China issues guidance for generative AI service providers

The technical document is intended to act as a reference for service providers to conduct security assessments, and for authorities to assess the security level of generative AI. It is also intended to support the Interim Measures for the Management of Generative Artificial Intelligence Services (Interim Measures), published by the Cyberspace Administration of China, which took effect in August last year.

The document includes a requirement that security assessments be performed on data collected for generative AI model training and that, when using commercial data, a legally binding contract should be established, noting the source, quality and safety of data.

It also requires that, regarding intellectual property (IP), a reporting channel be set up so that users of AI services can be informed of IP risks when using generated content.

According to the document, before individuals’ personal information can be used, service providers must obtain those individuals’ consent. Consent must also be obtained separately for the use of individuals’ sensitive personal information – such as race, gender and age – in training data.

In addition, service providers are required to assess the need for, and safety of, applying generative AI, ensuring measures are put in place to reduce the risks of using generative AI in critical infrastructure. Service providers are also required to assess whether the AI service is suitable for minors.

According to technology law expert Jennifer Wu of Pinsent Masons, the document builds on China’s existing compliance measures for adopting generative AI services, as outlined last year in the Interim Measures.

“This guidance sets out a prudent approach when developing generative AI services. Companies are already adopting internal assessments as to how and when AI can be adopted within their businesses and this guidance will help China’s business community to understand the best practices,” Wu said.