records for MOST’s dynamic adjustments to the list

An entity engaged in life sciences, medicine, artificial intelligence or similar activities whose research touches ethically sensitive areas must establish a science and technology ethics (review) committee. The entity must provide the committee with the necessary staff, premises and funding, and take effective measures to secure its independence. The committee’s duties include adopting management systems and working rules; providing ethics advice and guiding risk assessment; conducting reviews and monitoring the activity throughout; determining whether an activity falls within the Art. 25 list; organising training for members and researchers; receiving and assisting in investigating complaints; and completing the registration and reporting required by Arts. 43–45.

Evidence: Resolution establishing the ethics committee, the member roster and terms of appointment; Committee charter, management systems and working rules; Description of the independence safeguards: staffing, premises, funding and recusal rules; Ethics training records and test results for members and researchers; Note recording the joint build with the ethics-review systems required by the Deep Synthesis and Algorithmic Recommendation rules

ISO/IEC 42001 AI management system implementation and certification readiness checklist

Every science and technology activity requires an ethics risk assessment. Where the assessment places it within Art. 2, the activity lead applies to the ethics committee, submitting: an overview (name, purpose, significance, necessity and prior review history); the implementation plan and supporting materials, including the potential ethical risks with controls and a contingency plan, and how results will be published; the participating institutions’ qualifications, the researchers’ experience and ethics training, the funding source and conflict-of-interest declarations; the informed-consent form and documentation on the provenance of biological samples, data and laboratory animals; an undertaking to observe research ethics and integrity; and any other material the committee requires. The committee reviews against the seven focus areas in Art. 15, and a decision requires the agreement of at least two-thirds of the members present.

Evidence: The entity’s ethics risk assessment methodology and the per-project assessment records; Complete review application pack, including the informed-consent form, provenance documentation for data and samples, conflict-of-interest declarations and the integrity undertaking; Committee meeting minutes and voting records evidencing the two-thirds majority; The review decision (approved, approved subject to modification, re-review after modification, or refused) and evidence that required modifications were made; Assessment conclusions on algorithmic fairness, reliability and controllability corresponding to Art. 15(5)

ISO/IEC 42001 AI management system implementation and certification readiness checklist

By 31 March each year, the entity must submit to the national science and technology ethics management information platform the previous year’s report of its ethics committee and reports on the implementation of any listed activities. This is a hard annual deadline, and the reports feed into subsequent inspections and eligibility for research funding.

Evidence: The ethics committee’s annual work report for the previous year; Implementation reports for any activities under list management; Submission records and receipts from the national ethics management information platform; Archived annual reports and the internal approval records

Build an inventory of outbound flows and triage each one. Flows within Art. 7 — a CIIO transferring personal information or important data; a non-CIIO transferring important data, or cumulatively transferring since 1 January of the current year the personal information of more than 1 million individuals (excluding sensitive data) or the sensitive personal information of more than 10,000 individuals — must go through the security assessment. Flows within the Art. 8 band — a non-CIIO cumulatively transferring since 1 January of the current year the personal information of at least 100,000 but fewer than 1 million individuals (excluding sensitive data), or the sensitive personal information of fewer than 10,000 individuals — must use the standard contract or certification. Volumes are counted cumulatively from 1 January of the current year, so the count must be tracked on a rolling monthly basis rather than assessed transfer by transfer.

Evidence: Inventory of outbound flows covering scenario, recipient, data categories, and whether sensitive personal information or important data is involved; Rolling monthly counts of cumulative individuals transferred, with the counting methodology; Route determination for each flow (assessment, standard contract, certification or exemption) and the article relied on; Description of the threshold-proximity alerting mechanism and the alerts raised

Outbound Data Transfer Risk Self-Assessment Report (per the CAC filing guide template)

Open tool: Transfer Matrix

A processor transferring personal information abroad must perform the statutory duties of notice, obtaining separate consent and running a personal information protection impact assessment. These three duties sit outside the threshold triage: even where a flow is exempt under Arts. 3–6, if personal information leaves the country the separate consent in PIPL Art. 39 and the impact assessment in PIPL Art. 55 still apply, unless another statutory basis displaces consent. The processor must also discharge its data-security duties and, where a data-security incident occurs or may occur, take remedial measures and report promptly to the provincial or higher cyberspace authority and other competent departments.

