China AI compliance, generated from your own systems.
China does not have one horizontal AI Act. It has three operative regulations administered by the Cyberspace Administration of China (CAC), layered on top of the PIPL, Data Security Law and Cybersecurity Law. Compliance is filings, labelling and security assessment — not risk tiers.
Three regulations and one labelling regime. The Interim Measures on Generative AI Services, the Algorithmic Recommendation Provisions, the Deep Synthesis Provisions, and the 2025 mandatory labelling rules together define a filing-and-content control regime.
The Interim Measures for the Management of Generative Artificial Intelligence Services (生成式人工智能服务管理暂行办法, in force 15 August 2023) apply to providers offering generative AI services to the public in mainland China. Providers must ensure lawful training data (no IP infringement, no unlawful personal data), label AI-generated content, conduct algorithmic filings, and — where the service has 'public-opinion-shaping or social-mobilisation potential' — complete a CAC security assessment before going live.
The Internet Information Service Algorithmic Recommendation Management Provisions (in force 1 March 2022) require algorithm filings for services with public-opinion or social-mobilisation potential, user-facing transparency about how algorithms work and what user data feeds them, the ability for users to switch off algorithmic personalisation, and prohibitions on excessive price discrimination and addiction-inducing designs targeting minors.
The Provisions on the Administration of Deep Synthesis of Internet Information Services (in force 10 January 2023) impose security-assessment, identity-verification, content-labelling and notification duties on services that produce or significantly alter biometric or other realistic content using deep-synthesis technology — including synthetic voice, face replacement and full-body synthesis.
The Measures for the Mandatory Labelling of AI-Generated Synthetic Content (in force 1 September 2025) require both human-visible labels and machine-readable metadata on AI-generated content, with downstream-distribution obligations on platforms. Non-compliance attracts CAC enforcement under the existing Cybersecurity Law / PIPL / Data Security Law penalty architecture.
The files this framework actually requires.
China's regime is filing-and-evidence: CAC algorithm filing, security assessment where triggered, content-labelling implementation, and the records to prove each.
GRC tools tell you these are missing. Hael generates them — from each system's real configuration.
A checklist tells you what's missing. Hael puts it on record.
China is a filing, labelling and assessment regime — not a risk-tier regime. Hael generates the evidence the CAC actually opens.
Discover, classify, produce — for China Generative AI / Algo.
Find the systems in China Generative AI / Algo scope, including embedded third-party AI.
Assess each against China Generative AI / Algo's risk tiers and obligations.
Generate the China Generative AI / Algo records, versioned and current.
Every obligation, mapped to the control that satisfies it.
Rows are the framework's clauses.
Columns are the controls and files that satisfy them.
Cells update as the underlying configuration changes.
Clause by clause.
Author once. Satisfy many.
China's regime does not map cleanly onto EU-style risk tiers, but the substantive training-data, labelling and security-assessment evidence reuses the same source as the EU AI Act Annex IV file, the Korea AI Basic Act technical documentation, and a GDPR DPIA. The records differ in format; the underlying facts do not.
Make your China-facing AI surface CAC-fit.
Bring a generative-AI, algorithmic-recommendation or deep-synthesis service that touches Chinese users. We'll register it, identify which of the three regulations applies, and show the filing, security-assessment and labelling artefacts Hael would generate.