China: Data Governence And AI Regulatory In 2023

Overview

Over the past year, China has achieved remarkable progress in the realm of science and technology, with artificial intelligence (AI) standing out as a particularly vibrant field of advancement. The evolution of AI transcends mere technological innovation, relying heavily on extensive data processing and significant computational power. This paper presents a comprehensive overview and insights into the legal sector regarding AI, Machine Learning & Big Data in China in 2023. It delves into the strategies enterprises can employ to navigate the complex landscape of legal regulations that struggle to keep pace with rapid technological advancements and the evolving business models of the future.

Furthermore, this study investigates the potential reconfiguration of the existing data compliance framework prompted by AI advancements, alongside the profound implications for the intellectual property protection regime. Additionally, the paper offers a prognostic discussion on the anticipated trajectory of China's data resource market, the holistic transformation of the digital economy, and emerging opportunities for innovation.

1. Legislation

1. China's AI legislation in 2023

Every major technological innovation in human history has necessitated corresponding shifts in the legal landscape. In 2023 China witnessed substantial advancements in the field of AI, and the topic of "AI compliance" has rapidly risen to the forefront. To effectively oversee the R&D and deployment of AI technology, and to properly harmonize the interplay between AI technology development and data security, China has formulated and released the Interim Measures for the Management of Generative Artificial Intelligence Services. This legislation, a pioneering statutory law tailored to generative AI, introduces adaptable regulatory requirements concerning the source of training data, quality requirements, the specification of generated content, etc., reflecting the government's supportive stance towards the burgeoning generative AI sector, offering both policy direction and legal safeguards to foster industrial innovation, while establishing a scientific, equitable, and balanced regulatory framework.

In addition, regulatory bodies endeavor to supplement it with more practically instructive standards and guidelines. Notable examples include the Practical Guide to Cybersecurity Standards -- Method for Labeling Content in Generative Artificial Intelligence Services and Basic Security Requirements for Generative Artificial Intelligence Service(draft for comment). These documents, alongside the Together with the Administrative Provisions on Recommendation Algorithms in Internet-based Information Services(2021) and the Administrative Provisions on Deep Synthesis in Internet-based Information Services(2022), form the foundational legal framework for AI governance in China at this stage.

When it comes to ensuring compliance in crucial aspects concerning AI products, including account management, personal information protection, and real-name authentication, the provisions outlined in the Interim Measures for the Management of Generative Artificial Intelligence Services primarily echo existing special provisions found in regulations such as the Provisions on the Ecological Governance of Network Information Content and the Personal Information Protection Law. This alignment reflects a concerted effort to maintain consistency and coherence across regulatory frameworks, thereby providing clarity and guidance for AI businesses operating in these domains.

Notably, the introduction of the Measures for Ethical Review of Science and Technology (for Trial Implementation) represents a significant advancement in the regulation of AI. Healthcare, and allied sectors, introducing a novel dimension that prioritizes ethical considerations. This regulation underscores the importance of ethical scrutiny in domains such as life sciences, medicine, and AI by mandating the establishment of science and technology ethics review committees within relevant units. These committees play a pivotal role in conducting thorough and exhaustive ethical evaluations of scientific and technological projects. Operating within a structured framework, they oversee the entire lifecycle of projects, from initial application through assessment, subsequent re-examinations, and even emergency procedures. This meticulous process ensures that scientific endeavors consistently adhere to societal ethical norms and legal requirements at every stage of development and implementation.

By integrating ethical review mechanisms into the regulatory framework, the Measures for Ethical Review of Science and Technology not only promote ethical behaviour, but also instil an awareness of accountability and responsibility within the scientific community. By upholding the highest ethical standards, these measures serve to bolster public trust, safeguard individual rights, and ensure that technological advancements are aligned with broader societal values and aspirations. In essence, this regulation represents a proactive step towards fostering ethically sound practices in scientific research and technological innovation, thereby contributing to the responsible and sustainable development of AI and related fields.

We'll elaborate the regulatory issues that Genarative AI services and products need to face in order to go to market below.

