EU vs China — AI and data law, an overview

English · 中文

graded per item in the body·checked 2026-10-16

How to read: start with section 1 for the picture and the one-line conclusion, then go as deep as you need. Items marked ⚠ could not be verified against the primary text — treat the official wording as authoritative.

Evidence grades, used in every comparison file. A = the primary official text — statute, regulation, mandatory standard — checked live against the link in the file's source. B = another official source (regulator guidance, an official press release, Commission pages), or a direct mechanical reading of the primary text. C = this repository's own comparison or inference, or a claim not yet traced back to the primary text; a C never supports a conclusion on its own, and an unchecked one keeps the ⚠. The writing rules and the same table are in docs/README.md.

0. The difference in one line

The EU passes one big statute (the AI Act), sorts everything by risk, and governs every sector horizontally. China issues one rule per problem area (algorithms, deep synthesis, generative AI …), governs whatever surfaces first, and optimises for what works in practice.

Think of it this way: the EU draws a city master plan and then builds to it; China fixes whichever road is jammed, and the network grows organically.

1. The table

2. The EU's ten main tracks

1. AI Act (2024/1689) — the constitution for AI. Four risk tiers: unacceptable (banned) / high (strict) / limited (transparency only) / minimal (barely regulated). — A
   • Staged application (Article 113, as amended in 2026 by the Digital Omnibus on AI): prohibitions from 2025-02-02; GPAI duties, governance and penalties from 2025-08-02; Article 50 transparency from 2026-08-02; new Article 5(1) prohibitions on non-consensual intimate material and child sexual abuse material, points (ba) and (bb), from 2026-12-02 (Article 5(1a) and (1b) conditions apply from the same date); Annex III high-risk from 2027-12-02; Annex I high-risk from 2028-08-02. — A
2. GDPR (2016/679) — personal data; transfers under Articles 44–49. — A
3. Data Governance Act (2022/868) — safe re-use of public-sector data. — A
4. Data Act (2023/2854) — who may use data generated by connected devices. — A
5. Digital Services Act (2022/2065) — platform duties on illegal content, transparency, algorithmic explanation. — A
6. Digital Markets Act (2022/1925) — gatekeeper platforms and contestability. — A
7. ePrivacy Directive (2002/58/EC) — cookies and electronic communications privacy. Listed for completeness; no card yet. — A
8. AI Liability Directive — 2022 proposal, withdrawn by the Commission in its 2025 Work Programme (adopted 2025-02-11). No AI-specific civil liability instrument is planned; the gap it targeted is now handled by the Product Liability Directive below. — B
9. New Product Liability Directive (2024/2853) — brings software and AI into product liability; in force since 2024-12-08, and it binds products placed on the market from 2026-12-09 (the Member State transposition deadline). — A
10. Cyber Resilience Act (2024/2847) + NIS2 (2022/2555) — security baselines for digital products and critical infrastructure. — A

Three layers stack: an AI Act for AI, a GDPR for data, DSA/DMA for platforms.

3. China's nine main tracks

1. Cybersecurity Law (effective 2017-06-01; amended 2025-10-28, in force 2026-01-01) — network operations, critical information infrastructure. The amendment adds an AI article (new Article 20) and sharply raises penalties, up to RMB 10 million. — A
2. Data Security Law (effective 2021-09-01) — data classification, important data, national security. — A
3. Personal Information Protection Law (effective 2021-11-01) — the domestic GDPR, with cross-border rules in Articles 38–43. — A
4. Algorithmic Recommendation Provisions (effective 2022-03-01) — recommendation algorithms must be filed, switchable off, and not induce addiction. — A
5. Deep Synthesis Provisions (effective 2023-01-10) — face swaps and synthetic speech must be labelled and must not be used to spread disinformation. — A
6. Interim Measures for Generative AI Services (effective 2023-08-15) — public generative AI services need filing, security assessment and content compliance. — A
7. Labelling Measures for AI-Generated Synthetic Content (effective 2025-09-01) — explicit and implicit labels for AI-generated text, images, audio, video and virtual scenes. — A
8. Provisions on Promoting and Regulating Cross-Border Data Flows (effective 2024-03-22) — lowers thresholds, defines exemptions, works alongside the 2022 Security Assessment Measures. — A
   • Also Measures for Ethical Review of Science and Technology (trial) (effective 2023-12-01) ⚠ as an ethics backstop. — C
   • AI Law: repeatedly in the State Council legislative plan; not yet enacted ⚠. — B
9. Anthropomorphic Interaction Services Measures (Order No. 21, effective 2026-07-15) — the first rule aimed at AI companions rather than AI content: no induced emotional dependency or manipulation, no virtual relatives or virtual partners for minors, a usage reminder every two hours of continuous use, interaction data the user can copy or delete, and a bar on training on users' sensitive interaction data without separate consent. — A

Three pillars — Cybersecurity Law, Data Security Law, PIPL — with the AI layer filled in by departmental rules.

4. Eight dimensions

4.1 What is regulated — A

• The EU regulates the AI system by risk tier, with duties on providers and deployers.
• China regulates the service provider: whoever offers algorithmic, synthesis or generative services to the public must file and pass security assessment.

4.2 Generative AI — A

• EU: inside the AI Act's GPAI chapter — model cards, training-data summaries, copyright policy, adversarial testing for systemic risk.
• China: a dedicated interim measure plus the labelling measures — filing, content safety, labelling.

4.3 Cross-border data (where firms get stuck) — A

• EU: check for an adequacy decision first; otherwise SCCs or BCRs.
• China: security assessment, standard contract or certification, with exemptions widened in 2024.

