China’s AI Regulations in 2026: What Companies Need to Know

Updated: October 2026

China has no single AI law. It regulates AI through separate rules, each aimed at a specific type of service, and the newest took effect on 15 July 2026. The Interim Measures for the Administration of Anthropomorphic AI Interaction Services cover AI companions and other services built around ongoing emotional interaction.

They sit on top of the Interim Measures for Generative AI Services (August 2023), the labelling rules for AI-generated content (September 2025), and an amended Cybersecurity Law (January 2026). This guide covers what each one requires, who falls in scope, and where a unified AI law stands. Bird & Bird’s analysis of the companion measures, published on 5 October 2026, is one source we draw on.

Key Takeaways

• China regulates AI service by service. Generative AI, deep synthesis, recommendation algorithms, AI-generated content labelling and, since 15 July 2026, AI companion services each have their own rules.

• The rules reach foreign companies. They apply to services offered to the public in mainland China, whether or not the provider is incorporated there. Hong Kong, Macau and Taiwan are excluded.

• The AI companion rules require a security assessment when a service launches, and again at 1 million registered users or 100,000 monthly active users. They ban virtual companion services for minors. Fines run up to RMB 100,000, or RMB 200,000 where users’ life or health is harmed.

• A unified AI law is on the legislative agenda. We found no published draft.

China Regulates AI Through Targeted Rules, Not One Law

The EU wrote one regulation that sorts AI systems by risk. China built its framework in layers over several years, adding a new instrument each time a new type of AI service raised a concern.

The Cyberspace Administration of China (CAC) leads on most of them, often with other ministries. The AI companion measures were issued on 10 April 2026 jointly by the CAC, the National Development and Reform Commission, the Ministry of Industry and Information Technology, the Ministry of Public Security and the State Administration for Market Regulation, according to Hogan Lovells.

The AI rules also draw on China’s general data laws: the Personal Information Protection Law (PIPL), the Data Security Law and the Cybersecurity Law. Providers usually have to satisfy both.

The Generative AI Measures Remain the Core Rulebook

The Interim Measures for Generative AI Services took effect on 15 August 2023. They apply to providers of generative AI that produces text, images, audio, video and other content for the public in mainland China.

Providers must carry out security assessments and file information about their algorithms. They must use lawful training data, respect intellectual property and meet personal information requirements, and take measures to prevent discrimination. Providers must stop, delete, and report illegal content to the authorities. Penalties follow the Cybersecurity Law, the Data Security Law, the PIPL and other applicable legislation.

Two older instruments continue to apply alongside them: the Deep Synthesis Provisions (in force since 10 January 2023), which require algorithm filing with the CAC, and the Algorithm Recommendation Regulation (in force since 1 March 2022).

The Regulations on Network Data Security Management, in force since 1 January 2025, add data security duties. Article 19 covers generative AI providers, which must cooperate with supervision and inspection and follow rules on training data sources, scale, type, and labelling.

Labelling of AI-Generated Content Has Been Mandatory Since September 2025

The CAC and other departments issued the Labelling Measures for AI-generated content on 14 March 2025, and they took effect on 1 September 2025. They require explicit labels such as text and voice prompts, and implicit labels such as metadata carrying the provider’s name and a content ID.

The measures cover four types of entities: AI content generation providers, internet information content propagation providers, app distribution platforms and users. Distribution platforms have to verify implicit labels in file metadata and add prominent reminders to unlabelled content or content suspected of being AI-generated. The American Bar Association’s 2025 review summarises the mechanism.

Three National Standards for Generative AI Took Effect in November 2025

On 25 April 2025, the State Administration for Market Regulation and the Standardisation Administration of China jointly released three national standards for generative AI. All three took effect on 1 November 2025. They cover basic security requirements for generative AI services, security specifications for data annotation, and security specifications for pre-training and fine-tuning data.

