Filing practice

Is algorithmic filing the same thing as generative AI service filing?

What you may need to do

1. Decide first whether the service has public-opinion attributes or social-mobilisation capacity
2. Complete the security assessment in accordance with the relevant national provisions before advancing to filing
3. Handle filing and the modification and deregistration procedures under the algorithmic recommendation provisions
4. Keep a filing register that tracks changes to the model and to the form of service

Statutory basis

One-sentence conclusion

These are not two unrelated filing regimes. Article 17 of the Interim Measures for the Management of Generative AI Services points the filing procedure for generative AI services directly at the Provisions on the Administration of Algorithmic Recommendation in Internet Information Services: carry out the security assessment first, then handle algorithmic filing and the modification and deregistration procedures under the algorithmic recommendation provisions.

Basis

Article 17 of the Interim Measures for the Management of Generative AI Services: providers of generative AI services with public-opinion attributes or social-mobilisation capacity shall carry out a security assessment in accordance with the relevant national provisions, and shall carry out algorithmic filing and the procedures for modification and deregistration of the filing in accordance with the Provisions on the Administration of Algorithmic Recommendation in Internet Information Services. That article states the relationship between the two sets of provisions clearly — the security assessment comes first, and the filing procedure runs through the framework of the algorithmic recommendation provisions.

Article 24 of the algorithmic recommendation provisions gives the concrete act and time limits: a provider of algorithmic recommendation services with public-opinion attributes or social-mobilisation capacity shall, within ten working days from the date the service is provided, report through the internet information service algorithmic filing system such information as the provider’s name, the form of service, the field of application, the type of algorithm, the algorithm self-assessment report and the content proposed for publication, and complete the filing. The second and third paragraphs of the same article cover modification (within ten working days) and deregistration (within twenty working days, with proper arrangements made).

Comparing the two yields three points. First, the trigger in both is public-opinion attributes or social-mobilisation capacity, and how to judge that is covered in a separate knowledge entry. Second, the filing materials include an algorithm self-assessment report, so the security assessment is not optional. Third, the time limits for modification and deregistration come from Article 24 of the algorithmic recommendation provisions.

To be clear: the source documents contain no URL for the filing system, no account registration method and no materials template. Everything about the entry point, the form formats and the intake window follows the position of the cyberspace administration authority for your locality; do not copy a third-party checklist directly.

What you need to do

• Make a written judgement first on whether the service has public-opinion attributes or social-mobilisation capacity, and record the conclusion.
• Complete the security assessment in accordance with the relevant national provisions and produce a self-assessment report.
• Prepare the filing information in the fields of Article 24 of the algorithmic recommendation provisions, including the form of service, the field of application, the type of algorithm and the content proposed for publication.
• Set up modification triggers: replacing the model, adjusting the field of application and changing the form of service are all points at which the filing information has to be revisited.
• When the service stops, complete deregistration of the filing under Article 24, third paragraph, and make proper arrangements.

Common pitfalls

Assuming that a generative AI service only has to go through the generative AI route, and so missing algorithmic filing altogether. Treating filing as something to catch up on after launch and overlooking that the clock starts on the date the service is provided, within ten working days. Changing the model or adding an application scenario without handling a modification. Leaving the security assessment and the filing materials inconsistent, so that they have to be explained repeatedly on inspection.

Follow-up questions

Which level of cyberspace administration authority accepts the filing and how materials are submitted: the provisions go only as far as the national and provincial, autonomous region and municipality cyberspace administration departments. Executing details follow the position of the cyberspace administration authority for your locality.

Follow-up questions

Does a model used only inside the company need filing?

The trigger in Article 17 is the provision of a generative AI service with public-opinion attributes or social-mobilisation capacity to the public. Whether a scenario that provides no service to the public is covered depends on its specific form; the position of the cyberspace administration authority for your locality governs.

Can filing and the assessment be done at the same time?

Article 17 is framed as carrying out the security assessment in accordance with the relevant national provisions first, and then completing the filing procedure; the filing materials include an algorithm self-assessment report, so the sequence is the better route.

This entry belongs to the China AI Compliance & Filing cluster (42 entries in total): View all · Answers home