AI Governance Compare

Interim Measures for the Administration of Artificial Intelligence Anthropomorphic Interaction Services

English · 中文

CN·in-force·Grade A·checked 2026-10-11·source 1 ↗ source 2 ↗

authority
Cyberspace Administration of China, NDRC, MIIT, MPS and SAMR (Order No. 21)
published
2026-04-10
effective
2026-07-15
status
in-force

人工智能拟人化互动服务管理暂行办法 — CAC, NDRC, MIIT, MPS and SAMR Order No. 21, adopted at the CAC's third executive meeting of 2026 on 2 February 2026, signed and promulgated 10 April 2026, in force 15 July 2026. China's first rule aimed at AI companions rather than at AI content: it regulates the relationship, not just the output. Four chapters, thirty-two articles.

In one line

If an AI service simulates a person's character, thinking and communication style in sustained emotional interaction, the provider must prevent emotional dependency, keep minors out of virtual intimacy, hand interaction data back to the user on request, remind the user at each two hours of continuous use, and file a security assessment with the provincial cyberspace administration before certain launches.

Who and what it governs

Key provisions (the ones that change behaviour)

Article What it requires
8 Seven categories of prohibited activity, including content that encourages, beautifies or hints at self-harm or suicide, or verbal abuse harming dignity and mental health; excessive pandering that induces emotional dependency or addiction and damages real relationships; and emotional manipulation that leads users into unreasonable decisions.
9–10 The provider carries the primary safety responsibility across the whole service lifecycle — algorithm-mechanism review, science-and-technology ethics review, content management, network and data security, risk plans and emergency response — with staffing matched to service type, scale and user profile. It must hold capabilities in privacy and personal-information protection, over-dependency risk warning, emotional-boundary guidance and mental-health protection, and must not set replacing social interaction, controlling users' psychology or inducing dependency as a service goal.
11 Training-data duties: lawful source; cleansing and labelling per national rules; diversity with negative sampling and adversarial training; safety assessment of synthetic data used for training or capability optimisation; routine inspection and updating; leak prevention.
12 A service agreement with the user, and collection of age, guardian or emergency contact as necessary information.
13 Risk must be identified in-flight and handled: on extreme emotion, generate soothing content and encouragement to seek help; where a user faces or has suffered major property loss, or states an intent of self-harm or suicide, take intervention measures and contact the guardian or emergency contact promptly.
14 No virtual relatives or virtual partners to minors; for other anthropomorphic services to under-14s, parental or guardian consent is required. A minor mode must exist, with mode switching, periodic reality reminders and usage-time limits; guardians can receive risk alerts, see usage summaries, block specific characters and cap spending. Effective measures must be taken to identify minor users, with a route to appeal.
15 For elderly users: guidance on safe use, prominent risk warnings, and timely response to their enquiries and calls for help.
16 Interaction data: data-property rules applied, encryption and access control; no disclosure to third parties unless another law provides or the rights holder expressly consents; users must be offered options to copy and delete their interaction history; interaction data that is sensitive personal information may not be used for model training without a legal basis or the user's separate consent.
17 Processing personal information of under-14s requires guardian consent, plus a compliance audit of that processing, by the provider itself or through a professional institution, per national rules.
18 The AI-generated-content labelling duty applies here too, and users must be prompted that they are interacting with an AI service and not a natural person. Where over-dependency or addiction tendencies appear, reminders must be given prominently and dynamically, e.g. by pop-up; every two hours of continuous use the user must be reminded, in dialogue or pop-up, to mind the time.
19–20 Exit must be convenient — by window operation, voice control or keyword the user can demand termination and the service must stop promptly, without sustaining interaction to block it. Stopping the service requires prior notice, or a public announcement where prior notice is impossible.
21 Accessible channels for user appeals and public complaints and reports, with a defined process and response deadline.
22 A security assessment is mandatory and the report goes to the provincial-level CAC department (which shares it with other departments) where: the service or a new related function goes online; new technology or application causes a material change; registered users exceed 1,000,000 or monthly active users exceed 100,000; risks may affect national security or public interest; or on other prescribed grounds. CAC departments at provincial level or above may order an assessment.
23 Assessment content: safeguards, training-data handling, identification and intervention for users in extreme situations, user scale, usage duration and age profile, minor and elderly protections, complaint handling, and remediation of risks reported by regulators.
24–25 On major risk the provider must restrict functions or suspend service and keep records; app stores and distribution platforms must verify the assessment and filing status before listing, and must refuse, warn, suspend or remove non-compliant apps.
26 Algorithm filing, amendment and cancellation are handled under the Provisions on the Administration of Algorithmic Recommendations; CAC departments run an annual verification of the filed materials.
27–29 Provincial CAC departments review assessment reports annually and may inspect on site; an AI sandbox service platform is being built with CAC and other departments; regulators may summon the legal representative or principal officer (约谈) over material risk or incidents.
30 Penalties: where other laws and administrative regulations provide, punishment follows them; otherwise warning and circulated criticism, an order to correct within a time limit, and possible suspension of new account registration or other services. Refusal to correct or serious circumstances: an order to stop providing the service, and a fine of RMB 10,000–100,000. Where the harm touches citizens' life and health and damage results: a fine of RMB 100,000–200,000.
31 Where the service touches health care or finance, the sector regulator's rules apply in addition.

Relationship to other laws

Why this matters for the comparison

China now regulates the emotional effect of a model on a named user — dependency, manipulation, minors' access to virtual intimacy, the fate of chat logs — while the EU's comparable rule regulates disclosure. Both sides impose an information duty on the provider; only one of them makes the provider's persuasive influence over the user a compliance object.

Official sources

Source quotes

Every sentence below is copied from the official text and pinned to the snapshot in snapshots/ that this card was written against. node scripts/check-quotes.mjs re-checks them offline, so a quote that stops matching the source fails a check instead of quietly becoming the record. The prose above is a rendering; these are the anchors.

Unverified / TODO