China released regulations governing AIGC service providers

By 董皓 & Wenqiang Huang

Cyberspace Administration of China (CAC), the main data regulator, formally regulated the business of artificial intelligence-generated content (AIGC) Services on July 13, 2023. The regulation is titled Interim Administrative Measures on the AIGC Services (Measures). The Measures will come into force on August 15, 2023.

CAC released a draft version of the Measures for public comments in April. Compared to the April draft, the effective version of the Measures appeared to be more friendly to business.?

For multinational companies, the following terms of the Measures are more important than others.?

Definition of the AIGC and the regulated entities

The Measures defines AIGC as “models and related technologies that can generate text, images, audio, video, or other content.”

The Measures apply to all entities and individuals who provide AIGC services to the public. It specified that a programmable interface constitutes the provision of AIGC service. As such, third-party API developers in the ecosystem of an existing large language model (e.g., GPT-4) will fall into the coverage of the Measures.

Interestingly, the Measures have excluded universities and scientific research institutions from its coverage, provided that they do not provide AIGC service to users located in the territory of China.

Basic principles in providing AIGC service:

The Measures uphold certain universal norms, such as:

- non-discrimination: AIGC programs shall not be biased on race, ethnicity, beliefs, nationality, region, gender, age, etc.

- protecting intellectual property and trade secrets, and

- respecting other lawful rights and interests – AIGC services shall not be used to harm users’ mental health and dignity.

Protection of personal data

The Measures have reiterated the requirement of protecting personal information under the PRC Personal Information Protection Law (PIPL). In particular, an AIGC service provider shall:

- obtain consent from data subjects before collecting their personal information, except as permitted by law;

- comply with the data minimization requirement, i.e., ensure the scope of data processing is limited to the minimum scope necessary for achieving the purpose of processing and shall not be excessive; and

- timely response to requests from individuals for accessing, copying, correction, modification, or deletion of personal data.

Protection of minors

According to the Measures, AIGC service providers must disclose the specific usage and services associated with their AIGC functions. They are required to educate minors to use the AIGC responsibly and legally.

Further, AIGC service providers shall implement preventive measures to mitigate the risk of minors being over-reliant or addicted to the AIGC services.

Data labeling

Where data labeling is performed during the research and development of AIGC technology, providers shall formulate clear, specific, and operable labeling rules. They must also establish a training program for the staff who perform the data labeling work.

If breached

Those found violating the Measures may face suspension/termination of business and other punishments by referring to applicable regulations.?

*??????????*??????????*??????????*??????????*

Author: 董皓 is a partner of Hylands Law Firm heading its practice of data and the internet industry. ?A Certified Information Privacy Manager (IAPP/CIPM), and an Adjunct Professor at the University of Hong Kong’s Academy of Senior Executives, he regularly advises MNCs, unicorns, and start-ups on cross-border intellectual property, data privacy, related investment, and contentious matters.

?