China's Generative AI Training Data Rules: Lawful Sources, Corpus Security Checks and Filing

This page is general information, not legal advice. Confirm requirements with counsel for your jurisdiction and use case.

Who the rules reach and when training data becomes a filing issue

The Interim Measures apply to generative AI services offered to the public within mainland China, so a lab's training corpus becomes a regulated object once the model behind a public-facing service is filed [2]. Research and internal development that is not offered to the public sits outside the measures, but most labs build one corpus and reuse it, so the evidence has to exist before launch, not after.

Services with "public opinion attributes or social mobilization capacity" must complete a security assessment and algorithm filing, and providers must explain training data sources, scale, types and annotation rules when authorities ask [2]. In practice, the TC260 documents are the yardstick for that assessment [1]. As of October 2026, the corpus requirements a reviewer will test are drawn from TC260-003 and the two 2025 national standards, not from the measures' short text.

What Article 7 requires of training data

Article 7 sets five duties for pre-training and optimization (fine-tuning) data: use data and foundation models from lawful sources; do not infringe IP that others lawfully hold; obtain consent or another statutory basis where personal information is involved; take effective measures to raise quality, truthfulness, accuracy, objectivity and diversity; and comply with the Cybersecurity Law, Data Security Law and Personal Information Protection Law [2]. Translations differ ("lawful" versus "legitimate" sources), so check wording against the Chinese original before quoting it in a filing [2].

Article 8 adds annotation duties: clear, specific and operable labeling rules, annotator training, and sample verification of annotation accuracy [2]. For a buyer of licensed corpora, Article 8 means supplier label guides and QA reports are filing evidence, not just engineering artifacts. Both articles apply to fine-tuning data as much as to pre-training data, which matters when you add a small licensed set on top of an open base model.

TC260-003 corpus security checks: blacklist, per-source assessment and sampling

TC260-003 turns Article 7 into testable checks, and its corpus section is the part your data team will live with [3]. It is a technical document, not a formal national standard, released by the national cybersecurity standards committee in 2024 to support the measures and the filing assessment [1].

According to the CSET translation, the main corpus controls are [3]:

• Source blacklist. Keep a blacklist of corpus sources and do not train on data from listed sources.
• Per-source safety assessment. Assess each source corpus before collection and again after; the translation renders a threshold under which a source with more than 5% illegal or harmful content should not be collected or used and should be blacklisted. Verify this threshold against the Chinese text before writing it into a policy.
• Source mix. Combine multiple sources per language and corpus type, and mix domestic and foreign sources reasonably.
• Traceability. Open-source corpora need their open-source license; self-collected corpora need collection records; commercial corpora need a legally valid transaction contract or cooperation agreement, and the provider should review the counterparty's proof materials. Where those materials are missing, the corpus should not be used.
• Content filtering. Filter with keyword lists, classifier models and manual spot checks before training.

The assessment section adds sampling targets (manual review of random corpus samples with a minimum pass rate, plus larger keyword- or classifier-driven samples) and test-question banks for generated content [3]. Treat the exact sample sizes and rates as items to confirm in the translation and the 2025 standards rather than numbers to memorize.

IP and personal information checks inside the corpus

Corpus IP management under TC260-003 means a named person responsible for IP, identification of major infringement risks before training, and a complaint channel for rights holders [3]. That maps to the same lawful-access analysis Western counsel run: how a corpus was acquired changes risk, as the guide on lawful access and pirated sources explains.

For personal information, the translation calls for consent or another legal basis before training on corpora containing personal information, separate consent for sensitive personal information, and written authorization where biometric data such as faces is involved [3]. The PIPL legal-basis question does not go away because data was licensed; you need the supplier's record of how consent or another basis was obtained. A pre-training PII scan of the corpus is the technical complement, but it does not substitute for a documented basis.

