Security Management Measures for the Application of Facial Recognition Technology

• Authority: Chinese central government
• Jurisdiction: China
• Collections: Chinese law and policy;Editors' Picks
• Most recent activity: Enacted
• Most recent activity date: 2025-03-21

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Compromise of privacy
• AI system security vulnerabilities
• Disinformation, surveillance, and influence at scale
• Overreliance and unsafe use
• Loss of human agency and autonomy
• Governance failure
• Lack of transparency or interpretability

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Fraud, scams, and targeted manipulation
• Lack of capability or robustness

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 8-10 subdomains, with strong focus on privacy compromise (2.1), security vulnerabilities (2.2), disinformation and surveillance (4.1), fraud and manipulation (4.3), overreliance and unsafe use (5.1), loss of agency (5.2), governance failure (6.5), and lack of robustness (7.3). Coverage is concentrated in privacy, security, misuse prevention, and human-computer interaction domains.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Health Care & Social Assistance
• Arts, Entertainment & Recreation
• Accommodation, Food & Other Services
• Public Administration (excl. National Security)

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Agriculture, Mining, Construction & Manufacturing
• Trade, Transportation & Utilities
• Information
• Finance & Insurance
• Real Estate, Rental & Leasing
• Professional & Technical Services
• Scientific Research & Development Services
• Management, Administrative & Support Services
• Educational Services
• National Security

All other sectors had no coverage in this document.

Sectors Summary

This regulation applies broadly across all sectors that use facial recognition technology in China, with explicit coverage of public administration, accommodation and food services (hotels), health care (public baths), and arts/entertainment/recreation (public changing facilities). The cross-sectoral nature is evidenced by general applicability to any 'personal information processor' using facial recognition technology.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding regulatory measure issued by the Chinese central government with mandatory language, explicit enforcement mechanisms, penalties for violations, and designated enforcement authorities (cyberspace administrations and public security authorities).

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Summary: The document is described as being issued by the 'Chinese central government' and references multiple existing Chinese laws as its legal basis. The enforcement is delegated to cyberspace administrations and public security authorities.

Target

• Entity Types: AI_Developer, AI_Deployer
• Summary: The document explicitly defines and regulates 'personal information processors' as entities that independently determine the purpose and method of personal information processing activities using facial recognition technology. These entities must comply with consent requirements, impact assessments, filing procedures, and security measures.

Enforcer

• Entity Types: AI_Governance_Actor
• Summary: The document explicitly designates cyberspace administrations and public security authorities as the enforcement bodies with authority to conduct supervision, inspection, receive filings, and handle complaints. They have the power to enforce compliance and pursue violations.

Monitor

• Entity Types: AI_Governance_Actor
• Summary: The same authorities responsible for enforcement also conduct ongoing monitoring through supervision and inspection activities, filing reviews, and complaint handling mechanisms. They establish information sharing mechanisms to coordinate monitoring activities.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document primarily focuses on the Deploy and Operate and Monitor stages of the AI lifecycle, with comprehensive requirements for deployment procedures, ongoing monitoring, impact assessments, and operational security measures. It also addresses aspects of Plan and Design through requirements for purpose specification and necessity assessments.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Systems
• Task-specific AI

Technical Scope Summary

The document explicitly focuses on facial recognition technology and facial information processing. It does not mention AI models, AI systems, frontier AI, general purpose AI, foundation models, generative AI, or compute thresholds. The scope is specifically limited to biometric facial recognition technology applications.