Evidence: Text of the transfer-specific notice and evidence of how it is displayed; Separate-consent logs for the transfer, kept apart from general consent records; Personal information protection impact assessment report and evidence of three-year archiving; Incident reports for outbound data-security events and the receipts from the provincial or higher cyberspace authority

Outbound Data Transfer Risk Self-Assessment Report (per the CAC filing guide template)Personal Information Protection Impact Assessment (PIPIA) report

Where you rely on Art. 3 (data collected or generated in international trade, cross-border transport, academic cooperation, transnational manufacturing or marketing that contains no personal information or important data), Art. 4 (personal information collected abroad, transmitted into China for processing and then sent back out without introducing domestic personal information or important data), or any of the four cases in Art. 5 (a contract to which the individual is a party; cross-border HR management; an emergency to protect a natural person’s life, health or property; and a non-CIIO that has cumulatively transferred fewer than 100,000 individuals’ personal information, excluding sensitive data, since 1 January of the current year), produce a written justification at the time of the decision stating the limb relied on, the factual basis and the boundary conditions. Exemptions are self-determined rather than approved, so the burden of proof sits with the business if a regulator challenges them.

Evidence: Written exemption justification per scenario, naming the limb, the factual basis, the boundary conditions and the review cycle; Field-level inventory and technical verification evidence supporting “contains no personal information or important data”; For Art. 4, evidence of the offshore origin of the data and a description of the processing chain showing no domestic personal information or important data was introduced; For Art. 5(2), the lawfully adopted labour rules and the lawfully concluded collective contract; Re-determination records where the basis for the exemption changed

Outbound Data Transfer Risk Self-Assessment Report (per the CAC filing guide template)

Open tool: Transfer Matrix

Processors must identify and declare important data under the applicable rules. Where the relevant authority or region has not notified the processor, and has not publicly designated the data as important, the processor need not declare it as important data in an outbound security assessment. The rule leaves the final designation with the authorities, but the processor must still carry out and document the identification exercise; once notified or publicly listed, the outbound transfer of that data goes unconditionally through the security assessment route (Art. 37 of the Network Data Security Management Regulations).

Evidence: Working papers for the important-data identification, recording method, reviewers and conclusion date; Records of monitoring the sector and regional important-data catalogues; Archived copies of any notification from the authority or public designation received; Contingency plan for switching the outbound route if a designation is made

Outbound Data Transfer Risk Self-Assessment Report (per the CAC filing guide template)

Within the national data classification and grading framework, a free-trade zone may draw up its own list of data that must go through the security assessment, standard contract or certification (a negative list), approved by the provincial cybersecurity and informatisation commission and filed with the CAC and the national data administration. A processor inside the zone transferring data that is not on the negative list is exempt from the assessment, standard contract and certification. Site selection and entity structuring should take this into account, and the target zone should be checked for whether a list has been published and which sectors it covers.

Evidence: Text of the target zone’s negative list and a note on its approval and filing status; Item-by-item comparison of the company’s data against the negative list; Registration and operating evidence for the in-zone entity, showing processing genuinely occurs inside the zone; Monitoring mechanism and review records for updates to the list

Outbound Data Transfer Risk Self-Assessment Report (per the CAC filing guide template)

Open tool: Transfer Matrix

Exporting a dual-use item requires an individual licence, a general licence or a registration-based export voucher. An individual licence application is made to MOFCOM in writing or by electronic message, with a truthful application form and the prescribed materials; MOFCOM grants or refuses within 45 working days of acceptance. The exporter must export within the scope, conditions and validity stated on the licence and report the actual shipment, arrival, installation and use. The licence must be presented to Customs on export, and without it Customs will not release the goods.

Evidence: Archived dual-use export application form and the complete submission pack; Register of licences with their scope, conditions and validity periods; Reports on actual shipment, arrival, installation and use; Customs presentation records and release documentation; Per-shipment reconciliation between the licence scope and what actually shipped

An application for a dual-use export licence must include an end-user and end-use certificate issued by the end user, and MOFCOM may additionally require a certificate issued or authenticated by a government body in the end user’s jurisdiction. MOFCOM operates a risk-management regime for end users and end uses, assessing and verifying them; where an importer or end user fails to cooperate with verification or provide supporting materials within the prescribed period, so that verification is impossible, MOFCOM may place it on the watch list.

