China vs. Global AI Frameworks
Six jurisdictions. Eight compliance dimensions. A clear picture of where China’s AI rules diverge from frameworks you already know.
6-Jurisdiction AI Governance Matrix
Filter by domain. Scroll horizontally on mobile. The China column is highlighted throughout.
| Dimension | China | EU | US | India | Japan | Singapore |
|---|---|---|---|---|---|---|
| Risk Classification | Activity-based: targets specific AI applications (algorithms, deepfakes, GenAI), not horizontal tiers | 4-tier system: prohibited, high-risk, limited-risk, minimal under EU AI Act | Voluntary: NIST AI RMF is non-binding, no federal risk tiers | 6 context-specific categories under MeitY Guidelines (Nov 2025), focuses on vulnerable populations | Use-case-based, sector-specific under AI Promotion Act (soft law) | Voluntary, risk-proportionate via Model AI Governance Framework and AI Verify toolkit |
| Pre-Launch Filing | Mandatory CAC filing: algorithm, GenAI service, and registration filing types. Pre-filing consultation (预沟通) standard practice. | Conformity assessment for high-risk AI systems, no pre-launch filing | None at federal level | No mandatory filing (voluntary, pro-innovation stance) | No mandatory filing or registration | No mandatory registration. AI Verify is voluntary self-assessment. |
| Content Controls | Mandatory keyword lists (min 10,000 per TC260 GB/T 45654), content safety testing, “Core Socialist Values” alignment | Transparency labels under Art. 50, no mandatory keyword lists | No federal AI content controls | Mandatory AI content labeling, 2-3 hour takedown timelines (IT Amendment Rules 2026) | Voluntary watermarking recommended (AI Guidelines for Business) | Voluntary content provenance, toxicity assessment emphasis |
| Cross-Border Data Transfer | 3 primary mechanisms under PIPL Art. 38: CAC security assessment, standard contractual clauses, personal information protection certification | GDPR adequacy decisions, Standard Contractual Clauses, Binding Corporate Rules | Sector-specific (HIPAA, GLBA). No unified AI data transfer framework. | DPDPA requires consent and government-approved transfer mechanisms | APPI consent-based framework, relatively permissive | PDPA consent-based, with mutual recognition mechanisms |
| Maximum Penalties | Up to 50M RMB or 5% annual revenue (PIPL/CSL). Up to 10% revenue for GenAI content violations. | Up to 35M EUR or 7% turnover (prohibited AI). 15M/3% (high-risk). 7.5M/1.5% (other). | Sector-specific only (FTC, state laws). No unified federal AI penalty structure. | Up to INR 250 crore under DPDPA for data security safeguard failures | No AI-specific penalties. Enforcement through existing copyright and privacy laws. | No AI-specific penalties. Existing PDPA applies for data protection. |
| Enforcement Style | Campaign-based (Qinglang), multi-agency (CAC, SAMR, MPS), public naming | AI Office + national supervisory authorities, risk-based audit framework | FTC enforcement actions, state AG lawsuits, sector-specific regulators | MeitY advisories + DPDPA Data Protection Board, sector regulators (RBI, SEBI) | Soft guidance, sector-specific. No AI enforcement body. | Voluntary compliance, IMDA sandbox approach, PDPC for data issues |
| Standards Framework | TC260 under SAC: 83 published national standards, 36 published in 2025, 30 under development | CEN/CENELEC harmonized standards aligned to EU AI Act | NIST AI RMF, AI 600-1 (voluntary frameworks) | BIS adoption of ISO/IEC standards, MeitY AI safety guidelines | JISC standards aligned with ISO/IEC 42001 family | AI Verify open-source testing toolkit, aligned with ISO standards |
| Regulatory Approach | Five enacted AI-specific regulations plus three data laws plus TC260 standards | Single horizontal regulation (EU AI Act, August 2024) | Decentralized: executive orders plus voluntary frameworks | Voluntary guidelines plus existing IT Act enforcement | Non-binding “innovation-first” model (AI Promotion Act, soft law) | Voluntary frameworks plus government-led testing tools (AI Verify, GenAI Sandbox) |
Where Each Jurisdiction Sits on the Binding-to-Voluntary Spectrum
China and the EU both have binding AI regulations, but their enforcement structures differ.
Binding
Mixed / Sectoral
Voluntary / Soft Law
EU AI Act Compliant? What China Still Requires.
A company that already meets EU AI Act requirements still faces three categories of additional work for China.
CAC Filing Requirements
No EU EquivalentContent Safety Obligations
No Western EquivalentCross-Border Data Transfer
Distinct from GDPRIf you already have EU AI Act documentation, here is what can be partially reused for China:
- EU Fundamental Rights Impact Assessment partially maps to the PIPIA (Personal Information Protection Impact Assessment), but must be translated and adapted to Chinese legal categories.
- EU technical documentation partially maps to the CAC security self-assessment, but Chinese requirements focus on content safety categories (not risk tiers), and documents must be in simplified Chinese.
- EU risk management system documentation does not directly map to China’s activity-based system. China does not classify AI systems by risk tier; it applies obligations based on what the service does (recommendation, deep synthesis, generative output).
- EU conformity assessments do not substitute for CAC filing. The filing process is a separate administrative procedure with its own review body.
Who Regulated AI First?
China enacted AI-specific regulations before any other jurisdiction in this comparison.
