Data, Cybersecurity and AI

Data and AI in China: the landscape at a glance

Data and AI in China are governed by one of the most developed regulatory systems in the world. Three national laws form the base: the Cybersecurity Law, the Data Security Law and the Personal Information Protection Law (PIPL). On top of them sit State Council regulations, a growing set of rules from the Cyberspace Administration of China (CAC) and sector regulators, and a large body of national standards that regulators use in practice to judge compliance. Artificial intelligence is regulated service by service, through rules on algorithms, deep synthesis, generative AI, content labelling and, since July 2026, anthropomorphic AI.

For foreign companies, the main questions are practical. Can we send data from China to our global systems? Is any of our data "important data"? What do we have to do if we suffer a breach? Can we launch an AI product to Chinese users, and what filings are needed? For Chinese companies going abroad, the mirror questions concern the GDPR, the EU AI Act, US restrictions on data and connected vehicles, and how to run one group compliance programme across conflicting regimes.

This page sets out the framework, the regulators and the main themes for 2026, and introduces each of our detailed guides. It is general information about the Chinese legal and regulatory environment, written from a cross-border perspective.

The legal framework for data and AI in China

The framework has been built in layers since 2017. The laws set principles and penalties; regulations and departmental rules supply the detail; and national standards (GB and GB/T) translate requirements into checklists that auditors and regulators apply. Several important instruments took effect in 2025 and 2026, so programmes designed even two years ago may now be out of date.

Earlier AI rules remain central: the Provisions on Algorithmic Recommendation (2022), the Provisions on Deep Synthesis (2023) and the Interim Measures for Generative AI Services (August 2023). Together they require algorithm filing for services with public opinion or social mobilisation attributes, security assessments, content controls and, for generative AI offered to the public, a filing process with the CAC before launch.

Who regulates data and AI in China

The CAC is the coordinating regulator for cybersecurity, data security and personal information, and the lead regulator for AI services that generate or distribute content. It runs the cross-border transfer system, algorithm and generative AI filings, and most enforcement campaigns against apps and platforms.

Other regulators share the field. The Ministry of Industry and Information Technology (MIIT) supervises telecoms, industrial data and connected vehicles, and is active on app compliance. The Ministry of Public Security runs the multi-level protection scheme and investigates cybercrime and data crime. The State Administration for Market Regulation (SAMR) handles certification and consumer-facing issues. The National Data Administration, created in 2023, leads on data as an economic resource, including data assets, public data and data trading. Sector regulators such as the People's Bank of China, the National Financial Regulatory Administration and the National Health Commission set their own data rules, which often go further than the general regime.

Enforcement combines routine inspections, special campaigns, app takedowns, fines and, in serious cases, criminal prosecution for illegally obtaining or selling personal information. Regulators also publish typical cases and Q&A guidance, which are useful indicators of current priorities.

Key themes for data and AI in China in 2026

Cross-border transfers: easier, but more structured

Since March 2024 the cross-border regime has been relaxed. Many routine transfers are exempt, the security assessment applies only to large volumes, important data and critical information infrastructure operators, and assessment approvals now last three years. According to the CAC's March 2026 review, nine pilot free trade zones have published data export negative lists covering 22 sectors, and a certification route for mid-volume personal information exports has operated since January 2026. The trade-off is that regulators now expect companies to have documented their analysis.

Accountability: audits, officers and assessments

The focus of enforcement has shifted from notice-and-consent to accountability. Processors of personal information of 1 million or more individuals have had to report their personal information protection officer to the CAC since 2025. Large processors must carry out compliance audits, and important data processors must now carry out and file annual risk assessments under the Measures for Network Data Security Risk Assessment, in force since 20 August 2026.

AI: service-specific rules and labelling

China has not adopted a single AI statute. Instead, it regulates AI services through targeted measures and standards, adding rules as new use cases emerge. The amended Cybersecurity Law now expressly supports AI development while calling for stronger ethics, risk monitoring and supervision, which suggests further measures will follow. Labelling of AI-generated content has been mandatory since September 2025, and companion, emotional support and similar services face specific rules from July 2026.

Data as an asset

Policy encourages companies to treat data as a resource to be valued, traded and financed. Accounting rules for enterprise data resources have applied since January 2024, and data exchanges in Shanghai, Shenzhen, Beijing and elsewhere offer listing and trading services. This creates opportunities, but also new questions about ownership, licensing and compliance of the underlying data. A dataset can only be valued, licensed or pledged with confidence if it was collected lawfully, with valid consent or another legal basis, and if any important data or personal information in it can be used for the intended purpose.

Our data and AI in China practice areas

Each of the following pages explains one part of the field in detail.

Core compliance

• Personal information protection (PIPL): legal bases, consent, sensitive personal information, individual rights, officers, audits and enforcement.
• Cross-border data transfer: the security assessment, standard contract and certification routes, exemptions, free trade zone negative lists and the Greater Bay Area arrangements.
• Important data and data security: identifying important data, catalogues and standards, data security officers and annual risk assessments.
• Data breach response: incident grading, reporting deadlines, notification of individuals and handling regulators across jurisdictions.
• Employee personal information: HR data, monitoring, background checks and group HR systems.

Transactions and sectors

• Data compliance in IPOs and M&A: diligence, cybersecurity review, CSRC and exchange expectations, and deal protections.
• Health and medical data: medical records, clinical trial data, human genetic resources and health apps.
• Connected vehicle and automotive data: in-car data, mapping, important data in the automotive sector and US and EU restrictions.
• Data assets and data trading: data rights, accounting for data resources, data exchanges and data-backed financing.
• EU data and cyber rules for Chinese companies: GDPR, NIS2, the Data Act, the Cyber Resilience Act and the AI Act.

