作者： admin

Mythos is not magic. It’s not a doomsday device. It’s the first of many models that can automate cyber tasks (just like coding). OpenAI’s GPT-5.5-cyber can now do the same. And all the frontier models (including those from China) will be there within approximately 6 months. It’s important to recognize that these models do not create vulnerabilities; they discover them. The bugs are already in the code. Using AI to discover and patch them will actually harden these systems. The leap from pre-AI cyber to post-AI cyber means that there will be a big upgrade cycle. After that, however, the market is likely to reach a new equilibrium between AI-powered cyber-offense and AI-powered cyber-defense. Obviously it’s important that cyber defenders get access before cyber attackers. That process is already underway but needs to happen quickly (see point above about Chinese models). Unlike Mythos, GPT-5.5-cyber appears not to be token constrained so it may be the first cyber model that defenders actually get to use.

1. Article 59 is revised to read:

   “Where a network operator fails to perform the cybersecurity protection obligations prescribed in Articles 21 and 25 of this Law, the competent authorities shall order it to make corrections, issue a warning, and may impose a fine of not less than 10,000 yuan but not more than 50,000 yuan. If it refuses to make corrections or causes consequences such as endangering cybersecurity, a fine of not less than 50,000 yuan but not more than 500,000 yuan shall be imposed, and a fine of not less than 10,000 yuan but not more than 100,000 yuan shall be imposed on the directly responsible persons-in-charge.

   Where an operator of critical information infrastructure fails to perform the cybersecurity protection obligations prescribed in Articles 33, 34, 36 and 38 of this Law, the competent authorities shall order it to make corrections, issue a warning, and may impose a fine of not less than 50,000 yuan but not more than 100,000 yuan. If it refuses to make corrections or causes consequences such as endangering cybersecurity, a fine of not less than 100,000 yuan but not more than 1,000,000 yuan shall be imposed, and a fine of not less than 10,000 yuan but not more than 100,000 yuan shall be imposed on the directly responsible persons-in-charge.

   Anyone who commits the acts specified in the preceding two paragraphs and causes serious cybersecurity consequences such as massive data leakage or partial loss of function of critical information infrastructure shall be imposed a fine of not less than 500,000 yuan but not more than 2,000,000 yuan by the competent authorities. The competent authorities may also order the suspension of relevant businesses, suspension of operations for rectification, closure of websites or applications, revocation of relevant business licenses or revocation of business licenses, and impose a fine of not less than 50,000 yuan but not more than 200,000 yuan on the directly responsible persons-in-charge and other directly liable personnel. If such acts result in particularly serious cybersecurity consequences such as total loss of main functions of critical information infrastructure, the competent authorities shall impose a fine of not less than 2,000,000 yuan but not more than 10,000,000 yuan, and order the suspension of relevant businesses, suspension of operations for rectification, closure of websites or applications, revocation of relevant business licenses or revocation of business licenses, in addition to imposing a fine of not less than 200,000 yuan but not more than 1,000,000 yuan on the directly responsible persons-in-charge.”

2. A new article is added as Article 61:

   “Whoever, in violation of the provisions of Article 23 of this Law, sells or provides critical network equipment and specialized cybersecurity products that have not undergone security certification or testing, or have failed security certification, or failed to meet the requirements in security testing shall be ordered by the competent authorities to make corrections or terminate the illegal act, issued a warning, and have the illegal products and illegal gains confiscated. If the illegal gains exceed 100,000 yuan, an additional fine of not less than one time but not more than three times the illegal gains may be imposed. If there are no illegal gains or the illegal gains are less than 100,000 yuan, an additional fine of not less than 30,000 yuan but not more than 100,000 yuan may be imposed.”

3. A new article is added as Article 64:

   “Whoever commits any of the acts specified in Items (1) and (2) of Article 60 and Article 63 of this Law and causes the consequences prescribed in Paragraph 3 of Article 59 of this Law shall be punished in accordance with the provisions of that paragraph.”

