Filing practice

Beyond filing, which other obligations must you not miss?

What you may need to do

1. Set up appeal and complaint and reporting channels in a prominent position of the service and publish the handling time limit
2. Clarify where content producer responsibility and personal information processor responsibility fall
3. Sign a service agreement with users that sets out the rights and obligations of both sides
4. Keep a complaint handling register and hold the response time limit to account

Statutory basis

One-sentence conclusion

Filing is only one of the compliance steps. An enterprise must also bear the responsibility of a network information content producer, perform network information security duties and personal information protection duties, establish a complaint and reporting mechanism together with a user appeal mechanism, publish the handling time limit, and cooperate with supervision and inspection by the competent departments. Miss these and the filing itself will not hold.

Basis

Article 9 of the Interim Measures for the Management of Generative AI Services: a provider shall bear the responsibility of a network information content producer in accordance with law and perform network information security duties. Where personal information is involved, it shall bear the responsibility of a personal information processor in accordance with law and perform personal information protection duties. The second paragraph of the same article also requires the provider to sign a service agreement with users who register for its service, setting out the rights and obligations of both sides.

Article 15 requires a complaint and reporting mechanism to be established and improved: convenient complaint and reporting channels, a published handling process and response time limit, and prompt acceptance, handling and feedback on public complaints and reports.

Article 22 of the algorithmic recommendation provisions corresponds to it: a provider of algorithmic recommendation services shall set up convenient and effective channels for user appeals and for public complaints and reports, specify the handling process and the response time limit, and promptly accept, handle and give feedback on the results. In other words, both sets of provisions treat the four-part package of channel, process, time limit and feedback as a hard requirement.

Beyond those, the remaining articles of the two sets of provisions contain a series of continuing duties that are often forgotten: training data processing rules (Article 7 of the generative AI measures), data annotation rules and annotation quality assessment (Article 8), protection of minors against addiction (Article 10), labeling of generated content (Article 12), handling and reporting of illegal content (Article 14), and cooperation with supervision and inspection (Article 19). On the algorithmic recommendation side these include information security management and feature libraries (Article 9), user models and label management (Article 10), ecosystem management of layouts and pages (Article 11), and publication of the filing number (Article 26).

One clarification: the provisions do not give a specific number of days for complaint handling, only a requirement to specify the handling process and the response time limit — that is, the enterprise publishes the time limit itself and commits to it. The concrete standard may differ, and the position of the cyberspace administration authority for your locality governs.

What you need to do

• Put the complaint and reporting channels and the user appeal channel in a prominent position of the service, with the handling process and the response time limit written out.
• Clarify who is responsible for content security and personal information protection, which systems apply and what system capabilities exist.
• Sign a service agreement with users setting out the rights and obligations of both sides.
• Keep a complaint register and hold the agreed feedback time limit to account.
• Add the continuing duties for generative AI services: content labeling, training data and annotation rules, protection of minors.
• Build a standing pack of materials and a named contact for cooperation with supervision and inspection.

Common pitfalls

Completing the filing but never turning the complaint and reporting mechanism into a channel users can actually reach. Having a channel but never publishing the handling process and the response time limit. Copying a template service agreement that does not match the actual form of the product. Treating content labeling and protection of minors against addiction as operational options rather than duties. Keeping no record of complaints, so that when handling has to be explained there is nothing to produce.

Follow-up questions

The time limit for handling complaints and reports is published by the enterprise itself and the provisions do not set a number of days; whether the handling has to be reported separately to the competent department is also not required by the provisions. The position of the cyberspace administration authority for your locality governs.

Follow-up questions

Do the complaint and reporting channels have to sit inside the app?

The requirement in Article 9 and the related provisions is to set up convenient channels and to publish the handling process and the response time limit. The form of the channel is not limited by the provisions, but users must be able to find it easily.

Is there a single checklist for all these duties?

The source documents provide no checklist. Building a self-check table article by article is the recommended route, and the concrete position follows the cyberspace administration authority for your locality.

This entry belongs to the China AI Compliance & Filing cluster (42 entries in total): View all · Answers home