China is further tightening regulatory controls in the areas of cybersecurity, data protection, and artificial intelligence. Two new sets of regulations expand the government’s oversight powers and clarify legal liability for AI applications. For European companies with Chinese subsidiaries, this results in additional requirements regarding compliance, documentation, and risk management.
New regulations from the Chinese Ministry of Public Security governing cybersecurity oversight have been in effect since October 1, 2026. They replace the previous regulations from 2018 and expand the authorities’ oversight powers. Network operators, data processors, and digital service providers are particularly affected. Security authorities can verify compliance with the Cybersecurity Law (CSL), Data Security Law (DSL), and Personal Information Protection Law (PIPL). This includes technical security audits, vulnerability analyses, and, under certain conditions, penetration tests. Companies must therefore prepare their data classification, IT security measures, access rights, and compliance documentation for regulatory audits.
At the same time, China’s Supreme People’s Court has published new guidelines for handling legal disputes related to artificial intelligence. The 24 provisions specifically outline the responsibilities of AI developers, providers, and users. The focus is on the lawful use of personal data in AI training, liability for AI-generated content, deepfakes, and algorithmic decisions, as well as requirements for the presentation of evidence. Of particular importance is the question of under what conditions publicly available personal information may be used for training AI models. Both developments show that China is increasingly shifting its AI and data regulation from general legal requirements to specific control, liability, and enforcement mechanisms. For German companies, it is therefore no longer sufficient to demonstrate formal compliance with individual regulations. What is required is an integrated compliance system that combines data protection, data security, cybersecurity, and AI governance. Technical control mechanisms, transparent decision-making processes, and documented responsibilities are becoming increasingly important, particularly in the case of agent-based AI systems that can independently access corporate data and trigger actions.
