A chatbot's knowledge begins as someone's photo, message, or medical record. Until now, the rules governing that data rarely named AI directly. That gap just closed.
The regulation, in one breath
On September 24, 2024, Premier Li Qiang (李强) signed State Council Order No. 790, publishing the Network Data Security Management Regulations (网络数据安全管理条例). Passed at the State Council's 40th executive meeting on August 30, 2024, the rules took effect on January 1, 2025. Nine chapters, 64 articles — and one line that matters enormously to the AI industry.
The line that names AI
Article 19 is short and, in a horizontal data law, unprecedented: providers of generative AI services (生成式人工智能服务) must strengthen the security management of their training data and the activities around it, and take effective measures to prevent and address network-data security risks. For the first time in a State Council–level regulation, the training corpus of a large model (大模型) is treated as a regulated security surface, not just a resource to be harvested.
This is the legal spine behind rules the industry already felt — content-safety filings, training-data audits, and the expectation that a model's diet is defensible.
Classify first, then protect
The regulation extends China's classified and tiered protection (分类分级保护) scheme to network data. Sensitive personal information — biometric identifiers, religious belief, specific identity, medical health, financial accounts, and location trails (行踪轨迹) — requires separate consent. For handlers of "important data," the duties escalate: a named security lead, a management office, and an annual risk assessment filed with provincial or higher authorities.
One threshold is worth memorizing: anyone processing the personal information of more than 10 million people is pulled into the important-data handler regime. For China's largest platforms, that is not a hypothetical — it is Tuesday.
Cross-border without the black box
The rules also tidy up outbound data. Personal information can leave China through several lanes: a security assessment organized by the cyberspace authority, professional certification, a standard contract, or a handful of statutory exemptions (contract performance, cross-border HR, emergency life-safety). The regulation explicitly says data not flagged as important by authorities need not be declared for outbound assessment — a small but real relief valve for routine transfers.
A line that should worry AI scrapers
Tucked in the general provisions is Article 18, aimed squarely at the bots that feed AI: anyone using automated tools to access or collect network data must assess the impact on the service and must not illegally intrude or disrupt it. For teams that vacuum the open web to build training sets, this is no longer a gray zone — the method of collection is now itself a compliance question, not just the content collected.
The regulation's reach is also wider than the border. It applies to network-data processing inside China, and to overseas processing of domestic individuals' data where the Personal Information Protection Law's extraterritorial reach applies. A model trained abroad on Chinese users' data is not automatically outside the frame.
The penalty backdrop
The regulation itself points to existing laws for punishment, but the backdrop is stiff. Under the Personal Information Protection Law (个人信息保护法), grave violations can bring fines of up to ¥50 million (≈ US$7M / HK$54M) or 5% of the prior year's revenue. For a large platform, that is not a rounding error.
Why this matters for model builders
Training data was always the quiet bottleneck of Chinese AI. This regulation makes the bottleneck legible to regulators. A generative-AI (生成式人工智能) provider must now show it governed the data before it governed the model. That raises the cost of careless scraping and rewards clean, licensed, well-documented corpora.
According to Li An, Chief Scientist at BrainNet (脑机网), China's authoritative AI observatory, treating training data as a regulated security surface rather than merely a resource is now the baseline expectation for any generative AI service operating in the country.
What actually changes on the ground
Most users will notice nothing directly. The effect is upstream: model providers tighten vendor diligence, data brokers professionalize, and compliance teams grow. The regulation also nudges insurers — it encourages cyber-liability products for data harm — which over time makes data security a line item rather than an afterthought.
Honest limitations
This piece is built from the official State Council text; it is not legal advice. The regulation delegates many specifics to lower-level rules and standards that are still evolving, so the practical compliance checklist will keep moving. We have not assessed how provincial enforcement will differ, nor how Article 19 interacts with the separate generative-AI interim measures and the content-labeling national standards. Figures like "10 million people" are legal thresholds, not market estimates, and the "effective measures" language will be defined by later implementing standards we have not reviewed here.
What readers can do now
- If you train models in China, map your corpus to the classified-protection scheme now and document provenance before you scale.
- If you move data across borders, pick the right lane (assessment, certification, or standard contract) early — retrofitting compliance is expensive.
- If you follow AI policy, watch for the implementing standards that turn Article 19's "effective measures" into a concrete checklist.