GB/T 45654 and GB/T 45652: the 2025 national standards

Two national standards now carry the corpus rules forward. GB/T 45652-2025, the security specification for generative AI pre-training and fine-tuning data, was reported as issued on 25 April 2025 with effect from 1 November 2025 (verify on the TC260 list); it sets security requirements for that data and its processing, plus evaluation methods for providers and third-party assessors [4]. Its draft was framed around general data security and data processing security, including threats such as data poisoning [4].

GB/T 45654-2025 is the national-standard successor to TC260-003's basic security requirements, and it is reported to point readers to GB/T 45652 where pre-training and fine-tuning data is the focus [5]. Both are recommended (GB/T) standards, but because reviewers use them as the assessment benchmark, labs treat them as the working baseline. As of October 2026, confirm current versions on the TC260 list before citing clause numbers.

A corpus source register that maps to the filing evidence

The most useful single artifact is a per-source register that a reviewer can trace from model to contract. It should let you answer the authorities' Article 19-style questions on source, scale, type and annotation rules without rebuilding records [2].

Illustrative example: invented to show structure; it does not describe an available dataset.

Keep the register keyed to dataset versions, because filters and removals change the corpus that was actually trained. A provenance audit of an existing corpus is the fastest way to backfill entries for data you already hold.

Where licensed US data meets the DOJ bulk sensitive data rule

US-origin data creates a separate constraint that runs in the opposite direction from Chinese rules. The DOJ final rule at 28 CFR Part 202, effective 8 April 2025, prohibits or restricts transactions that give countries of concern, including China, or covered persons access to bulk US sensitive personal data and government-related data [6]. DOJ framed the risk partly around use of bulk data to build AI capabilities.

The practical result is that a corpus satisfying Chinese consent and traceability tests can still be off-limits for a China-linked training pipeline under US law. Counsel should review data categories, volumes and the parties involved before any licensed US dataset enters a pipeline connected to a China-facing service; this page does not suggest such transfers. De-identification lowers but does not settle the question, because the rule has its own definitions and thresholds [6].

Failure modes reviewers find in training data files

Most problems are evidence gaps rather than bad data. Common ones:

1. Commercial corpus with no proof materials. An invoice or purchase order exists, but no license terms or supplier rights statement, which TC260-003 treats as grounds not to use the corpus [3].
2. Blacklist kept but never applied. The list exists in a wiki, while the ingestion job has no filter step that reads it.
3. Assessment done once. A source was sampled at collection, but later crawls or supplier refreshes were never re-assessed.
4. Fine-tuning data ignored. Teams document pre-training thoroughly and treat a small instruction set as exempt, although Article 7 covers optimization training [2].
5. Translation drift. Policy text quotes one English translation's thresholds without checking the Chinese original or the 2025 standards [2][5].

If you are comparing regimes, the training data disclosure comparison and the EU AI Act Article 53 guide show where one supplier record can serve several filings; the compliance hub and the SourceX laws overview cover the wider map.

What to ask a data supplier when the model will serve China

Ask suppliers for the evidence the register needs, because you cannot reconstruct it later. That means the executed license, a description of source and collection method, the legal basis or consent record for personal information, the de-identification method and how it was checked, annotation guides and QA results, and the record counts delivered. If the data will support fine-tuning rather than pre-training, ask for the same items; scale is smaller, but the duties are the same.

SourceX sources operational datasets from US companies on request and rights-reviews each dataset for ownership and consents before delivery under a license that defines records, uses, term and delivery. Buyers can describe the data they need on the SourceX buyer page. Whether any US dataset can lawfully support a China-facing service is a question for your counsel under both regimes.

Sourcing training data with source records for regulated filings

SourceX prepares diligence materials per dataset covering source, rights, preparation and allowed use, and removes or replaces personal details such as names, emails and account numbers before delivery, with the method recorded and a sample checked. Data is sourced on request, every release is approved by the supplying company, and nothing is contracted until a supplier agrees. Describe the training data you need.