2. Data legislation in 2023

The year 2023 has seen vigorous legislative efforts in China in the domain of digital economy compliance, with significant progress in the regulation of cross-border data flows, as well as the circulation and utilization of data resources.

Focus 1: Advancement and Upgrading of Cross-Border Data Regulatory Mechanisms

In 2023, China successively enacted the Measures for the Security assessment of Outbound Data Transfers, Measures for the Standard Contract for Outbound Cross-Border Transfer of Personal Information and Rules for the Implementation of Personal Information Protection Certification, marking China's construction of a complete "three-pillar governance system" for data cross-border transmission, i.e., data outbound security assessment, personal information protection certification, and standard contract filing system.

Looking back at the first half of 2023, data export compliance emerged as a pivotal concern across various sectors. Businesses have been diligently undertaking data mapping and addressing compliance gaps, investing substantial efforts in drafting comprehensive data export security assessments and personal information protection impact analyses. This meticulous process, often extending from several months to a full year, has enabled businesses to gain deeper insights into the legality, legitimacy, and necessity of their data flows, thereby significantly enhancing their data compliance management capabilities. Nonetheless, for many small and medium-sized enterprises (SMEs) and multinational corporations (MNCs) less acquainted with China's regulatory landscape, these requirements have imposed considerable pressure on them, resulting in increased operational burdens and extended average review durations.

The turning point came on 28 September 2023, when the Cyberspace Administration of China (CAC) published the Provisions on Regulating and Facilitating Cross-border Data Flow (Draft for Comment). This document indicated that China's current cross-border data regulatory mechanism may be about to undergo a major change. By revising the scope of compliance mechanism for data export and introducing various exemption scenarios, the Provisions on Regulating and Facilitating Cross-border Data Flow (Draft for Comment) notably decrease the burden on enterprises.

Up to date, the Provisions on Regulating and Facilitating Cross-border Data Flow have not yet been formally introduced. However, pioneering efforts in regions and free trade zones such as Guangdong-Hong Kong-Macao Greater Bay Area, Beijing Daxing, and Shanghai Lingang and other regions/free trade zones have already been initiated, toward a new compliance strategy for outbound data flows, in alignment with the draft provisions. The current period is considered a "transition phase" under the pending outbound rules. Enterprises that fall within the exemption scenarios are awaiting the concrete implementation or the "final landing" of the regulatory measures.

Focus II: Exploration of the Institutionalization of data circulation and utilization

The circulation of data has been a key issue of concern for several years. Widespread consensuses exist among stakeholders that data as a strategic asset, holds critical importance in terms of protection and economic development. Despite numerous initiatives, including policies, programs, and guidelines aimed at enhancing data flow, progress has been hindered in the past years. On one hand, legislation is not keeping pace with the administrative calls, resulting in an absence of a legal framework, coupled with the shortage of specialized talent; on the other hand, complex challenges like security concerns, ownership issues, privacy protection, and inconsistent standards have impeded significant advancements in the domain of data circulation. The current status quo shows that data utilization largely remains insular data utilization, while inter-organizational open sharing and "third-party use" models have yet to gain traction. This, in turn, limits the vibrancy and scale of the data trading market.

The year 2023 marks a pivotal juncture in the journey towards more robust data resource circulation and utilization. Firstly, towards the end of 2022, the Central Committee of the Communist Party of China and the State Council released the Opinions on Building the Fundamental Systems for Data to Better Utilize the Role of Data as a Factor, outlining an elaborate blueprint for the development of China's data infrastructure, covering critical areas such as data rights, data flow and transactions, profit sharing, and security management. It also innovatively proposed a "three-pronged approach" to data rights:

• At the data collection stage, enterprises establish possession rights over data resources through lawful data collection.
• During the data aggregation and processing stages, data holders extend their usufructuary rights over legally obtained non-personal data to further develop usage rights, transforming raw data resources into standardized datasets, and laying the groundwork for basic pricing and subsequent transactions.
• Based on these foundations, enterprises develop diversified data products, thereby enjoying the right to operate the data or data-derived products formed through their processing, analysis, etc.