Evidence: Original end-user and end-use certificate from the end user, with translation; Certificate issued or authenticated by a government body in the end user’s jurisdiction, where required; End-user penetration checks covering ownership, ultimate controller, nature of business and compliance history; Distributor contract clauses requiring end-user declaration and restricting onward transfer; Correspondence evidencing cooperation with MOFCOM verification

An exporter or importer that discovers any of the situations listed in Art. 25 must stop the export immediately, report to MOFCOM and cooperate with verification. An exporter that discovers, or is notified by MOFCOM of, a situation under Art. 14 §3, Art. 18 §4 or Art. 25 must report promptly, take the required measures to eliminate or mitigate the harm, and cooperate with the investigation. In addition, operators providing agency, freight, delivery, customs-clearance, third-party e-commerce platform or financial services that discover a suspected export-control violation must report it promptly to MOFCOM (Art. 36).

Evidence: Documented procedure for identifying risk situations and stopping shipments, including a freeze and interception runbook; Execution records for stopping exports, with timestamp, order number and operator; Text of the report to MOFCOM and the receipt; Materials submitted in cooperation with verification and the outcome; Records of notifying and training service providers on their reporting duty

PRC citizens, legal persons and unincorporated organisations that receive a foreign-government request for an export-control-related visit or on-site inspection must report it immediately to MOFCOM, and must not accept or undertake to accept such a visit or inspection without MOFCOM’s consent. Together with the data-blocking rule in Art. 36 of the Data Security Law this forms a pair of blocking duties and should be handled through a single “foreign authority request” procedure.

Evidence: Intake register for foreign-government and offshore-institution requests, recording date, requester, subject and scope; Text of the report to MOFCOM and the receipt; Archived MOFCOM decision granting or refusing consent; The combined foreign-request handling procedure designed jointly with Art. 36 of the Data Security Law; Negotiation records and reservations logged against export-control audit clauses in customer contracts

Properly retain end-user and end-use certificates together with contracts, invoices, ledgers, documents and business correspondence relating to dual-use exports for at least five years, unless another law or administrative regulation provides otherwise. Separately, MOFCOM issues a dual-use export-control compliance guideline and encourages exporters, and the freight, third-party e-commerce and financial service providers serving them, to build sound internal export-control compliance programmes (Art. 6). Such a programme is in practice the precondition for facilitation measures such as general licences and registration-based export vouchers.

Evidence: Internal export-control compliance programme covering governance, classification, list screening, licence management, audit, training and whistleblowing; Appointment of the compliance officer and training records; Archive index for export records and screenshots of the five-year retention configuration; Internal compliance audit reports and remediation records; Compliance-programme evidence submitted when applying for a general licence or registration-based export voucher

Network products and services must meet the mandatory requirements of the relevant national standards; on discovering a security defect, vulnerability or similar risk, the processor must take remedial action immediately, inform users and report to the competent authority as required, and where national security or the public interest is endangered, must additionally report to the competent authority within 24 hours.

Evidence: Severity taxonomy for vulnerabilities and defects, stating which cases trigger the 24-hour report; Template and channel documentation for the 24-hour report; Actual filing records and receipts with timestamps; Text of the user notification and its publication record

AI incident and serious incident reporting record (register plus report drafts)

An outbound transfer of personal information must satisfy one of the eight bases in Art. 35: passing the outbound data security assessment; certification by an accredited body; compliance with the standard-contract rules; genuine necessity to conclude or perform a contract to which the individual is a party; genuine necessity for cross-border HR management under lawfully adopted labour rules and a collective contract; genuine necessity to perform a statutory duty or obligation; genuine necessity in an emergency to protect a natural person’s life, health or property; and any other condition set by law, administrative regulation or the CAC. Important data is governed instead by Art. 37: where it genuinely needs to go abroad, it must pass the outbound data security assessment.