4. Article 65 is renumbered as Article 67 and revised to read:

   “Where an operator of critical information infrastructure, in violation of the provisions of Article 35 of this Law, uses network products or services that have not undergone security review or have failed the security review, the competent authorities shall order it to make corrections within a time limit, eliminate the impact on national security, impose a fine of not less than one time but not more than ten times the procurement amount, and impose a fine of not less than 10,000 yuan but not more than 100,000 yuan on the directly responsible persons-in-charge and other directly liable personnel.”

5. Articles 68 and Item (1) of Article 69 are merged into a new Article 69, which is revised to read:

   “Where a network operator, in violation of the provisions of Article 47 of this Law, fails to stop the transmission of information prohibited by laws and administrative regulations, take such disposal measures as removal, keep relevant records, or report to the competent authorities; or in violation of the provisions of Article 50 of this Law, fails to stop the transmission of such prohibited information, take such disposal measures as removal, or keep relevant records in accordance with the requirements of the competent authorities, the competent authorities shall order it to make corrections, issue a warning and a circular of criticism, and may impose a fine of not less than 50,000 yuan but not more than 500,000 yuan. If it refuses to make corrections or the circumstances are serious, a fine of not less than 500,000 yuan but not more than 2,000,000 yuan shall be imposed. The competent authorities may also order the suspension of relevant businesses, suspension of operations for rectification, closure of websites or applications, revocation of relevant business licenses or revocation of business licenses, and impose a fine of not less than 50,000 yuan but not more than 200,000 yuan on the directly responsible persons-in-charge and other directly liable personnel.

   Where a network operator commits the illegal acts specified in the preceding paragraph and causes particularly serious impacts or consequences, the competent authorities shall impose a fine of not less than 2,000,000 yuan but not more than 10,000,000 yuan, and may order the suspension of relevant businesses, suspension of operations for rectification, closure of websites or applications, revocation of relevant business licenses or revocation of business licenses, and impose a fine of not less than 200,000 yuan but not more than 1,000,000 yuan on the directly responsible persons-in-charge and other directly liable personnel.

   Providers of electronic information sending services and providers of application software downloading services that fail to perform the security management obligations prescribed in Paragraph 2 of Article 48 of this Law shall be punished in accordance with the provisions of the preceding two paragraphs.”

6. Paragraph 1 of Article 64, Article 66 and Article 70 are merged into a new Article 71, which is revised to read:

   “Whoever commits any of the following acts shall be handled and punished in accordance with the provisions of relevant laws and administrative regulations:

   (1) Publishing or transmitting information prohibited by Paragraph 2 of Article 12 of this Law and other laws and administrative regulations;

   (2) Violating the provisions of Paragraph 3 of Article 22 and Articles 41 to 43, thus infringing upon the legally protected rights and interests of personal information;

   (3) Violating the provisions of Article 37, where an operator of critical information infrastructure stores personal information and important data overseas or provides such information and data to overseas parties.”

7. A new article is added as Article 72:

   “Where a network operator actively eliminates or mitigates the harmful consequences of its illegal act, or commits a minor illegal act that is promptly corrected without causing harmful consequences, or commits an illegal act for the first time with minor harmful consequences that is promptly corrected, it shall be given a lighter or mitigated administrative penalty, or be exempted from administrative penalty in accordance with the provisions of the Administrative Penalty Law of the People’s Republic of China.

   Competent authorities shall formulate corresponding benchmarks for the discretionary application of administrative penalties in accordance with their duties to regulate the exercise of discretionary power in imposing administrative penalties.”

8. Partial articles are revised as follows:

   (1) Article 61 is renumbered as Article 62 and Article 62 as Article 63, and the phrase “closing of websites” therein is revised to “closing of websites or applications”.

   (2) Paragraph 2 of Article 64 is renumbered as Article 66.

   In addition, the serial numbers of the relevant articles are adjusted accordingly.