Artificial intelligence

• AI regulation and governance: algorithm and generative AI filings, labelling, ethics review and AI governance frameworks.
• AI disputes and case law: copyright in AI output, training data, personality rights and liability.
• AI in employment: algorithmic management, automated decisions about workers and platform labour.
• Healthcare AI: AI medical devices, clinical decision support and the use of health data to train models.

Data and AI in China from a cross-border perspective

Few businesses face only Chinese rules. A multinational with a China subsidiary must reconcile the PIPL with the GDPR, US state privacy laws and Hong Kong's Personal Data (Privacy) Ordinance. The mechanisms are similar in concept but differ in detail: China requires separate consent in more situations, sets volume thresholds for transfers, and adds a national security dimension through important data that has no direct equivalent in the GDPR.

Restrictions also run the other way. The US Department of Justice rule on access to bulk sensitive personal data by countries of concern, in force since April 2025, limits certain data transactions involving China. US rules on connected vehicles restrict Chinese-linked software and hardware in vehicles sold in the US. In Europe, the AI Act's obligations are phasing in, NIS2 has widened cybersecurity duties, and the Data Act governs access to connected-product data. Chinese companies expanding abroad must build compliance for these regimes alongside their domestic obligations.

Government-to-government dialogue is also developing. The CAC reports that China and the EU held a second meeting of their cross-border data flow exchange mechanism, that China and Germany agreed to continue regular dialogue, and that work is under way with ASEAN on a joint guide comparing China's standard contract for personal information export with the ASEAN model contractual clauses. None of these yet changes the legal tests that apply to a transfer, but they point toward greater interoperability. In the meantime, groups operating across ASEAN and China should design contracts that can satisfy both templates, rather than negotiating separate agreements for each jurisdiction.

Hong Kong is often the bridge. The Mainland and Hong Kong have operated a simplified standard contract for personal information flows within the Greater Bay Area since 2023, and Guangdong has published a filing guide for it. For groups headquartered in Hong Kong or Shenzhen, this can simplify regional HR and customer data flows. See our hub on the Greater Bay Area, and our cross-practice guide to China data compliance.

Penalties and liability

Liability is layered. Under the PIPL, serious violations can lead to fines of up to RMB 50 million or 5% of the previous year's turnover, suspension of the relevant business, and fines and temporary bans on directly responsible managers. The Data Security Law punishes breaches of core data rules most severely and provides for fines and business suspension for failures to protect important data or for unlawful exports. The Network Data Security Management Regulations add specific fine ranges, for example up to RMB 2 million in serious cases for failures by important data processors to identify and declare data, meet the requirements for responsible persons or assess risks before sharing data.

The amended Cybersecurity Law, in force since 1 January 2026, raised penalties under that statute; Xinhua reported that conduct causing critical information infrastructure to lose its main functions, or other particularly serious harm, can attract fines of RMB 2 million to RMB 10 million. Beyond administrative fines, the Criminal Law punishes infringing citizens' personal information, refusing to perform information network security management obligations and illegal intrusion. Civil claims are also growing, including public interest litigation brought by procuratorates against companies that misuse personal information at scale.

Regulators frequently take softer steps first: interviews (summonses), rectification orders, app removals and public naming. A well-documented compliance programme is the best way to keep an issue at that level.

A practical roadmap for foreign companies

For a foreign-invested group starting or refreshing its China programme, the following sequence usually works:

1. Inventory. List the China entities, systems, vendors and data categories, and count the individuals whose personal information each entity holds.
2. Classify. Mark sensitive personal information, minors' data and any data that could be important data under sector catalogues or GB/T 43697-2024.
3. Choose transfer routes. For each outbound flow, decide whether an exemption, the standard contract, certification or a security assessment applies, and complete the personal information protection impact assessment.
4. Appoint and report. Designate a personal information protection officer and, where needed, a data security officer and management body; report as required.
5. Document. Update privacy notices, consent flows, internal policies, vendor contracts and the incident response plan to match Chinese requirements.
6. Diarise. Set dates for audits, annual risk assessments, renewals of assessments and certificates, and retraining.
7. Review AI uses. Identify any public-facing algorithmic or generative AI features and check filing, labelling and content control duties before launch.

Common mistakes include treating the China programme as a translation of the GDPR programme, relying on blanket consent, assuming that data held on a global cloud is outside Chinese law, and overlooking the data of employees and business contacts, which are counted toward thresholds like any other personal information.

How we approach data and AI mandates

Most data and AI work starts with a map: which entities hold which data, about whom, in which systems, flowing where. From that map follow the classification of personal, sensitive and important data, the choice of transfer mechanisms, and the list of filings, officers and assessments that apply. We then turn the analysis into policies, contracts and processes that operational teams can follow, with a calendar of recurring obligations.

For transactions, the focus is narrower and faster: identifying data risks that affect valuation or timetable, such as unlawful data collection, missing filings, important data held by the target, or a need for cybersecurity review. For AI products, it is product-led: reviewing the model, training data, user interface and content controls against filing and labelling requirements before launch. Our artificial intelligence in China hub collects related material across practices.

How TRW & Co helps

TRW & Co's Shenzhen office helps foreign companies operating in China and Chinese companies expanding abroad manage data and AI in China as one cross-border programme. We map data flows, design group transfer structures and intra-group agreements, advise on the GDPR, the EU AI Act and other non-PRC regimes, prepare internal policies and AI governance frameworks, and run data workstreams in transactions and incident responses. Where PRC legal advice, regulatory filings or representation before Chinese authorities are needed, we work with licensed PRC law firms and coordinate the combined team so that the client receives one consistent answer. Contact us to discuss your data or AI project.