Interim Measures for Generative AI

AI content liability: is the provider or the user liable?

What you may need to do

1. Write the boundary of rights and duties between provider and user into the service agreement
2. Build a tiered process for handling illegal conduct by users
3. Keep records of user violations and file them
4. Report illegal activities to the competent authorities as required
5. Prohibit the use of the service for illegal activities in the service agreement

Provisions relied on

One-line conclusion

The provider and the user are not an either-or liability relationship. The provider bears the responsibility of a content producer and of a personal information processor, and the user is responsible for its own use. Shifting all liability onto users with a disclaimer does not hold under these Measures.

Basis

Article 9, paragraph 1 defines the provider's role clearly: bear the responsibility of a network information content producer in accordance with the law and perform network information security obligations; where personal information is involved, bear the responsibility of a personal information processor in accordance with the law and perform personal information protection obligations. These two capacities are statutory and do not disappear because a user clicked “agree”.

Article 22 draws the boundary between the two sides with two definitions. Item (2) provides that a generative AI service provider means an organisation or individual that uses generative AI technology to provide generative AI services (including providing generative AI services by providing programmable interfaces and other means). Item (3) provides that a generative AI service user means an organisation or individual that uses a generative AI service to generate content.

Article 14, paragraph 2 deals with illegal conduct by a user: where a provider finds that a user is using a generative AI service to engage in illegal activities, it shall, in accordance with the law and the agreement, take disposal measures such as warning, restricting functions, suspending or terminating the provision of the service to that user, keep the relevant records and report to the competent authorities. Note the words “in accordance with the law and the agreement”: the power to dispose must come from the law and must also be agreed in the service agreement in advance.

Article 18 protects users in parallel: where a user finds that a generative AI service does not comply with laws, administrative regulations or these Measures, the user has the right to complain or report to the competent authorities.

What you need to do

1. Write a list of prohibited uses into the service agreement, together with the measures the provider may take on a violation (warning, restricting functions, suspending or terminating the service), so that “in accordance with the agreement” has a basis.
2. Build tiers of disposal: a warning for minor cases, restriction of functions for repeated cases, suspension or termination of the service for serious cases.
3. Keep a record of every disposal, including the trigger, the measures taken and the time.
4. Where the reporting threshold is met, report to the competent authorities as required; do not absorb the matter internally.
5. Do not treat a clause saying that the user alone bears all liability as an exemption; statutory liability is not transferred by agreement.
6. When serving business customers, agree in the contract on the customer's duty to manage its own end users.

Common pitfalls

• Assuming a user agreement can exempt liability. The liability in Article 9 is statutory.
• Disposing without a basis. If the agreement does not mention restricting functions or suspending the service, a disposal lacks support in “the agreement”.
• Disposing without reporting. Article 14, paragraph 2 places reporting and disposal side by side.
• Treating a user's complaint as harassment. Article 18 makes clear the user's right to complain or report to the competent authorities.

Common follow-up questions

If a user generates violating content with AI and posts it on another platform, is the provider liable? Once the provider finds out, it should dispose of the matter and report in accordance with the law and the agreement. The provider's own liability is still judged under Article 9, and the focus is whether a content safety management mechanism was built and actually operated.

If employees use AI for office work and something goes wrong, is the company a user? Article 22, item (3) defines a user as an organisation or individual that uses the service to generate content. The company as an organisation is a user and is responsible for its own use.

Can the provider push all content liability onto a downstream integrator? No. An organisation or individual that provides services to the public through programmable interfaces is itself a provider, and the liability is not transferred by reselling.

Common follow-up questions

Does a clause in the service agreement saying the user bears all liability hold?

An agreement can clarify the rights and duties of the parties, but it cannot exempt the provider from its statutory duties. The network information content producer responsibility and the network information security obligations set out in Article 9 rest on the provider.

On finding a user violation, must we simply close the account?

Article 14, paragraph 2 lists measures such as warning, restricting functions, suspending or terminating the provision of the service. Handling violations in tiers according to severity, and writing the tiers into the service agreement, is the safer course.

Where can a user take a complaint that the service is non-compliant?

Article 18 provides that a user has the right to complain or report to the competent authorities. On the provider's side, Article 15 also requires a sound complaint and reporting mechanism.

This entry belongs to the “China AI Compliance and Filing” cluster (42 entries in total): View all · Answers home