Explanation on the Draft Amendment to the Cybersecurity Law of the People’s Republic of China (for the Second Round of Public Comment)

1. Background of the Revision

   Since the Cybersecurity Law came into force in 2017, it has provided strong legal guarantees for safeguarding the sovereignty of cyberspace, national security, and public interests, as well as protecting the legitimate rights and interests of citizens, legal persons, and other organizations. As network and information technologies become increasingly integrated into social production and daily life, cybersecurity risks have become more prominent. Since 2021, relevant cybersecurity legislations such as the Data Security Law of the People’s Republic of China and the Personal Information Protection Law of the People’s Republic of China have been formulated and implemented successively, and the Administrative Penalty Law of the People’s Republic of China has been revised and issued. The Cybersecurity Law needs to adapt to the new situation, strengthen connection and coordination with these newly issued laws, scientifically optimize the relevant legal liability system, and further ensure cybersecurity.

Chapter 1 General Provisions

Article 1: These Measures are formulated in accordance with the Cybersecurity Law of the People’s Republic of China, the Data Security Law of the People’s Republic of China, the Personal Information Protection Law of the People’s Republic of China, the Law of the People’s Republic of China on the Advancement of Science and Technology, and other laws and administrative regulations, in order to promote the healthy development and standardized application of generative artificial intelligence, safeguard national security and the public interest, and protect the lawful rights and interests of citizens, legal persons, and other organizations.

Article 2: These Measures apply to the use of generative artificial intelligence technology to provide services for generating text, pictures, audio, video, and other content to the public in the People’s Republic of China (hereinafter referred to as generative artificial intelligence services).

Where the state has other provisions on the use of generative artificial intelligence services to engage in activities such as press and publication, film and television production, literary and artistic creation, those provisions shall prevail.

The provisions of these Measures shall not apply to industry organizations, enterprises, educational and scientific research institutions, public cultural institutions, relevant professional institutions, etc., where generative AI technology is developed and applied and does not provide generative AI services to the domestic public.

Article 3: The state adheres to the principles of attaching equal importance to development and security, promoting innovation, and combining governance according to law, takes effective measures to encourage the innovation and development of generative artificial intelligence, and implements inclusive, prudent, and classified and hierarchical supervision of generative artificial intelligence services.

Article 4: The provision and use of generative AI services shall comply with laws and administrative regulations, respect social morality and ethics, and comply with the following provisions:

(1) Adhere to the core socialist values, and must not generate content prohibited by laws and administrative regulations, such as inciting subversion of state power, overthrowing the socialist system, endangering national security and interests, damaging the national image, inciting secession, undermining national unity and social stability, promoting terrorism and extremism, promoting ethnic hatred, ethnic discrimination, violence, obscenity, pornography, and false and harmful information;

(2) In the process of algorithm design, training data selection, model generation and optimization, and service provision, take effective measures to prevent discrimination on the basis of ethnicity, belief, country, region, gender, age, occupation, health, etc.;

(3) Respect intellectual property rights and business ethics, keep trade secrets, and do not use algorithms, data, platforms, and other advantages to implement monopoly and unfair competition;

(4) Respect the lawful rights and interests of others, and must not endanger the physical and mental health of others, and must not infringe on the rights and interests of others’ portrait, reputation, honor, privacy, and personal information;

(5) Based on the characteristics of service types, take effective measures to improve the transparency of generative AI services and improve the accuracy and reliability of generated content.

Chapter 2 Technology Development and Governance

Article 5: Encourage the innovative application of generative artificial intelligence technology in various industries and fields, generate positive, healthy, and upward-looking high-quality content, explore and optimize application scenarios, and build an application ecosystem.

Support industry organizations, enterprises, educational and scientific research institutions, public cultural institutions, relevant professional institutions, etc. to collaborate on generative artificial intelligence technology innovation, data resource construction, transformation and application, risk prevention, etc.

Article 6 Encourage independent innovation in basic technologies such as generative AI algorithms, frameworks, chips, and supporting software platforms, carry out international exchanges and cooperation on an equal and mutually beneficial basis, and participate in the formulation of international rules related to generative artificial intelligence.

