Apply the functional boundary first
Five departments issued Order No. 21 on 10 April 2026; the measures took effect on 15 July 2026. Article 2 addresses services offered to the public in China that simulate natural-person personality, thinking and communication in sustained emotional interaction. Emotional care, companionship and support can use text, images, audio or video. A friendly interface alone does not establish that the service is covered.
The final text expressly excludes customer service, knowledge Q&A, work assistance, education and research when they do not involve sustained emotional interaction. For mixed products, record what each function actually does and reassess when memory, personas or relationship-oriented features change. This is a practical scoping method, not a statutory safe harbour for anything labelled an assistant. Healthcare and financial functions also need the relevant sector requirements under Article 31.
| Illustrative function | Scope question | Evidence to examine |
|---|---|---|
| Task-focused helpdesk | Does it remain issue resolution without sustained emotional interaction? | Function specification, persona instructions and representative conversations; other AI/privacy duties still need review. |
| Persistent emotional companion | Does it simulate a natural-person personality and sustain emotional care or support? | Relationship features, memory design, user journey and actual interaction behaviour, not marketing labels alone. |
| Learning app with a companion mode | Does the added mode change an otherwise task-focused service? | Mode boundaries, access by age, interaction persistence and assessment of the new function before release. |
A consent screen cannot authorize a prohibited role
Article 14 prohibits virtual relatives, partners and other virtual intimate-relationship services for minors. The separate rule requiring guardian consent for other covered services supplied to children under 14 is not an exception to that prohibition. Article 17 separately governs under-14 personal-information processing. Treat service permission and data-processing permission as two decisions.
Age recognition must protect privacy and personal information. Minors-mode settings, an appeal route and age-appropriate guardian controls are substantive product work, not merely a checkbox. Older users have a separate set of healthy-use, risk-warning and assistance protections; do not import a minors-only prohibition into that group or ignore the wider anti-manipulation rules.
| Group and service | Controlling distinction | Practical check |
|---|---|---|
| Any minor; virtual intimate role | Prohibited by Article 14, including virtual relatives and partners. | Block prohibited role access; parental consent must not unlock it. |
| Under 14; other covered services | Guardian consent for the service and separate attention to personal-information processing. | Check lawful service design, consent evidence, minors mode and data purposes. |
| Ages 14-17; other covered services | Minor protections still apply; the specific under-14 threshold does not erase them. | Age-appropriate controls, risk alerts, spending controls and an appeal path. |
| Older users | Article 15 requires guidance, prominent risk warnings and timely responses to requests for help. | Readable warnings, accessible help and an effective escalation route. |
Separate operating the service from training a model
Article 16 requires security safeguards and user options to copy or delete interaction data. It also restricts third-party provision unless law provides otherwise or the rights holder clearly agrees. A workflow should identify chat history, stored persona memory, exports and downstream recipients rather than treating the visible chat window as the entire dataset.
The special training clause concerns interaction data that is sensitive personal information and allows an exception under laws/administrative regulations or the user's separate consent. It does not create unrestricted reuse rights over other identifiable conversations. Keep the ordinary lawful-basis and purpose analysis, distinguish supplier access from model training, and ensure a service-consent record is not silently reused as a training-consent record.
| Operation | Question to resolve | Suggested evidence |
|---|---|---|
| Store interactions | What is retained, where, for which service purpose and with whose access? | Data inventory, permissions, encryption and retention controls. |
| Copy or delete | Can the user exercise both options without exposing another person's records? | Request tests, identity checks, system coverage and clear handling of lawful retention exceptions. |
| Provide to a third party | Which recipient, purpose and lawful exception or clear consent applies? | Recipient and purpose records; distinguish disclosure from other supplier arrangements under applicable law. |
| Use in training | Does it include sensitive interaction data, and is the required basis present? | Dataset classification, lawful-source checks, separate-consent evidence where required and access restrictions. |
Do not wait for a million users to assess a launch
Article 22 lists independent assessment circumstances. Launching a covered service or adding a related function is one; major technology/application changes are another. At least 1,000,000 registered users or 100,000 monthly active users is a separate trigger. The word or matters: the measures do not require both counts and do not provide a low-user exemption from launch review.
The provider assesses and submits the report to its local provincial CAC; assessment also follows a provincial-or-higher CAC notice when required. Article 23 sets review topics, while Article 26 addresses algorithm filing, changes/cancellation and annual verification of filing materials. These records serve different functions. A filing entry is not proof that an assessment, a minors-data audit or every applicable product requirement has been satisfied.
| Trigger or process | What to establish | Practical preparation |
|---|---|---|
| Launch / added function | Whether the function is a covered anthropomorphic interaction service. | Scope memo, function specification and assessment/report workstream; not a user-count-only check. |
| Significant technology change | Whether new technology or applications materially change the covered service. | Change record, safety tests, affected data flows and reassessment decision. |
| User-count trigger | Registered users at least 1,000,000 OR monthly active users at least 100,000. | Document measurement and check both metrics independently; no invented cross-border counting rule. |
| Risk / authority direction | Listed risk circumstances, other prescribed situations or an applicable assessment notice. | Risk evidence, notice, accountable owner and submission record; use the actual authority's requirements. |
Make reminders, intervention and exit separate controls
Articles 13 and 18 answer different questions. Extreme emotions call for timely supportive and help-seeking content; specified severe circumstances require necessary intervention and timely contact with a guardian or emergency contact. Dependency indications trigger prominent dynamic AI reminders. These are not substitutes for each other, and the information used to identify risk must remain protected.
