⁠‌​‌​‌​‌‌‌​‌​​​​‌​‌‌​‌​​‌​‌‌‌​‌​‌⁠Interim Measures for Generative AI

If AI generates illegal or non-compliant content, how should a platform prevent it?

What you may need to do

1. Build classification, review and interception rules for generated content.
2. Set refusal and transfer-to-human policies for high-risk prompts.
3. Continuously add safety samples at the model optimisation stage.
4. Retain generation and interception logs for inspection.
5. Re-scan generated content periodically for sampling evaluation.

Provisions relied on

One-line conclusion

When AI-generated content causes trouble, responsibility does not disappear because the model produced it. Article 9 of the Interim Measures for the Administration of Generative AI Services characterises the provider as a network information content producer; the first sentence of Article 9 supplies that characterisation, and Article 4 sets out specifically what must not be generated.

Basis

Article 4 requires that in providing and using generative AI services, laws and administrative regulations be observed and social morality and ethics respected, and it lists five requirements. The first is the core negative list: do not generate content that incites subversion of state power or overthrow of the socialist system, endangers national security and interests, damages the national image, incites secession, undermines national unity and social stability, promotes terrorism or extremism, promotes ethnic hatred or ethnic discrimination, is violent, obscene or pornographic, or is false and harmful information, along with other content prohibited by laws and administrative regulations.

The second requires discrimination to be prevented, across the whole process: in algorithm design, training data selection, model generation and optimisation, and service provision, effective measures shall be taken to prevent discrimination on grounds of ethnicity, belief, country, region, gender, age, occupation and health.

The fifth requires effective measures based on the characteristics of the service type to improve the transparency of the service and to improve the accuracy and reliability of generated content.

Article 9 supplies the characterisation of responsibility: providers shall bear the responsibility of a network information content producer in accordance with the law and perform network information security obligations. That means the security obligation is not an optional item; it comes with the provider's status.

What you need to do

1. Build a content safety policy with layered handling: clear violations are refused outright, grey-area content is downgraded or transferred to a human, and normal content passes.
2. Turn the negative list in Article 4, item (1) into an executable set of interception rules, rather than leaving it in a policy document.
3. Tighten policy separately for high-risk scenarios (government affairs, healthcare, finance, news and information), because these fields demand higher accuracy and reliability.
4. Continuously add safety samples at the model optimisation stage, feeding problems found in production back into training and policy.
5. Retain generated content and interception records, for after-the-fact review and for responding to inspections.
6. Sample and re-scan periodically to check whether policy lets content slip through or wrongly blocks it.

Common pitfalls

• Filtering input keywords only. There are many ways around that, so the output side needs checking too.
• Leaving content safety to the model vendor and stopping there. The responsible party under Article 9 is the provider offering the service.
• Ignoring discrimination. Article 4, item (2) writes discrimination prevention into algorithm design, training data selection and other stages.
• Missing records. Being unable to explain which measures were taken is the same as having taken none.

Common follow-up questions

A user deliberately induces it and the output goes wrong -- who is responsible? The provider still bears the responsibility of a network information content producer. At the same time, Article 14 requires that where a user is found to be engaging in illegal activity, measures such as warning, restricting functions, or suspending or terminating the provision of the service shall be taken in accordance with law and agreement, and reported.

Must we reach zero violations? The law requires effective measures to prevent violations and to handle them promptly. Absolute zero occurrence is not attainable, but you must have verifiable measures and a mechanism that disposes of problems as soon as they are found.

Does inaccurate generated content count as a violation? Article 4, item (5) requires improving the accuracy and reliability of generated content, which is a directional obligation to take effective measures. Inaccuracy is not necessarily illegal content in itself, but if it becomes false and harmful information it falls within the prohibition in Article 4, item (1).

Common follow-up questions

Can content review be fully outsourced?

The technical part can be outsourced, but the network information content producer responsibility under Article 9 rests with the provider; policy standards, disposal decisions and record keeping cannot be handed over along with it.

How do copyright and content responsibility work for AI-written material?

Content safety responsibility rests with the provider under Article 9. Article 4, item (3) also requires respecting intellectual property and business ethics, keeping trade secrets, and not using algorithm, data or platform advantages to monopolise or engage in unfair competition.

If a topic answers badly after launch, how do we patch it?

In the short term, stop the bleeding with interception and refusal policy, and at the same time take disposal measures such as stopping generation, stopping transmission and eliminating the content under Article 14, and rectify through model optimisation training.

This entry belongs to the “China AI Compliance and Filing” cluster (42 entries in total): View all · Answers home