Promote the construction of generative artificial intelligence infrastructure and public training data resource platforms. Promote the collaborative sharing of computing power resources and improve the efficiency of computing power resource utilization. Promote the classification and grading of public data and open it in an orderly manner, and expand high-quality public training data resources. Encourage the use of secure and trusted chips, software, tools, computing power, and data resources.

Article 7: Generative AI service providers (hereinafter referred to as “providers”) shall carry out training data processing activities such as pre-training and optimization training in accordance with law, and comply with the following provisions:

(1) Use data and basic models with legitimate sources;

(2) Where intellectual property rights are involved, they must not infringe on the intellectual property rights enjoyed by others in accordance with law;

(3) Where personal information is involved, personal consent shall be obtained or other circumstances that comply with laws and administrative regulations;

(4) Take effective measures to improve the quality of training data, and enhance the authenticity, accuracy, objectivity, and diversity of training data;

(5) Other relevant provisions of laws and administrative regulations such as the Cybersecurity Law of the People’s Republic of China, the Data Security Law of the People’s Republic of China, and the Personal Information Protection Law of the People’s Republic of China, as well as the relevant regulatory requirements of relevant competent authorities.

Article 8: Where data labeling is carried out in the process of generative AI technology research and development, the provider shall formulate clear, specific, and actionable labeling rules that meet the requirements of these Measures; carry out data annotation quality assessment, sampling and verification of the accuracy of annotation content; Conduct necessary training for markers, enhance their awareness of respecting the law and abiding by the law, and supervise and guide labeling personnel to carry out labeling work in a standardized manner.

Chapter 3 Service Specifications

Article 9: Providers shall lawfully assume the responsibility of being a producer of online information content and perform their network information security obligations. Where personal information is involved, it shall assume the responsibility of the personal information processor and fulfill its personal information protection obligations in accordance with the law.

Providers shall sign service agreements with generative AI service users (hereinafter referred to as users) who register their services, clarifying the rights and obligations of both parties.

Article 10: Providers shall clarify and disclose the applicable populations, occasions, and uses of their services, guide users to scientifically and rationally understand and use generative AI technology in accordance with law, and take effective measures to prevent minor users from over-relying on or indulging in generative AI services.

Article 11: Providers shall perform their obligations to protect users’ input information and usage records in accordance with law, and shall not collect unnecessary personal information, illegally retain input information and usage records that can identify users, and must not illegally provide users’ input information and usage records to others.

Providers shall promptly accept and handle individuals’ requests for access, copying, correcting, supplementing, or deleting their personal information in accordance with law.

Article 12: Providers shall label the generated content such as pictures and videos in accordance with the “Provisions on the Administration of Deep Synthesis of Internet Information Services”.

Article 13: Providers shall provide safe, stable, and continuous services in the course of their services to ensure normal use by users.

Article 14: Where providers discover illegal content, they shall promptly take measures such as stopping generation, transmission, or elimination, and adopt measures such as model optimization and training to make rectifications, and report to the relevant competent departments.

If a provider discovers that a user is using generative AI services to engage in illegal activities, it shall take measures such as warning, restricting functions, suspending or terminating the provision of services to the user in accordance with law and agreement, keep relevant records, and report to the relevant competent departments.

Article 15: Providers shall establish and improve complaint and reporting mechanisms, set up convenient portals for complaints and reports, publish handling procedures and feedback time limits, promptly accept and handle public complaints and reports, and provide feedback on handling results.

Chapter IV: Supervision and Inspection and Legal Responsibility

Article 16: Departments such as internet information, development and reform, education, science and technology, industry and information technology, public security, radio and television, and press and publication shall strengthen the management of generative artificial intelligence services in accordance with their respective duties and in accordance with law.

The relevant national competent departments shall formulate corresponding classification and hierarchical supervision rules or guidelines based on the characteristics of generative artificial intelligence technology and its service application in relevant industries and fields, and improve scientific supervision methods that are compatible with innovation and development.