To advance the monetization of data resources, the Interim Provisions on the Relevant Accounting Treatment for Data Resources of Enterprises were enacted in August 2023. This legislation represents a significant stride towards the formal recognition of data as an impartant asset within China's economic framework.

Following this, on 25 October 2023, the National Data Bureau was officially established, marking a watershed moment for China's data governance. Entrusted with pivotal roles such as fostering the construction of foundational data systems, enhancing the integration, sharing, development, and utilization of data resources, and spearheading the ambitious projects of Digital China, the Bureau has been instrumental in providing stringent oversight and coordination. In recent days, provincial data bureaus have already been established in places like Shanghai, Jiangsu, and Sichuan.

A mere two months after its inception, the National Data Bureau, in conjunction with CAC, the Ministry of Science and Technology, the Ministry of Industry and Information Technology, and 14 other departments, unveiled the "Data Factor ×" Three-Year Action Plan (2024-2026). This initiative signifies a strategic commitment to harness the transformative power of data across various sectors, including industrial manufacturing, modern agriculture, commercial circulation, transportation services, financial services, scientific innovation, cultural tourism, healthcare, emergency management, meteorological services, urban governance, and green and low-carbon initiatives. By the end of 2026, it aims to create more than 300 typical application scenarios with demonstrative significance and broad promotional effects, along with an ambitious goal for the data industry to sustain an annual growth rate exceeding 20%.

We have good reason to think that a series of landmark actions in the field of data circulation system construction initiatives in 2023 will significantly advance China's regulatory capabilities and improve its data flow system. China will further explore and make available the potential of data with the introduction of the "Data Factor ×" Three-Year Action Plan, which will effectively encourage the creation and advancement of digital China.

3. Legislative trends

In 2024, the landscape of domestic AI and data compliance in China is poised to undergo significant transformations, heralded by four key regulatory trends that promise to redefine the contours of this rapidly evolving sector:

• The legislative process of China's AI Law is expected to see a critical breakthrough.

The legislation race in the AI field is as intense as the arithmetic and modeling race. Although China introduced Interim Measures for the Management of Generative Artificial Intelligence Services in 2023, a comparison between its official draft and the version for public comments reveals a cautious legislative approach, hinting at a strategic retreat. This nuanced stance was made to protect the development of the Generative AI industry, yet it simultaneously mirrors the legislative lawmakers' hesitation and deliberation over the optimal trajectory for regulatory action.

As a key force in global AI development, China urgently needs a comprehensive and systematic AI Law to regulate industry growth, safeguard lawful rights, guide technological innovation, and actively participate in the formulation of international AI governance rules. Considering that the Draft AI Law has been written in the State Council's 2023 legislative agenda, we have good reason to believe that we can see further legislative developments in 2024.

• The official launch of the new cross-border data transfer rule.

The impending enaction of new cross-border data transfer regulations represents a strategic maneuver within China's broader agenda to cultivate the digital economy and enhance international digital cooperation. These forthcoming regulations are essential not only for harmonizing with global digital economic practices but also for aligning with international accords such as the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP), and the Digital Economy Partnership Agreement (DEPA). Therefore, we expect that the new rule will build on the experience of the pilot regions and will be issued at an opportune time in 2024.

• Implementation of Personal Information Compliance Audit Mechanism.

The anticipated formal promulgation of the Personal Information Protection Compliance Audit Management Measures in 2024, following the conclusion of the public consultation period in September 2023, marks a significant step towards enhancing personal information security. The implementation of the personal information compliance audit will adopt an ex post facto governance approach. In essence, the annual audit will be mandatory for businesses, while granting personal information processors sufficient discretion to schedule audits within legal timeframes. These compulsory audits serve as a regulatory tool to prevent superficial oversight of personal information management. Given that audits may inevitably impose operational costs and pressures on businesses, it is conceivable that official regulations might be moderately relaxed in terms of requirements and standards.

• Regulation on Data Utilization.