Evidence: Inventory of outbound transfer scenarios, each tagged with the Art. 35 limb relied on; Completion evidence for the route chosen (assessment approval, certification certificate or standard-contract filing receipt), or the documented basis for an exemption; Security assessment application and approval for any important data going abroad; Reconciliation records showing the actual transfer stays within the assessed scope (Art. 38)

Outbound Data Transfer Risk Self-Assessment Report (per the CAC filing guide template)Personal Information Protection Impact Assessment (PIPIA) report

Open tool: Transfer Matrix

Where personal information or important data is provided to, or entrusted for processing by, another processor, the parties must agree by contract on the purpose, method and scope of processing and the security obligations, and the provider must supervise the recipient’s performance; records of the processing must be kept for at least three years.

Evidence: Data processing agreement template and the register of executed versions; Description of the recipient-oversight mechanism, with questionnaires, audits or spot-check records; Register of provisions and entrustments recording recipient, data scope, date and purpose; Archive and retrieval evidence demonstrating the three-year retention

Supplier and subcontractor ESG and security due diligence questionnaire (for use as the buyer)

A network data processor providing generative AI services must strengthen the security management of training data and training-data processing, and take effective measures to prevent and handle network data security risks. In practice this covers the lawfulness of corpus sources, the compliance of collection methods (Art. 18 separately requires an impact assessment for automated tools and prohibits interfering with others’ network services), the scrubbing of personal and sensitive information from corpora, access control over training and inference environments, and classification and grading of the corpus store.

Evidence: Training-corpus register recording source, licence or authorisation, collection method and cleaning rules; Impact assessment for automated collection tools and a note on robots-policy compliance; Detection and removal plan for personal and sensitive information in corpora, with sampling results; Access-control matrix and audit logs for training and inference environments

Filing pack for generative AI services and algorithm filing, including the security assessment reportData Card — datasheet for a training, validation or test dataset

An offshore network data processor handling the personal information of natural persons in China that establishes a dedicated PRC entity or appoints a PRC representative under PIPL Art. 53 must report the entity’s name or the representative’s name and contact details to the municipal cyberspace authority where it is located.

Evidence: Incorporation documents for the PRC entity or the letter of appointment for the PRC representative; Filing materials submitted to the municipal cyberspace authority and the receipt; Terms of reference and scope of authority for the PRC representative; Updated filings after any change of entity or contact details

A processor handling more than 10 million individuals’ personal information must also comply with Arts. 30 and 32, which apply to important-data processors: designate a network data security officer and a network data security management body, with the officer drawn from management and empowered to report directly to the authority; the management body owns the policies and incident plans, periodic risk monitoring, assessment, drills and training, and the complaints channel; and where a merger, division, dissolution or bankruptcy may affect data security, the disposal plan and the recipient’s details must be reported to a provincial-level or higher authority.

Evidence: Methodology note and quarterly counts for individuals whose data is processed; Appointment letter for the network data security officer showing management-level status, and the direct-reporting channel; Terms of reference for the network data security management body and minutes of its regular meetings; Records of risk monitoring, assessments, drills and training; Reporting materials and receipts for major corporate changes, where applicable

Where notice is given through a processing rule, that rule must be displayed centrally, be easy to access, sit in a prominent position, and be specific and plain. For qualifying portability requests, the processor must provide a route for another processor named by the individual to access and obtain the data. Where automated collection unavoidably captures unnecessary personal information or data for which consent was not lawfully obtained, and where a user closes an account, the data must be deleted or anonymised; where a statutory retention period has not expired or deletion is technically infeasible, all processing other than storage and necessary security measures must stop.

Evidence: Screenshots of the processing-rules page evidencing centralised, prominent and accessible display; Intake workflow and interface documentation for portability requests; Technical approach and execution records for identifying and deleting or anonymising unnecessary personal information; Verification report on data erasure following account closure

This is the mandatory track alongside self-audits, and the regulator sets the tempo. Three triggers (Art. 5): processing that carries significant risk such as serious impact on individual rights or a serious lack of security measures; processing that may infringe the rights of numerous individuals; or a personal information security incident causing the leakage, alteration, loss or destruction of more than 1 million individuals’ personal information or more than 100,000 individuals’ sensitive personal information. The same incident or risk may not be made the basis of a second mandated audit, which is a point to raise if a duplicate demand arrives. Once mandated: select the professional institution as the protection department requires (it is not a free choice), complete the audit within the time limit, and, where the matter is complex, obtain the department’s approval for a reasonable extension (Art. 9); provide the support the institution needs and bear the cost (Art. 8); file the institution’s audit report with the department on completion, signed by the institution’s principal and by the audit lead and bearing the institution’s seal (Art. 10); and remediate the findings as required, filing a remediation report WITHIN 15 WORKING DAYS OF COMPLETING THE FIXES (Art. 11). In practice, build this chain into the incident response plan: once an incident’s severity reaches the 1 million / 100,000-sensitive scale, start preparing for a possible mandated audit in parallel — shortlist institutions, identify the budget line and settle the cooperation posture — rather than beginning the search after the clock has already started.