Article 17: Where generative AI services with public opinion attributes or social mobilization capabilities are provided, security assessments shall be carried out in accordance with relevant state provisions, and procedures for algorithm filing, change, and cancellation shall be carried out in accordance with the “Provisions on the Administration of Algorithm Recommendations for Internet Information Services.”

Article 18: If users find that generative AI services do not comply with laws, administrative regulations, and these Measures, they have the right to complain or report to the relevant competent departments.

Article 19: Relevant competent departments shall supervise and inspect generative AI services in accordance with their duties, and providers shall cooperate in accordance with law, explain the source, scale, type, labeling rules, algorithm mechanisms, etc. of training data as required, and provide necessary technical and data support and assistance.

Relevant institutions and personnel participating in the security assessment, supervision and inspection of generative AI services shall keep state secrets, commercial secrets, personal privacy, and personal information known in the course of performing their duties confidential in accordance with law, and shall not disclose or illegally provide them to others.

Article 20: Where the provision of generative AI services from outside the People’s Republic of China to domestic does not comply with laws, administrative regulations, and these Measures, the CAC shall notify the relevant institutions to take technical and other necessary measures to deal with it.

Article 21: Where providers violate the provisions of these Measures, the relevant competent departments shall impose punishment in accordance with the provisions of the Cybersecurity Law of the People’s Republic of China, the Data Security Law of the People’s Republic of China, the Personal Information Protection Law of the People’s Republic of China, the Law of the People’s Republic of China on the Advancement of Science and Technology, and other laws and administrative regulations; Where laws and administrative regulations do not provide for this, the relevant competent departments shall give warnings, notify criticisms, and order corrections within a time limit. if corrections are refused or the circumstances are serious, the provision of relevant services shall be ordered to be suspended.

if it constitutes a violation of public security administration, public security administration punishment shall be given in accordance with law; if a crime is constituted, criminal responsibility shall be pursued in accordance with law.

Chapter V Supplementary Provisions

Article 22 The meanings of the following terms in these Measures are:

(1) Generative artificial intelligence technology refers to models and related technologies with text, pictures, audio, video, and other content generation capabilities.

(2) Generative AI service providers refer to organizations and individuals that use generative AI technology to provide generative AI services (including providing generative AI services by providing programmable interfaces).

(3) Generative AI service users refer to organizations and individuals who use generative AI services to generate content.

Article 23: Where laws and administrative regulations provide that relevant administrative permits shall be obtained for the provision of generative AI services, providers shall obtain permits in accordance with law.

Foreign investment in generative AI services shall comply with the provisions of relevant laws and administrative regulations on foreign investment.

Article 24 These Measures shall come into force on August 15, 2023.

1. Cybersecurity Law of the People’s Republic of China

https://www.miit.gov.cn/zwgk/zcwj/flfg/art/2020/art_b47f3f954273437d9f3ebe880fd6b0b4.html

2. Data Security Law of the People’s Republic of China

https://www.miit.gov.cn/zwgk/zcwj/flfg/art/2022/art_284b390b84484f10b0e43eeafaad0f6d.html

3. Anti-Telecommunications Network Fraud Law

https://www.miit.gov.cn/jgsj/zfs/fl/art/2022/art_d30139b442a141f48f05775d8c0b3cee.html

4. Regulations on the Security Protection of Critical Information Infrastructure

https://www.miit.gov.cn/xwdt/szyw/art/2021/art_8a317dd6beab43e396e278fde38af0bb.html

5. Notice of the Ministry of Industry and Information Technology on Printing and Distributing the Measures for Monitoring and Disposing of Public Internet Network Security Threats

https://www.miit.gov.cn/zwgk/zcwj/wjfb/zh/art/2020/art_2da1d9a1cf0a48d2879bc966d45fc041.html

6. Administrative Measures for Communication Network Security Protection

https://www.miit.gov.cn/jgsj/waj/wjfb/art/2020/art_540e0eb014284206b4e504c9e3b0118d.html

