Interim Measures for Generative AI
What must an AI service user agreement spell out?
Basis: Interim Measures for the Administration of Generative AI Services (《生成式人工智能服务管理暂行办法》)
Conclusion: Article 9, paragraph 2 of these Measures requires a provider to conclude a service agreement with users who register for its generative AI service, clarifying the rights and duties of both sides; Article 10 requires the intended audience, occasions and purposes of the service to be made clear and public; Article 4, item (5) requires greater transparency and greater accuracy and reliability of generated content. The agreement should cover: the scope of and limits on the service, prohibited uses, measures for violations, personal information processing rules, and complaint and reporting channels with a response time limit.
What you may need to do
- Draft a service agreement template that meets these Measures
- Set out prohibited uses and measures for violations in the agreement
- Publish the intended audience, occasions and purposes of the service
- State personal information processing and the complaint and reporting channel in the agreement
- Attach a clear notice to AI-generated content
Provisions relied on
Interim Measures for the Administration of Generative AI Services, Article 9
A provider shall conclude a service agreement with users of the generative AI service who register for its service (hereafter users), clarifying the rights and duties of both sides.
Interim Measures for the Administration of Generative AI Services, Article 4
(5) take effective measures based on the characteristics of the service type to improve the transparency of generative AI services and to improve the accuracy and reliability of generated content.
Interim Measures for the Administration of Generative AI Services, Article 10
A provider shall make clear and publish the intended audience, occasions and purposes of its service, guide users to understand generative AI technology scientifically and rationally and to use it in accordance with the law, and take effective measures to prevent minor users from becoming overly dependent on or addicted to generative AI services.
One-line conclusion
The service agreement is not just a legal text; it is the vehicle that carries several obligations. Article 9, paragraph 2 requires an agreement that clarifies the rights and duties of both sides; Article 10 requires the intended audience, occasions and purposes to be published; Article 4, item (5) requires greater transparency. A disposal measure that is not written into the agreement lacks a basis when it is executed.
Basis
Article 9, paragraph 2 provides: a provider shall conclude a service agreement with users of the generative AI service who register for its service, clarifying the rights and duties of both sides. Note that the audience is “users who register for its service”, that is, users with an account, and the agreement must reach them.
Article 10 requires the intended audience, occasions and purposes of the service to be made clear and public, requires guiding users to understand generative AI technology scientifically and rationally and to use it in accordance with the law, and requires measures against excessive dependence on or addiction to generative AI services by minors. The audiences for the disclosure are users, and both the agreement and product pages can carry it.
Article 4, item (5) requires effective measures based on the characteristics of the service type to improve the transparency of generative AI services and to improve the accuracy and reliability of generated content. On the agreement side, transparency means explaining the boundaries of the service's capability, stating that content is generated by AI, and stating that errors may occur.
Taken together, these articles determine what substantive content the agreement must contain. In addition, Article 14, paragraph 2 uses the phrase “in accordance with the law and the agreement”, which means the agreement must agree in advance on how violations are handled for a disposal to have a contractual basis. The complaint and reporting entry point and the response time limit under Article 15 also need to be made known to users in the agreement or on accompanying pages.
What you need to do
- Draft the service agreement, stating at least: the service content and the boundaries of its capability, the intended audience and occasions, the list of prohibited uses, the measures for violations (warning, restricting functions, suspending or terminating the service), personal information processing rules, and the complaint and reporting channel with a response time limit.
- Write “use of this service for illegal activities is prohibited” as an express clause and link it to the disposal measures, so that “in accordance with the agreement” under Article 14 holds.
- Publish the intended audience, occasions and purposes. This can live on the product introduction page and need not be hidden in an annex to the agreement.
- Give generated content a transparency notice: the content is generated by AI, may be inaccurate, and should be verified by a person before any major decision.
- Manage agreement versions. Clause changes must be notified to users and past versions kept.
- For business customers, sign a separate data processing agreement that sets out each side's role in relation to personal information and input information.
Common pitfalls
- Copying the agreement from an e-commerce or SaaS template, with nothing about the characteristics of AI-generated content.
- Writing prohibited uses but not the measures for violations, leaving no basis for action when a violation occurs.
- Overusing exemption clauses. Article 9 makes the provider bear the network information content producer responsibility, which cannot be waived by agreement.
- Disclosing the intended audience only in the agreement, with no notice in the product interface.
- Updating clauses without notifying users and without keeping past versions.
Common follow-up questions
Must the agreement state the intended audience? Article 10 requires the intended audience, occasions and purposes to be made clear and public. The place of disclosure is not fixed, but users must be able to learn it.
Can one line, “AI-generated content is for reference only”, satisfy the transparency requirement? That line is necessary, but transparency also requires explaining the boundaries of capability and the risks based on the characteristics of the service type. For scenarios such as medical care or finance, a more specific notice is advisable.
Do limitation of liability clauses in the agreement hold? Clarifying the rights and duties of both sides is itself required by Article 9, paragraph 2, but statutory liability cannot be waived by agreement. Clauses about content must be designed under Article 9, paragraph 1 and Article 14.
Common follow-up questions
- If business customers sign a contract rather than registering, do they still need a service agreement?
- Article 9, paragraph 2 is worded for users who register for the service. Business customers normally agree their rights and duties in a commercial contract; we suggest covering the same elements there, including prohibited uses, measures for violations and personal information processing rules.
- How is the transparency requirement implemented in practice?
- Article 4, item (5) requires effective measures based on the characteristics of the service type to improve transparency. Common practice is to mark content as AI-generated, explain the boundaries of capability, and prompt users to verify important information.
- Does an updated user agreement need fresh consent?
- These Measures do not prescribe a specific form. We suggest giving prominent notice of the change and re-confirming as the business requires, while keeping past versions for inspection.