With the establishment of National Data Bureau and the rapid development of generative artificial intelligence, the integration and utilisation of data resources has been seen as a very important task. In the coming years, it is highly likely that there will be policies to encourage data utilisation as well as new laws and regulations. The goal is to protect the rights and interests of various market players while making full use of data resources to promote innovation and digital transformation in the industries concerned.

2. Administrative Enforcement in the AI Sector

1. Observation of Law Enforcement in 2023

In 2023, the enforcement landscape in the AI sector was dominated by two primary regulatory mechanisms: algorithm record-filing and the scrutiny of large language models (LLMs).

Algorithm record-filing, mandated by the Administrative Provisions on Recommendation Algorithms in Internet-based Information Services, is compulsory for all Chinese enterprises providing Internet services utilizing algorithmic recommendation technology. This obligation encompasses five algorithm categories: generation and synthesis technology, personalized pushing technology, ranking and selection technology, retrieval and filtering technology, and dispatching and decision-making technology. Enterprises are obligated to provide transparent disclosures regarding their algorithm, including algorithm process, data, models, intervention strategies, etc. Additionally, they must include information about their service, risk assessment, and risk prevention and control measures. The overall process takes about 2-3 months. Currently, the compliance of algorithm record-filing relies mainly on pre-launch checks conducted by app stores. Penalties have not been imposed by the relevant authority for those who fail to submit the algorithm filing. However, leading enterprises may receive individual attention from regulatory authorities and reminders to fulfill their legal obligations.

The review of LLMs is said to be in accordance with the "security assessment" stipulated in the preceding paragraph of Article 17 of the Interim Measures for the Management of Generative Artificial Intelligence Services. The review of LLMs involves a stringent process, including submitting filing forms and assessment reports and undergoing technical testing. Regulatory authorities evaluate based on Basic Security Requirements for Generative Artificial Intelligence Services (draft for comment). For cases where third-party registered LLMs are used, the evaluation focus is on the detailed report; for independently developed LLMs, besides the report, they must also pass through a rigorous testing process. Regulatory authorities will pay attention to and review the quality and compliance of training data.

Algorithm record-filing and LLMs review have emerged as prominent legal topics in 2023. The former integrates algorithm record-filing into the standard compliance checklist for all businesses across the AI industrial chain, covering five types of algorithms seamlessly. The latter employs refined and in-depth assessment and management measures for LLMs. Despite an initial exploratory and adjustment phase in regulatory intensity and duty allocation of regulatory bodies, rapid industry development necessitates strong adaptive capacities from all business entities in response to the regulatory framework's volatility and uncertainty. This reflects the regulatory issues faced by the generative AI industry in China and the bottlenecks that need to be broken through.

2. Outlook on Law Enforcement in 2024

In 2024, the status of algorithm record-filing and LLMs review as legal focal points will be further strengthened and progressively refined and improved in practice. Regulatory bodies are expected to introduce more detailed and transparent operational guidelines and review mechanisms for the full lifecycle management of both administrative procedures.

With the implementation of the Measures for Ethical Review of Science and Technology (for Trial Implementation) on December 1st, 2023, ethical considerations in the design, development, and use of artificial intelligence models will become a new mandatory part of the process. This means that on top of the present technical and safety reviews, enterprises must also subject their models to review by independent science and technology ethics committees to ensure adherence to societal ethical principles throughout the research and application process. As a result, the ethical review will become another compliance obligation for AI businesses in 2024.

3. Justice

1. Intellectual Property Dispute in AI Sector in 2024

In the year 2023, the global proliferation of artificial intelligence technology triggered a wave of groundbreaking intellectual property protection disputes. A similar scenario unfolded in China, involving a highly noteworthy case of intellectual property infringement related to Genarative AI. This particular legal battle centered around the creation of images by users utilizing AI technology. At the heart of the debate was the crucial question of whether these AI-generated images should be eligible for copyright protection and, if so, who should rightfully lay claim to those rights.

