⁠​​‌‌‌‌​​​​​‌​‌‌​‌‌‌​​‌​‌‌‌​​‌​​​⁠Interim Measures for Generative AI

AI has generated illegal content -- how do we dispose of it and report it?

What you may need to do

1. Write an emergency disposal procedure for illegal content and name the people responsible.
2. Define the concrete actions for stopping generation, stopping transmission and eliminating content.
3. Set up the reporting route to the competent authorities and a record template.
4. Apply graded restrictions to abusive users and keep records.
5. Feed production problems back into model optimisation and policy updates.

Provisions relied on

One-line conclusion

Four actions are indispensable when illegal content is found: prompt disposal, rectification, reporting and record keeping. Deleting the content without reporting, or reporting without rectifying, does not satisfy Article 14.

Basis

Article 14, paragraph 1 addresses content: where a provider finds illegal content, it shall promptly take disposal measures such as stopping generation, stopping transmission and eliminating the content, take measures such as model optimisation training to rectify the situation, and report to the competent authorities.

There are three layers here. The first is immediate disposal, and the measures include stopping generation (blocking the current output), stopping transmission (blocking the spread) and eliminating the content (clearing what has already been produced). The second is rectification, which explicitly requires measures such as model optimisation training, meaning reducing recurrence at the root cause rather than only cleaning up a single point. The third is reporting to the competent authorities.

Article 14, paragraph 2 addresses users: where a provider finds a user using a generative AI service to engage in illegal activity, it shall, in accordance with law and agreement, take disposal measures such as warning, restricting functions, or suspending or terminating the provision of the service to that user, keep the relevant records, and report to the competent authorities.

The key phrase in paragraph 2 is in accordance with law and agreement. In accordance with law means the disposal must have a legal basis; in accordance with agreement means these measures must be agreed in advance in the service agreement, otherwise enforcement lacks contractual support. Keeping the relevant records is required explicitly as well.

Article 19 adds a duty to cooperate: when the competent authorities carry out supervision and inspection, providers shall cooperate in accordance with the law, explain the source, scale and type of training data, the labelling rules, the algorithm mechanism and so on as required, and provide the necessary technical and data support and assistance.

What you need to do

1. Write an emergency disposal procedure: who discovers, who judges, how quickly disposal happens, who decides on reporting. Make the on-call arrangement explicit.
2. Put the three types of measure into practice: stopping generation corresponds to output-side interception; stopping transmission corresponds to closing sharing, export and public links; eliminating corresponds to taking content down and clearing caches.
3. Build a reporting record template: time of the incident, form of the content, scope of impact, measures taken, rectification plan.
4. Handle abusive users in grades by severity, and write the grading into the service agreement so that in accordance with agreement has a basis.
5. Keep disposal records, including what triggered them and which measures were taken.
6. Feed problems back into model optimisation training and safety policy to close the loop.

Common pitfalls

• Deleting without reporting. Paragraph 1 puts reporting and disposal on the same footing.
• Disposing of only that one output without rectifying on the model side. Paragraph 1 explicitly requires measures such as model optimisation training.
• Disposing against a user without a contractual basis. In accordance with agreement in paragraph 2 requires prior agreement.
• Not keeping records. Records are both a compliance requirement and the evidence needed during supervision and inspection.
• No clear owner for the judgement call. Finding the problem and then escalating level by level misses the window for disposal.

Common follow-up questions

Which department do we report to? Article 14 says the competent authorities. The specific reporting channel and time limit follow your local cyberspace administration; internally, name the contact department and the responsible person in advance.

If the user deletes the content, do we still have to report? Disposal and reporting are two independent actions. Finding illegal content triggers the action requirements in paragraph 1, and they are not lifted because the content has since been deleted.

The model outputs illegal content only occasionally -- does this article still apply? The trigger in Article 14 is finding illegal content, and it does not turn on whether the problem is occasional. Occasional problems also go through disposal, rectification and reporting, and model optimisation training is used to reduce recurrence.

Common follow-up questions

How do we choose between suspending and terminating the service?

Article 14, paragraph 2 lists measures such as warning, restricting functions, and suspending or terminating the provision of the service to that user. Apply them in grades by severity, and write the grading standard into the service agreement.

What should the disposal records contain?

The Measures require the relevant records to be kept. We suggest at least the time of the incident, the content or function involved, the conclusion, the measures taken, the reporting and the rectification actions.

What must a company provide during supervision and inspection?

Under Article 19, providers shall cooperate in accordance with the law, explain the source, scale and type of training data, the labelling rules, the algorithm mechanism and so on as required, and provide the necessary technical and data support and assistance.

This entry belongs to the “China AI Compliance and Filing” cluster (42 entries in total): View all · Answers home