The Cybersecurity Law Amendment Added an AI Article

The National People’s Congress Standing Committee adopted amendments to the Cybersecurity Law on 28 October 2025. They took effect on 1 January 2026, and China Briefing calls them the most significant adjustments since the law’s adoption.

The amendment adds a new Article 20. It commits the state to supporting basic AI research and key technologies such as algorithms, building infrastructure such as training data resources and computing power, improving AI ethical norms, and strengthening risk monitoring, assessment and security supervision.

The article also supports AI policy. The changes with direct compliance effect sit elsewhere in the amendment. Penalties are higher across the law, with fines of RMB 2 million to RMB 10 million for the most serious consequences, and a new clause requires network operators to follow the PIPL and the Civil Code when processing personal information.

AI Companion Services Have Had Their Own Rules Since July 2026

The Interim Measures for the Administration of Anthropomorphic AI Interaction Services took effect on 15 July 2026. Hogan Lovells describes them as the first Chinese rules aimed specifically at AI-driven emotional interaction.

The rules apply to continuous emotional interaction

Article 2 covers services that use AI to simulate human personality traits, thinking patterns and communication styles to provide continuous emotional interaction to the public in mainland China. This includes companionship, emotional care, and psychological support, in text, image, audio, video, or other formats.

The measures exclude customer service, knowledge Q&A, work assistants, education and scientific research. The deciding test is whether the interaction is continuous and emotional.

Bird & Bird notes that the text provides no technical definition of continuity. A user could keep a relationship going by recapping earlier conversations at the start of each session, and general-purpose AI services are also used for emotional support. Regulators and courts have not yet addressed the question, so general-purpose AI providers cannot assume they are outside the rules.

Minors, crisis response and user data have specific duties

The measures carry several obligations that go beyond the older AI rules:

• Minors. Virtual companion and virtual relative services are banned for minors. Providers must offer a minor mode with usage time limits and parental controls. For users under 14, parental or guardian consent is required.

• AI disclosure and usage reminders. Providers must remind users they are talking to an AI, and must issue a usage reminder after two hours of continuous use. Where signs of excessive dependence or addiction appear, they must warn the user prominently.

• Crisis response. If a user shows extreme emotional distress, the provider must respond with comfort and encourage the user to seek help. Where a user has expressed an intention to self-harm or is facing significant financial loss, the provider must intervene and notify the user’s guardian or emergency contact.

• User data. Providers must use encryption and access controls, let users copy or delete their chat history, and obtain separate explicit consent before using sensitive personal information from interactions to train models.

• Elderly users. Providers must show prominent safety risk warnings.

Two provisions are open-ended. Article 8(5) prohibits over-accommodating users, inducing emotional dependence and damaging real-world relationships, and Article 8(6) prohibits emotional manipulation that leads users to make unreasonable decisions. Neither comes with guidance on where the line sits.

Security assessments are triggered at low user numbers

A provider must submit a security assessment report to the provincial cyberspace authority when it launches the service, makes significant technical changes, or reaches 1 million registered users or 100,000 monthly active users. The assessment covers safeguards, training data governance, handling extreme user scenarios, protecting minors and older people, and complaint handling.

Providers must also file their algorithms under the Recommendation Algorithm Regulations. App stores have to check that the security assessment and filing are done before an app goes live.

Penalties and early market reaction

Under Articles 29 and 30, authorities can interview a provider’s legal representative, order rectification, suspend services and impose fines of up to RMB 100,000, rising to RMB 200,000 where users’ life or health has been harmed.

According to Bird & Bird, major Chinese generative AI platforms withdrew their AI agent features before the measures took effect, including some tool-oriented agents that appear to fall inside the exclusions. The firm notes that the reasons are a matter of inference. On 5 October 2026, it reported that the measures had been in force for less than two months and that no enforcement decisions or regulatory guidance had been published.

A Unified AI Law Is Planned, and No Draft Has Been Published

Chinese authorities have said a unified AI law is coming. On 27 May 2026, Vice Minister of Justice Wu Zeng told a press conference that legislative priorities for the year include advancing wide-ranging legislation for the sound development of AI, Global Times reported.