Evidence: The protection department’s audit demand and the internal record starting the response; Selection process and engagement contract for the professional institution, including confidentiality and post-engagement deletion clauses; Records of the audit cost borne and of the support provided to the institution; The compliance audit report issued by the institution, signed by its principal and the audit lead and sealed; Record and acknowledgement of filing the audit report with the protection department; Remediation register: issue, action, owner, completion date, verification result; Remediation report and the filing record showing delivery within 15 working days of completing the fixes; Extension request and the department’s approval, where applicable

The threshold is the single factual entry point to this regime, so first count — and evidence — how many individuals’ personal information is processed. Write the methodology down: a de-duplicated count of identifiable natural persons, covering active users, dormant users, deactivated accounts still inside the retention window, end users reached through an SDK or entrusted processing, individuals captured offline, and non-product data such as employees and candidates; and set explicit rules for merging users who overlap across product lines and legal entities, without which each self-check produces a different number. Once more than 10 million individuals’ personal information is processed, an audit is required at least every two years (Art. 4). Falling below the threshold is not an exemption: Art. 3 requires the processor to have its internal function or an engaged institution audit compliance “regularly”, so the company must fix its own cycle in writing — commonly aligned with the annual internal-control or security assessment cadence. File each count, the basis and date of the determination, and the scheduled date of the next audit; that file is the only material that shows a regulator the cycle has not been allowed to slip.

Evidence: Policy defining the headcount methodology: scope, de-duplication rules, cross-entity merge rules; Headcount results for each period with an explanation of the data sources; Threshold determination record: conclusion, basis, assessor, date; Audit cycle schedule showing the previous and next audit dates; Written decision fixing a self-determined audit cycle where the threshold is not met

Art. 6 requires both self-initiated and mandated audits to follow the annexed Guidelines, whose 27 sections amount to a ready-made audit programme: lawful basis and consent (including re-consent after changes, separate consent and written consent); processing rules set out as a list with the shortest necessary retention period; notice that is prominent and readable; agreements and supervision for joint and entrusted processing; notice when personal information transfers on a merger, restructuring, division or dissolution; separate consent and a prior impact assessment before providing personal information to others; transparency, fairness and a refusal mechanism for automated decision-making; consent-based public disclosure; necessity and signage for image-collection equipment in public places; the limits on processing already-public personal information; sensitive personal information and minors under 14; the three outbound routes and approval before providing information to foreign judicial or law-enforcement authorities; the six grounds for deletion and the duty to stop processing where deletion is technically infeasible; handling and responding to individuals exercising their rights; explaining the processing rules; internal management systems and operating procedures (classification, emergency mechanisms, impact assessment and audit systems, complaints, operating permissions, training, performance appraisal, and accountability for unlawful processing); the effectiveness of security technical measures (confidentiality, integrity and availability, encryption and de-identification, access control); coverage and assessment of training; the personal information protection officer’s qualifications, authority and registration with the authority; the conduct and content of impact assessments; the comprehensiveness of emergency plans and drills; incident response; and, for major platforms, platform rules and the personal information protection social responsibility report. In practice: map all 27 sections onto your own systems, data flows and policy documents to produce working papers with four columns — review point, evidence, owner, conclusion. For AI companies the recurring gaps are the lawful basis for training corpora, retention and deletion of conversation logs, whether personal information in models and logs can actually be deleted, and explanations of automated decisions in recommendation and risk control; evidence those first.