Singapore: Model AI Governance Framework
January 2019 (voluntary)
China: Algorithm Recommendation Provisions
March 2022 (binding, first AI-specific regulation)
China: Deep Synthesis Provisions
January 2023 (binding, deepfake regulation)
China: Interim Measures for GenAI (生成式人工智能服务管理暂行办法)
August 2023 (binding, GenAI cornerstone regulation)
US: Executive Order 14110
October 2023 (executive order, not legislation)
EU: EU AI Act
August 2024 (binding, horizontal regulation)
Japan: AI Promotion Act
2025 (soft law)
India: MeitY AI Guidelines
November 2025 (voluntary guidelines)
Maximum Penalty Comparison by Jurisdiction
Revenue-based penalties expressed as percentage of annual turnover. China’s GenAI content violations carry the highest ceiling.
Revenue percentages shown for comparison. Absolute amounts vary by jurisdiction and company size. China’s CSL 2026 amendment raised the ceiling to 50M RMB or 5% annual turnover.
Content Controls: Three Tiers of Obligation
China’s content safety requirements have no direct equivalent in any Western AI framework.
- Keyword library: min 10,000 entries across 17 safety risk categories, updated weekly
- Test question bank: min 2,000 questions covering all 31 safety risks
- Refusal bank: min 500 questions (test 300, pass 95%+)
- Non-refusal bank: min 500 questions (test 300, refusal rate 5% or less)
- Generated content: 1,000 questions, 90%+ acceptable
- “Core Socialist Values” alignment (legal term)
- Mandatory AI content labeling, watermarking, and metadata tagging
- EU: Transparency labels under Art. 50 (AI-generated content must be marked)
- EU: No keyword filtering or content alignment requirements
- India: Mandatory AI content labeling required
- India: 2-3 hour takedown timelines for flagged content (IT Amendment Rules 2026)
- India: No mandatory keyword libraries or test banks
- US: No federal AI content regulation. Sector-specific only (FTC deception).
- Japan: Voluntary watermarking recommended via AI Guidelines for Business
- Singapore: Voluntary content provenance. Toxicity assessment emphasis via AI Verify.
- All three rely on existing laws (copyright, defamation, consumer protection) rather than AI-specific content rules
How Each Jurisdiction Approaches AI Governance
Click a jurisdiction to see its regulatory structure, key instruments, and enforcement model.
Five enacted AI-specific regulations plus three foundational data laws (PIPL, DSL, CSL). The Cyberspace Administration of China (CAC, 网信办) is the lead AI regulator, managing all three filing registries and coordinating with SAMR, MIIT, and MPS for sector-specific enforcement. TC260 (a standards committee under SAC, not a regulatory body) has published 83 national AI standards. An AI Law (人工智能法) is on the NPC legislative agenda, though no public draft exists as of May 2026.
A single horizontal regulation (the EU AI Act, effective August 2024) classifies AI systems into four risk tiers: prohibited, high-risk, limited-risk, and minimal. The EU AI Office coordinates with national supervisory authorities. Conformity assessments are required for high-risk AI systems, but there is no pre-launch filing registry equivalent to China’s CAC system. Penalties scale by tier: up to 35M EUR or 7% turnover for prohibited AI, 15M/3% for high-risk, and 7.5M/1.5% for other violations.
Decentralized approach: executive orders plus voluntary frameworks. NIST AI RMF is the primary risk framework but is non-binding. No federal pre-launch filing, no unified penalty structure, and no federal AI content controls. Enforcement is sector-specific (FTC for consumer protection, FDA for medical AI, state attorneys general for consumer AI harms). Multiple states have enacted or proposed AI legislation, creating a patchwork of obligations.
Voluntary MeitY AI Guidelines (November 2025) define 6 context-specific risk categories focused on vulnerable populations, paired with mandatory DPDPA enforcement for data protection violations (up to INR 250 crore). No mandatory AI filing system, but mandatory AI content labeling and 2-3 hour takedown timelines under IT Amendment Rules 2026. Sector regulators (RBI for financial services, SEBI for securities) issue their own AI guidance.
An explicitly “innovation-first” model. The AI Promotion Act and AI Guidelines for Business are non-binding soft law. No mandatory AI filing, no AI-specific penalties, and no AI-specific content regulation. Enforcement relies on existing copyright and privacy laws (APPI). JISC standards are aligned with the ISO/IEC 42001 family. Voluntary watermarking is recommended, not required.
Voluntary frameworks paired with government-led testing tools. The Model AI Governance Framework (released January 2019, one of the world’s earliest) and AI Verify open-source testing toolkit provide structure without legal mandates. The GenAI Sandbox offers a controlled testing environment. No AI-specific penalties exist; the PDPA applies for data protection issues. PDPC handles enforcement for personal data violations.
Explore More China AI Governance Topics
Data Triad: PIPL, DSL, CSL
How China’s three data laws apply to AI systems
Explore →CAC Filing System
Which of the three filing types does your AI service need?
Explore →Generative AI Measures
The cornerstone August 2023 GenAI regulation
Explore →Content Rules and Labeling
Mandatory labeling, watermarking, and metadata requirements
Explore →TC260 National Standards
83 published standards and technical safety thresholds
Explore →AI Ethics Review
Mandatory ethics committees and three-tier review system
Explore →Cross-Border Data Transfer
Three primary mechanisms for cross-border AI data transfer
Explore →Sector Regulators
PBoC, CSRC, and SAMR sector-specific AI rules
Explore →Templates and Tools
China vs. EU vs. NIST mapping tool and compliance checklists
Explore →