4.4 Penalties — A

• The EU fines hard (GDPR 4%; AI Act up to 7%) and has done so.
• China leans on rectification, warnings, takedowns and suspension; statutory fines are lower, but a takedown hurts a platform more than a fine. (The second half of this sentence is our judgement.) — B

4.5 Platforms — A

• The EU adds duties by size and demands algorithmic explanation.
• China applies platform responsibility plus algorithm filing, aimed at content and order.

4.6 The language of rights — C (our framing, not a legal claim)

• The EU speaks in rights: data-subject rights, fundamental rights.
• China speaks in security, development and order; individual rights sit inside PIPL, but the frame serves national security.

4.7 Who enforces — A

• EU: national data protection authorities plus the AI Office, coordinated through the consistency mechanism.
• China: CAC leads, with industry, public security and market regulators alongside.

4.8 AI-generated intimate content about real people — A

• EU: the AI Act prohibits AI systems that generate or manipulate realistic material of an identifiable natural person's intimate parts, or of an identifiable person engaged in sexually explicit activities, without that person's explicit consent — Article 5(1), first subparagraph, point (ba), added by Regulation (EU) 2026/1744 and applying from 2026-12-02; the companion point (bb) covers child sexual abuse material, and Article 5(1a) narrows both to the intended-purpose and foreseeable-outcome triggers. Separately, the AI Act requires disclosure of AI generation, the GDPR covers biometric and image-related data, and the DSA obliges platforms to act on illegal content. — A
• China: the Deep Synthesis Provisions Article 14 require that where a service offers editing of biometric information such as faces and voices, the user must be prompted to inform the person being edited and obtain that person's separate consent; Article 18 forbids stripping the labels, and Articles 16–17 require them. The Labelling Measures and the Deep Synthesis Provisions also bar using synthesis to spread disinformation or infringe rights. — A
• Where the two differ — the level the rule bites at. The EU instrument prohibits the placing on the market, putting into service or use of the AI system itself; the Chinese consent duty sits on the service and the user (the provider must prompt, the user must obtain consent), with the deep-synthesis provisions setting no fine of their own and punishment routed through other laws. A prohibition on the system and a duty on the service are different techniques — read them as such, not as two versions of one rule. — C (our characterisation, resting on the A readings above)
• Shared blind spot still holds: once content is posted to a platform abroad, neither regime can reach it — the governance gap. — C

5. Why cross-border governance is the hardest part

In one line: law is national, the internet is not.

• One country finds content unlawful; a platform in another can ignore it absent mutual legal assistance or voluntary cooperation. — C
• Data flows: the EU uses adequacy decisions; China uses assessment / contract / certification. The two systems do not recognise each other. — A (first sentence) / C (second)
• AI-generated content: the EU emphasises transparency, China emphasises labelling and content safety — similar direction, non-overlapping jurisdiction. — C

Product-level mechanisms that put authorisation, revocation, identity and audit at the entry point can work around the absence of legislation — but ask where the data sits, whose law governs it, and who gets to see the audit.

6. Three entry points for research

1. Compare labelling regimes — China's September 2025 measures vs the EU's transparency duty: which is finer, which is actually enforceable? — C
2. The cross-border enforcement gap — using AI-generated intimate videos of real people as the case: both regimes reach the conduct on paper, neither reaches the platform abroad. — C
3. Where expert identity lands — comparative work like this converts naturally into assessment reports and standards input. — C

7. Limits and unverified ⚠

• Stage dates for the AI Act reflect Article 113 as amended by Regulation (EU) 2026/1744 (the Digital Omnibus on AI); check the consolidated text before relying on them. — A
• The AI Law's progress needs checking against the latest legislative plan. The Cybersecurity Law amendment is confirmed (adopted 2025-10-28, in force 2026-01-01). — B
• Penalty caps (GDPR 4%, AI Act 7%) are statutory maxima; actual fines are far lower. — A
• The ePrivacy Directive (2002/58/EC) is listed as a track but has no card yet, so it is not compared anywhere in this repository. — A

8. Official sources

• AI Act (consolidated, EUR-Lex): https://eur-lex.europa.eu/eli/reg/2024/1689/oj
• Digital Omnibus on AI, Regulation (EU) 2026/1744 (EUR-Lex): https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng
• EU AI Act policy page: https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
• AI Act implementation timeline (third-party tracker, listed for convenience — not an official source): https://artificialintelligenceact.eu/implementation-timeline/
• New Product Liability Directive (EU) 2024/2853: https://eur-lex.europa.eu/eli/dir/2024/2853/oj
• European Parliament legislative train, AI Liability Directive (records the withdrawal): https://www.europarl.europa.eu/legislative-train/theme-a-europe-fit-for-the-digital-age/file-ai-liability-directive
• Notice issuing the Labelling Measures (CAC et al., 国信办通字〔2025〕2号, dated 2025-03-07, released 2025-03-14) — carries the full text: https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm
• Cross-border data flows provisions (CAC, 2024-03-22): https://www.cac.gov.cn/2024-03/22/c_1712776611775634.htm
• Cybersecurity Law, re-promulgated text (CAC): https://www.cac.gov.cn/2025-12/29/c_1768735112911946.htm
• Data Security Law (NPC): http://www.npc.gov.cn/npc/c2/c30834/202106/t20210610_311888.html
• Personal Information Protection Law (NPC): http://www.npc.gov.cn/npc/c2/c30834/202108/t20210820_313088.html
• Anthropomorphic Interaction Services Measures (CAC et al., Order No. 21), full text: https://www.cac.gov.cn/2026-04/10/c_1777558395078289.htm