Evidence: Audit plan: scope, sampling method, schedule and division of responsibility; Working papers mapped section by section to the 27 Guidelines items (review point, evidence, owner, conclusion); Inventory of processing activities and data-flow diagrams covering training, inference and logging; Sample lawful-basis and consent records, including separate consent, written consent and re-consent after changes; Explanatory materials for automated decisions, the refusal mechanism, and evidence of the non-profiled option; Prior impact assessments for sensitive personal information and for minors under 14; Materials determining the outbound route: security assessment, standard contract filing, or certification; Execution records and technical notes on giving effect to deletion in applications, logs, backups and models; Internal management systems and operating procedures, training and assessment records, emergency plans and drill records; List of audit findings with the remediation plan

Art. 12 attaches the audit work to named people and bodies. First: a processor handling more than 1 million individuals’ personal information must appoint a personal information protection officer responsible for the organisation’s compliance audit work — note that this threshold (1 million) sits below the 10 million mark that triggers the mandatory two-year cycle, so many companies hit “you need an officer” before “you need a scheduled audit”. Section 22 of the Guidelines adds what is reviewed about that officer: relevant experience and professional knowledge and familiarity with the applicable laws and regulations; clearly defined duties and sufficient authority to coordinate internal departments; the right to give views before major processing decisions are taken; the power to stop non-compliant operations and take necessary corrective measures; and publication of the officer’s contact details, with the name and contact details filed with the protection department. Second: a processor providing important internet platform services with a very large user base and complex business types must set up an independent body composed mainly of external members to supervise the compliance audit — “mainly external” means a committee dominated by internal executives does not qualify, and the membership, rules of procedure and supervisory conclusions all need to be documented.

Evidence: Appointment document and delegation of authority for the personal information protection officer; Officer qualification materials: relevant experience, professional knowledge and training records; Records of the officer giving views before major processing decisions; Records of the officer stopping non-compliant operations and taking corrective measures; Screenshot of the published contact details and the record of filing the name and contact details with the protection department; Establishment document for the independent oversight body, its membership list and the proportion of external members; The oversight body’s rules of procedure, meeting minutes and supervisory conclusions on the compliance audit

The engaging party has to control four things itself, or the problem only surfaces at the moment of engagement. (1) Capability (Art. 7): the institution must be capable of performing the audit, with audit personnel, premises, facilities and funding commensurate with the service, and is encouraged to be certified under the Regulations on Certification and Accreditation — keep verification materials on its personnel, premises, facilities and past work. (2) Confidentiality and deletion (Art. 13): the institution owes confidentiality over the personal information, trade secrets and confidential business information obtained, must not disclose or unlawfully provide it to others, and must delete it promptly once the audit work ends — write both into the engagement contract and obtain a deletion confirmation at closeout. (3) No sub-delegation (Art. 14): the institution may not sub-delegate the audit, so the contract needs an explicit prohibition and a liability clause. (4) Rotation (Art. 15): the same institution and its affiliates, and the same audit lead, may not audit the same subject more than three times consecutively. This is the rule most often discovered at the fourth engagement, because “affiliates” and “same audit lead” are not fields in ordinary vendor management records; keep a dedicated engagement-history register keyed on institution, affiliate relationship and audit lead, and check it before requesting quotes.

Evidence: Capability verification materials: auditors’ credentials, premises and facilities, funding, and certification where held; Contract clauses on confidentiality, post-engagement deletion and the prohibition on sub-delegation; Deletion confirmation letter obtained at closeout; Engagement-history register: institution, affiliate relationships, audit lead, and the years of each engagement; Record of the consecutive-engagement check run before this selection

For content within Art. 17 §1 of the Deep Synthesis Provisions, add the explicit label by modality under Art. 4: for text, a textual or common-symbol prompt at the start, end or an appropriate midpoint, or a conspicuous prompt in the interactive interface or around the text; for audio, a spoken or rhythmic prompt at the start, end or an appropriate midpoint, or a conspicuous prompt in the interactive interface; for images, a conspicuous prompt at an appropriate position; for video, a conspicuous prompt on the opening frame and around the player, optionally also at the end and at appropriate midpoints; for virtual scenes, a conspicuous prompt on the opening frame, optionally also at appropriate points during the session; and for other scenarios, a conspicuous prompt suited to the application. Where download, copy or export functions are offered, the file must still contain a conforming explicit label.