The final duration rule requires a reminder each time continuous use exceeds two hours, using dialogue or a pop-up. It does not itself order automatic shutdown of every session at two hours. Article 19 separately requires convenient exit, including timely response to window, voice or keyword requests, and prohibits continued interaction that obstructs exit. Article 20 requires advance cessation notice or a timely announcement if advance notice is impossible.
An original test plan can separately exercise risk alerts, repeated duration prompts, an ordinary exit, an emergency escalation and a service shutdown. Use synthetic test accounts and controlled scenarios rather than genuine sensitive user conversations. The measures do not supply a complete emergency playbook; provider controls must be designed for the actual service and risk.
Build evidence across the service lifecycle
Article 23 expressly covers safeguards, training-data processing, extreme-situation identification and intervention, user scale/duration/age, protection of minors and older users, complaints, and correction of major risks. A useful preparation sequence is to map each topic to a responsible owner, an implemented control, a test and a retained result. That sequence is an editorial working method, not an official report template.
Keep a release/change record, training-data inventory, role/age access tests, copy/deletion tests, reminder and exit tests, incident/escalation records and complaint outcomes. Article 10's lifecycle duty already appeared in draft Article 9; it was not introduced for the first time in the final rule. Article 25 separately requires app-distribution platforms to check relevant assessment/filing circumstances. Give distribution partners accurate evidence rather than a generic compliance assertion.
Review cadence must distinguish provider compliance audits, annual administrative verification of filing materials and annual provincial written review of assessment reports. The final minors-data audit clause does not repeat the draft's annual frequency, but still requires audits under relevant national provisions. Removing one word from a draft is not removal of the underlying audit obligation.
Read changes without treating omissions as permissions
The December 2025 consultation closed on 25 January 2026; its proposed rules are historical, not an alternative current compliance route. The final text adds an express task-service exclusion and changes minors' intimate-role restrictions, copying rights and the special training clause. It also modifies the wording of crisis intervention, older-user protection and reminder timing. The linked comparison locates each change in both texts.
The final does not repeat the draft's express human-takeover instruction or the older-relative simulation ban. Those omissions must not be paraphrased as permission for unattended crisis handling, deception or emotional manipulation. Conversely, launch assessment, the user-count triggers, convenient exit and lifecycle safeguards were already present in the draft. Calling everything new exaggerates the change and obscures which controls actually need revision.
Keep penalty amounts tied to their legal conditions
Article 30 first points to treatment and penalties under applicable laws and administrative regulations. Its fallback applies where those instruments do not provide a rule: warning, public criticism and correction, potentially with registration or other service restrictions. Refusal to rectify or serious circumstances can result in cessation and a possible RMB 10,000-100,000 fine; where life/health safety is endangered and harmful consequences occur, the provision specifies an additional RMB 100,000-200,000 fine.
These are not an all-purpose cap on AI, cybersecurity or privacy exposure. A research note should identify the breached duty, responsible actor, relevant authority and applicable instrument before naming a sanction. Product teams should prioritize preventing prohibited conduct and correcting risks rather than using one fine range as the price of non-compliance.
Three hypothetical product reviews
A helpdesk adds a persistent companion mode. The original ticket-resolution function may fall within the express task-service exclusion on its facts, but the new emotional mode needs a fresh Article 2 analysis. If covered, assess launch/additional-function requirements even below the user-count thresholds. Review age access, data reuse and whether other AI/sector rules apply; changing the mode name does not resolve those questions.
A family buys a companion product for a 12-year-old. First inspect the actual relationship role. Guardian consent cannot enable a prohibited virtual intimate relationship; if the service is another permitted covered design, under-14 service consent, data-processing requirements, minors mode and protective controls still need separate evidence. A purchase receipt is not that evidence.
An adult companion provider wants to reuse past conversations for training. Inventory the records and identify sensitive personal information; separate training from current service delivery and supplier access. Check the relevant exception or separate consent, broader privacy requirements, data-copy/deletion paths and training-data safeguards. An opt-in for marketing or a generic acceptance of service terms is not automatically sufficient. These examples illustrate a review process, not a finding that a real product is compliant.
Official sources & revisions
- Final measures, Articles 2, 8-10 and 31-32
- Final measures, Articles 12-15 and 18-21
- Final measures, Articles 11 and 16-17
- Final measures, Articles 22-30
- December 2025 consultation draft, Articles 2, 9 and 11-32; historical text
- CAC questions and answers, 10 April 2026, questions 2 and 7-9
: Replaced a short source record with paired scope, age, data and assessment matrices, operational safeguards, conditional sanctions and hypothetical reviews. Verified the complete draft and final texts and corrected retained-versus-new distinctions.
Examples and working tables are original research aids, not official forms or legal advice.
Suggest a correction