The plaintiff in this case employed a multitude of prompts to refine the AI-generated images, and the process of adjustment and correction showcased his unique aesthetic preferences and individual judgment. Consequently, he demonstrated a substantial level of input into the final product. In light of these specific circumstances, the court leaned towards the view that the disputed image produced by AI software could indeed be considered intellectual achievements under copyright law, potentially falling within the realm of "artistic works". This interpretation suggested that AI-generated image works might be entitled to legal protection, provided they meet the criteria of originality and creativity, even if they were not traditionally crafted directly by a human author.

The presiding judge in the case also articulated her thoughts on the case from the industry's point of view, i.e. she hoped that the judgement would encourage more people to use Genarative AI's products and stimulate the industry's growth by protecting their copyright.

However, the case is still much in dispute at the level of legal logic. One of the main controversies is how much do humans actually contribute to the creation of a work in the use of Genarative AI scenarios? Is this contribution sufficient to recognise humans as authors under copyright law? is Genarative AI analogous to tools such as cameras, or does the existence of an algorithmic "black box" make the "expression" protected by copyright law only computer-generated? Whether, from the perspective of the development of the industry, such judgements would make it too easy to obtain protection for all kinds of works, thus reducing the space for human creativity?

Moreover, the lawful and ethical use of AI training datasets has become increasingly urgent. The requirement for vast amounts of high-quality data for training large-scale models poses a significant challenge, as ensuring that each piece of data used for training is legally authorized could impose a substantial cost burden on AI enterprises, potentially jeopardizing their viability. This dilemma was highlighted in the New York Times v. Microsoft & Open AI case, igniting intense debates among industry and legal experts. The ability of judicial practice to delineate clear boundaries between promoting technological innovation and maintaining regulatory order has emerged as a pressing topic of discussion, prompting global legislators and judicial practitioners to continuously reevaluate existing intellectual property laws and actively seek new protective mechanisms tailored to the evolving landscape of AI technology.

All in all, the convergence of AI and law presents complex challenges, including defining the intellectual property rights of AI-generated content, determining rightful ownership, and allocating liability for infringement. These fundamental issues lack uniform and clear resolution within current legal frameworks, leaving room for societal perceptions and technological advancements to significantly influence future interpretations. As we delve deeper into the complexities of AI-generated content and its implications for intellectual property law, it becomes evident that a comprehensive and nuanced approach is required to navigate the intricacies of this emerging field. The intersection of AI and law presents not only challenges but also opportunities for innovation and adaptation within legal frameworks.

2. Outlook of Judicial Development in AI Sector in 2024

Looking ahead to 2024, we anticipate a surge in litigation related to generative AI, encompassing copyright disputes and unfair competition suits. Given the relative lag in legislation, market participants are expected to increasingly turn to litigation as a means of addressing grievances and shaping legal precedent in this rapidly evolving domain. This surge in litigation is poised to play a pivotal role in clarifying the intellectual property landscape surrounding artificial intelligence. These legal battles not only serve as platforms to address specific grievances but also function as catalysts for the formulation of robust legal frameworks governing AI-generated content.

Furthermore, this surge in litigation is likely to exert pressure on legislative bodies to expedite the development and adaptation of laws that are attuned to the rapid advancements in AI technology. The dynamic nature of the field necessitates a proactive legal framework that can keep pace with the intricacies of generative AI, and the outcomes of these legal battles are poised to influence and, in turn, shape the trajectory of legislative progress.

In essence, the expected increase in legal activity surrounding generative AI in 2024 is not just a response to individual disputes; it is a broader movement that holds the potential to define the rules and regulations governing AI-driven creations, thereby contributing to the evolution of a more comprehensive legal landscape.

Conclusion

In short, 2023 marks the "first year" of generative AI legal regulation and governance in China. Not only has China made substantial progress in strengthening administrative oversight and resolving related litigation, but it has also taken the lead in introducing administrative regulatory measures and incorporating ethical concerns. These legal actions all highlight China's proactive stance in effectively managing AI technologies, striking a delicate balance between promoting innovation and upholding accountability.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.