Evidence: Implementation and placement note for the explicit label in each modality: text, audio, image, video and virtual scenes; Sample labelled files per modality, including samples after download, copy and export; Mapping table comparing product functions against the five categories in Art. 17 §1 of the Deep Synthesis Provisions; Technical verification that the label survives the export path

Filing pack for generative AI services and algorithm filing, including the security assessment report

As required by Art. 16 of the Deep Synthesis Provisions, add an implicit label to the metadata of generated and synthetic files, carrying the generated-content attribute, the provider’s name or code and a content identifier among other production elements. Art. 5 §3 defines file metadata as descriptive information embedded in the file header in a specific encoding format, recording the file’s source, attributes and use. The Measures also encourage adding implicit labels in the form of digital watermarks. The specific fields and encoding must conform to GB 45438-2025.

Evidence: Field design document for the implicit label: attribute, provider name or code, and content identifier; Implementation note for metadata writing in each file format, with exported metadata from sample files; Field and encoding conformity check against GB 45438-2025; Digital watermark design and robustness test results, where used; API documentation showing metadata carried in outputs

Filing pack for generative AI services and algorithm filing, including the security assessment report

A provider of network content dissemination services must: verify whether the file metadata carries an implicit label, and where the metadata confirms the content is generated or synthetic, add a conspicuous prompt around the published content telling the public it is generated content; where no implicit label is found but the user declares the content as generated, add a conspicuous prompt telling the public the content may be generated; where no implicit label is found and the user has not declared, but an explicit label or other traces of generation are detected, treat it as suspected generated content and add a conspicuous prompt; and provide the necessary labelling function while prompting users to declare whether their post contains generated content. In the first three situations the platform must also write dissemination elements into the file metadata — the generated-content attribute, the platform’s name or code and a content identifier.

Evidence: Metadata verification workflow, plus the copy and display samples for each of the three prompt tiers; Description of the detection capability for traces of generation, with detection-rate statistics; Implementation note and samples for writing dissemination elements back into the metadata; Screenshot of the user declaration entry point and declaration-rate statistics; Note on how this connects to Art. 9 §2 of the Algorithmic Recommendation Provisions, which requires labelling before transmission continues

The user service agreement must set out the method and style of content labelling and remind users to read and understand the labelling requirements. Where a user asks for generated content without an explicit label, the provider may supply it after the user agreement has made the user’s own labelling duty and usage responsibility clear, and must retain logs including details of the recipient for no less than six months.

Evidence: Service-agreement clauses describing the labelling method and style, with evidence of user acknowledgement; Documented application and approval process for supplying output without an explicit label; Recipient logs (account, entity, timestamp, content identifier) and screenshots of the six-month retention configuration; Usage statistics and anomaly monitoring for unlabelled output

Filing pack for generative AI services and algorithm filing, including the security assessment report

When completing algorithm filing, security assessment and similar procedures, the provider must submit the labelling materials required by these Measures, and must strengthen the sharing of labelling information to support the prevention and investigation of related offences. Labelling must also conform to the applicable laws, administrative regulations, departmental rules and mandatory national standards — namely GB 45438-2025 “Cybersecurity technology — Labeling method for content generated by artificial intelligence” (issued 28 Feb 2025, effective 1 Sep 2025, currently in force).

Evidence: Labelling description filed with the algorithm filing and security assessment materials; Self-assessment checklist and gap list against GB 45438-2025; Reconciliation between the labelling implementation described in the filing and the live product; Description of the mechanism for sharing labelling information and cooperating with enforcement

Filing pack for generative AI services and algorithm filing, including the security assessment report

Before applying for certification of an outbound transfer, perform the statutory duties of notice, obtaining separate consent, and running a personal information protection impact assessment. Art. 6 sets out what the assessment must focus on, and it dovetails with the separate consent for outbound transfers in PIPL Art. 39 and the assessment requirements in PIPL Arts. 55–56. The certification body takes this pack as its input for the conformity assessment, and an incomplete pack is a direct cause of failure.

Evidence: Text of the outbound-transfer notice and screenshots of where it is displayed, covering the recipient’s name and contact details, the purposes and methods, the data categories and how rights are exercised; Captured interaction evidence and consent logs for the separate outbound consent; Personal information protection impact assessment report organised around the matters in Art. 6; Remediation items arising from the assessment, with closure evidence

Personal Information Protection Impact Assessment (PIPIA) report

After confirming eligibility under Art. 5, define precisely the scope submitted for certification: the business scenarios covered, the data categories and fields, the onshore and offshore entities, the direction and frequency of transfers, and the recipient jurisdictions. The certified scope then becomes the compliance boundary — Art. 10 requires the certification body to suspend and ultimately revoke the certificate where actual transfers depart from it — so the scope must be neither so narrow that it constrains the business nor so broad that it cannot be evidenced.