The NPC Standing Committee’s 2026 legislative plan, released on 11 May 2026, is less specific. NPC Observer reports that the plan schedules 34 bills for review, and none of the titled bills concerns AI. The plan separately directs research into legislative projects on issues including the healthy development of artificial intelligence.

We found no published draft. Until one appears, the instruments above remain the law.

China and the EU Regulate AI in Different Ways

Feature	China	EU
Structure	Separate rules per service type	One regulation, the AI Act, with risk categories
Lead regulator	CAC, often with other ministries	National authorities and the EU AI Office
Main focus	Content, public opinion, user protection, data security	Risk to health, safety and fundamental rights
Territorial reach	Services to the public in mainland China	AI systems placed on or used in the EU market
Content labelling	Explicit and implicit labels since 1 September 2025	Article 50 transparency duties since 2 August 2026, with a grace period to 2 December 2026 for systems already on the market
High-risk timing	No equivalent category	Annex III systems from 2 December 2027, Annex I systems from 2 August 2028

The EU dates reflect the Digital Omnibus on AI, Regulation (EU) 2026/1744, which entered into force on 27 July 2026. Sidley sets out the new dates for high-risk systems and the watermarking grace period.

Foreign Companies Are in Scope If They Serve Users in Mainland China

Where a service is offered to the public in mainland China, the rules apply regardless of where the company is based. In practice, three questions come first:

• Is the service available to users in mainland China, and does it produce generated content or simulate a human personality?

• Does it need an algorithm filing, a security assessment or a generative AI filing with the CAC?

• Where is user data stored and processed, and does the PIPL’s consent and transfer regime apply?

Hogan Lovells adds that foreign providers should check ICP licensing requirements and the effect of data localisation on their system architecture.

Conclusion

China’s AI rules are specific to each service type; the CAC and its partner ministries enforce them, and they now include a dedicated set for AI companions. The most recent changes are the AI Labelling Measures (September 2025), the Cybersecurity Law amendment (January 2026) and the companion measures (July 2026).

Companies offering AI to users in mainland China should map each product against the instruments above, starting with the generative AI measures and the labelling rules. Anything with persona, memory or emotional features needs a separate check against the companion measures.

Our AI governance services and data protection consultants can help you map your AI services against these requirements.

Frequently Asked Questions

Does China have a national AI law?

No. China regulates AI through separate rules for each type of service, plus general laws on cybersecurity, data security and personal information. Authorities have said a unified AI law is a legislative priority. We found no published draft.

Do China’s AI regulations apply to foreign companies?

Yes, where the company offers AI services to the public in mainland China. The provider’s location does not matter. Hong Kong, Macau and Taiwan are excluded.

When did the AI companion rules take effect?

On 15 July 2026. The CAC and four other bodies issued the Interim Measures for the Administration of Anthropomorphic AI Interaction Services on 10 April 2026.

Does an AI chatbot fall under the AI companion rules?

It depends on how users engage with it. The rules apply to services that simulate human personality traits to provide continuous emotional interaction. Customer service, knowledge Q&A, work assistants, education and scientific research are excluded. Bird & Bird notes that continuity is not defined, and that general-purpose AI services may also be used for emotional support.

Is AI-generated content labelling mandatory in China?

Yes, since 1 September 2025. Providers must use explicit labels that users can see, such as text and voice prompts, and implicit labels embedded in metadata. Distribution platforms must also verify implicit labels and flag unlabelled or suspected AI-generated content.

How does China’s approach differ from the EU AI Act?

China regulates by service type through several instruments led by the CAC. The EU AI Act is a single regulation that classifies AI systems by risk and is enforced by national authorities and the EU AI Office.

Disclaimer: This blog post is for informational purposes only. It does not offer legal advice or opinions. This article is not a guide for resolving legal issues or managing litigation on your own. It should not be considered a replacement for professional legal counsel and does not provide legal advice for any specific situation or employer.