National Standard of the People’s Republic of China: Cybersecurity Technology – Basic Safety Requirements for Generative Artificial Intelligence Services (Draft for Feedback)

• Authority: Chinese central government
• Jurisdiction: China
• Collections: Chinese law and policy
• Most recent activity: Proposed
• Most recent activity date: 2024-05-17

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Unfair discrimination and misrepresentation
• Exposure to toxic content
• Compromise of privacy
• AI system security vulnerabilities
• False or misleading information
• Overreliance and unsafe use
• Governance failure
• AI pursuing its own goals
• AI possessing dangerous capabilities
• Lack of capability or robustness

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Disinformation, surveillance, and influence at scale
• Cyberattacks, weapon development or use
• Fraud, scams, and targeted manipulation
• Lack of transparency or interpretability

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 12-14 subdomains, with strong focus on toxic content (1.2), privacy compromise (2.1), security vulnerabilities (2.2), false information (3.1), disinformation/surveillance (4.1), cyberattacks/weapons (4.2), fraud/manipulation (4.3), overreliance (5.1), governance failure (6.5), goal misalignment (7.1), dangerous capabilities (7.2), and lack of robustness (7.3). Coverage is concentrated in content safety, security, misuse prevention, and AI system reliability domains.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Information

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Trade, Transportation & Utilities
• Finance & Insurance
• Scientific Research & Development Services
• Educational Services
• Health Care & Social Assistance
• Arts, Entertainment & Recreation
• Public Administration (excl. National Security)
• National Security

All other sectors had no coverage in this document.

Sectors Summary

The document governs generative AI services across multiple high-risk sectors with explicit coverage of healthcare (medical information services), finance (financial information services), critical infrastructure, education (services for minors), and psychological counseling. The Information sector is implicitly governed as the primary sector where generative AI service providers operate.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding national standard with mandatory language throughout ('shall', 'must', '应'), explicit enforcement mechanisms, and regulatory oversight by government departments. It establishes legally enforceable requirements for generative AI service providers in China.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Summary: The document is titled 'National Standard of the People's Republic of China' and is described as being issued by the Chinese central government, indicating it was proposed and drafted by government regulatory authorities.

Target

• Entity Types: AI_Developer, AI_Deployer
• Summary: The document explicitly targets 'service providers' who provide generative AI services to the public. These entities develop models, collect training data, and deploy AI systems, making them both AI developers and deployers.

Enforcer

• Entity Types: AI_Governance_Actor
• Summary: The document references 'main oversight department' as the regulatory authority that will use this standard as a reference for oversight. The document also establishes mechanisms for service suspension and compliance monitoring.

Monitor

• Entity Types: AI_Governance_Actor, AI_Deployer
• Summary: The document establishes monitoring responsibilities for both government oversight departments and service providers themselves. Service providers must implement internal monitoring personnel and conduct ongoing evaluations.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document comprehensively covers the entire AI lifecycle with particular emphasis on data collection/processing, model building, verification/validation, deployment, and operation/monitoring stages. It addresses training data requirements, model development and safety, testing procedures, service deployment requirements, and ongoing monitoring obligations.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• Foundation Models
• AI Systems
• Generative AI
• Open Weight / Open Source
• Task-specific AI

Technical Scope Summary

The document explicitly focuses on generative AI services and systems. It defines generative AI services as using generative AI technology to provide content generation to the public. The document does not explicitly mention frontier AI, general purpose AI, task-specific AI, foundation models, predictive AI, open-weight models, or specific compute thresholds.