Evidence: Scope statement covering business scenarios, data fields, entities, flows and jurisdictions; Eligibility determination record (non-CIIO status, volume thresholds, absence of important data); Intra-group data flow map and entity relationship diagram; Documented change-control process for scope changes

Outbound Data Transfer Risk Self-Assessment Report (per the CAC filing guide template)

Open tool: Transfer Matrix

Apply to a body holding accreditation for personal information protection certification, which carries out the assessment under the basic certification specification and the certification rules and issues a certificate where the requirements are met. Within five working days of issuing a certificate or of any change in its status, the body must report the certificate number, the certified processor’s name, the certified scope and the status change to the national certification and accreditation information platform, so certificate status is publicly checkable. After certification the processor must keep actual transfers within the certified scope and submit to supervision, spot checks and evaluation by SAMR and the CAC.

Evidence: Verification record for the certification body’s accreditation, including its CAC filing; Certification application pack and the certificate issued by the body; Screenshot of the certificate record published on the national certification and accreditation information platform; Periodic reconciliation records comparing actual transfers against the certified scope; Records of responses to supervision, spot checks and evaluation, with remediation closure evidence

Art. 23 enumerates five obligations: (1) adopt internal security management systems and operating procedures, name a cybersecurity officer and allocate protection responsibility; (2) deploy technical measures against computer viruses, network attacks and intrusions; (3) deploy technical measures to monitor and record network operating status and security events, and retain the relevant network logs for no less than six months; (4) apply data classification and backup and encryption of important data; and (5) perform any other duties set by law or administrative regulation. The aim is to keep the network free from interference, damage and unauthorised access, and to prevent network data from being leaked, stolen or tampered with. A CIIO carries the additional duties in Art. 36 on top of Art. 23.

Evidence: MLPS grading report, expert review opinion and public-security filing certificate; MLPS assessment report and remediation closure records; Appointment letter for the cybersecurity officer; Security management policy and operating-procedure set; Backup and encryption policy for important data, with drill records

Deploy technical measures to monitor and record network operating status and security events, and retain the relevant network logs for no less than six months. For a model service this must cover authentication and login logs, API call logs, and audit logs of administrative operations and data exports, with integrity and tamper-resistance assured.

Evidence: Log-collection scope note and field inventory; Screenshots of the retention policy configuration showing the retention period; Description of log integrity and tamper-resistance controls; Records of sample log retrievals

Network products and services must meet the mandatory requirements of the relevant national standards and must not contain malicious programs; on discovering a security defect or vulnerability the provider must take remedial action immediately, inform users as required and report to the competent authority. Providers must also maintain security support for their products and services and may not terminate it within the prescribed or agreed period. Where a product collects user information, the provider must disclose this and obtain consent.

Evidence: List of applicable mandatory national standards and conformity evidence; Vulnerability management policy, SLA and remediation log; Records of user notifications and reports to the competent authority; Contract clauses on the security-maintenance period and the product lifecycle announcement

When arranging network access or domain registration, handling fixed-line or mobile subscriptions, or providing users with information-publishing or instant-messaging services, the operator must require real identity information when signing the agreement or confirming the service; where the user does not provide it, the service must not be supplied.

Evidence: Design note for real-identity authentication, listing the factors used and the verification channel; Coverage statistics and product evidence showing feature restrictions for unauthenticated users; Identity-authentication clauses in the user agreement; Note on data minimisation and encrypted storage of authentication data

Maintain a cybersecurity incident response plan and promptly deal with system vulnerabilities, computer viruses, network attacks and intrusions; on an incident that endangers cybersecurity, activate the plan immediately, take remedial measures and report to the competent authority as required.

Evidence: Cybersecurity incident response plan with severity criteria and reporting routes; Annual drill plan and drill report; Incident tickets and timeline records; Text of reports to the competent authority and the receipts

AI incident and serious incident reporting record (register plus report drafts)