When a Chinese company ships a chatbot to the public, it does not just flip a switch. Somewhere in the paperwork, the model gets a filing number. Most outside observers hear "regulation" and picture a ban. The reality in China is a registry with a security gate — and the gate has numbers attached.
Key takeaways
- China's Interim Measures for the Management of Generative AI Services (《生成式人工智能服务管理暂行办法》) took effect on 15 August 2023, issued as Decree No. 15 by the Cyberspace Administration of China (CAC, 国家网信办) together with six other ministries.
- The CAC runs a generative-AI service filing (备案) system; as of 31 December 2025, 748 generative-AI services had been filed cumulatively, with 435 applications or functions registered separately.
- In 2025 alone, 446 new generative-AI services were filed nationally, and local cyberspace offices registered 330 new applications that call already-filed models via API.
- A companion technical document, Generative AI Service Security Basic Requirements (《生成式人工智能服务安全基本要求》, TC260-003), was published on 29 February 2024 by the national cybersecurity standardization body as a recommended guideline.
- The guideline is a practice standard, not a standalone law: it tells providers what security assessment to run before they submit a filing, covering corpus, model, and service safety.
The law that started it
The Interim Measures (暂行办法) were promulgated on 10 July 2023 and came into force on 15 August 2023. They were issued as Decree No. 15 by the CAC jointly with the National Development and Reform Commission, the Ministries of Education, Science and Technology, and Industry and Information Technology, the Ministry of Public Security, and the National Radio and Television Administration.
The measure's scope is services that provide text, image, audio, or video generation to the public inside China. Its posture is "development and security in parallel" with inclusive, prudential, and classified regulation. A pivotal clause requires providers whose services carry "opinion-propagation attributes or social-mobilization capability" to conduct a security assessment and complete algorithm filing — the clause that feeds the registry.
The filing (备案) numbers
The CAC's own announcement, published on 9 January 2026, lays out the running tally. During 2025, 446 new generative-AI services were filed at the national CAC. Separately, local cyberspace offices registered 330 new applications or functions that reach an already-filed model through an API. As of 31 December 2025, the cumulative totals stood at 748 filed services and 435 registered applications or functions.
A few weeks earlier, in a 2 December 2025 interview, CAC director Zhuang Rongwen (庄荣文) said that as of 1 December 2025, 663 large-model services had completed filing. The State Council Information Office, on 26 December 2025, summarized the picture as "over 700" products filed. The figures are consistent: 748 is the precise year-end number, and "over 700" was an interim description from earlier in the same window.
One detail matters: filing (备案) and registration (登记) are two procedures. Filing applies to the generative-AI service itself; registration applies to applications or functions that simply call a filed model through an API. Both are tracked, but they are not the same bucket.
The security baseline (TC260-003)
The other half of the machinery is Generative AI Service Security Basic Requirements (《生成式人工智能服务安全基本要求》, TC260-003). It was published on 29 February 2024 by TC260, the national technical committee on cybersecurity standardization (全国网络安全标准化技术委员会).
Its status is easy to misread. It is a recommended technical guideline (指南), not a binding national law in its own right. What it does is operational: it tells a provider exactly what to check before submitting a filing — corpus safety (source compliance, content safety, labeling), model safety (third-party base models used must themselves be filed, content-safety controls, accuracy), service safety measures (transparency, labeling of generated content, complaint channels), and a defined security-assessment method. In practice it functions as the de facto assessment template tied to filing, even though it was not enacted as a statute.
That distinction is not pedantic. Calling TC260-003 "in effect as law" would be inaccurate; describing it as the security gate every public model is expected to clear before filing is correct.
What "filed" does and does not mean
Filing is a compliance checkpoint, not a quality endorsement. It signals that a service has addressed corpus legality, content safety, and generated-content labeling — not that the model is accurate or better than a rival. Public-facing services with opinion or social-mobilization attributes must file; internal R&D that does not serve the public may be exempt.
The system also creates transparency obligations. Live applications are expected to display the model name and the filing or registration number, so a user can, in principle, see which underlying model powers a product.
Why this matters outside China
A working, public registry of live generative-AI services is unusual globally, and it produces market visibility other jurisdictions lack — a rough census of how many models are actually shipping. The security baseline shapes what training data and base models are acceptable, which directly affects any company exporting a model into China. It is a different mechanism from the EU's risk-tiered AI Act, but the takeaway is the same: building for the Chinese market means designing for the filing gate from day one.
Honest limitations
- The headline counts — 748 filed, 446 added in 2025, 435 registered — come from a single official CAC announcement (9 January 2026); I treat them as authoritative primary-source figures but have not cross-checked them against a second independent publisher.
- TC260-003 is a recommended technical guideline, not a binding national law; describing it as "in effect" as a statute would be inaccurate. It functions as the de facto security-assessment template tied to filing.
- Filing (备案) and registration (登记) are distinct procedures; I have summarized them, but the precise thresholds for which products require which are set out in the measures and implementing rules, which I have not quoted line by line.
- This article does not track per-provider filing numbers or the separate algorithm-recording (算法备案) system, which runs in parallel.
What readers can do now
- If you plan to launch a generative-AI product in China, map it against the Interim Measures first: determine whether it has "opinion-propagation or social-mobilization" attributes that trigger filing and security assessment.
- Before building on a Chinese model via API, check that the underlying model carries a filing (备案) number — providers are required to display it, and using an unfiled base model is a compliance gap.
- Read TC260-003 directly as your security-assessment checklist (corpus, model, service, assessment) rather than treating "filing" as a black box.