7. Provisions on the Registration of Real Identity Information of Telephone Users

https://www.miit.gov.cn/zwgk/zcwj/flfg/art/2020/art_07ad6d8e69cd4d5ba8b307b37c1aa093.html

8. Cybersecurity Review Measures

https://www.miit.gov.cn/jgsj/waj/wjfb/art/2022/art_9f941fea4fba45f0b590f683ae1c6c6c.html

9. Notice of the Ministry of Industry and Information Technology on Printing and Distributing the “Emergency Plan for Public Internet Network Security Emergencies”

https://www.miit.gov.cn/zwgk/zcwj/wjfb/zh/art/2020/art_f061c6c5fb894dfaa3277ca6c3857bab.html

10. Notice on Printing and Distributing the Guiding Opinions on Strengthening Industrial Internet Security

https://www.miit.gov.cn/jgsj/waj/wjfb/art/2019/art_e1eb259e089943dc85c4f30848ffb043.html

11. Notice of the Ministry of Industry and Information Technology, the Cyberspace Administration of China, and the Ministry of Public Security on Printing and Distributing the Provisions on the Management of Security Vulnerabilities in Network Products

https://www.miit.gov.cn/zwgk/zcwj/wjfb/zh/art/2021/art_0ee692709b76445e9237eb2ba908c5bb.html

12. Notice of the Ministry of Industry and Information Technology on Strengthening Network Security and Data Security of the Internet of Vehicles

https://www.miit.gov.cn/zwgk/zcwj/wjfb/tz/art/2021/art_ba43080de41242e4ab6d6d5fa3218ff9.html

13. Notice of the Ministry of Industry and Information Technology on Printing and Distributing the “Administrative Measures for the Filing of Network Product Security Vulnerability Collection Platforms”

https://www.miit.gov.cn/jgsj/waj/wjfb/art/2022/art_2b63467607fe4961b400ea6a26ab0f55.html

14. Notice of the General Office of the Ministry of Industry and Information Technology on Printing and Distributing the “Guidelines for the Construction of Internet of Vehicles Network Security and Data Security Standard System”

https://www.miit.gov.cn/jgsj/kjs/jscx/bzgf/art/2022/art_0319fb270f634beabd52fbb41c8eb152.html

15. Implementation Opinions on Carrying out Network Security Service Certification

https://www.miit.gov.cn/jgsj/waj/wjfb/art/2023/art_1c72de8733c34303997f5f645d5485f3.html

16. Notice of the Ministry of Industry and Information Technology on Printing and Distributing the Implementation Plan for Improving Data Security Capabilities in the Industrial Sector (2024-2026).

https://www.miit.gov.cn/jgsj/waj/wjfb/art/2024/art_abeb8b6b4ad54ff9bdcceb95808148a0.html

17. The Ministry of Industry and Information Technology on Issuing the Measures for the Management of Data Security in the Field of Industry and Information Technology (Trial)

https://www.miit.gov.cn/jgsj/waj/wjfb/art/2022/art_e4d9ba53a8014d85a4f80d47272f486d.html

18. Notice of the two departments on printing and distributing the “Guidelines for the Construction of Data Security Standard System in the Industrial Sector (2023 Edition)”

https://www.miit.gov.cn/zwgk/zcwj/wjfb/tz/art/2023/art_4558f6132b1e4ef1be564522350906d9.html

19. Guiding Opinions of the Ministry of Industry and Information Technology and Other Sixteen Departments on Promoting the Development of the Data Security Industry

https://www.miit.gov.cn/zwgk/zcwj/wjfb/yj/art/2023/art_a8ef4985d9834d11a5b5495574e60480.html

20. Notice of the General Office of the Ministry of Industry and Information Technology on the “Guidelines for the Construction of Data Security Standard System for the Telecommunications and Internet Industry”

https://www.miit.gov.cn/zwgk/zcwj/wjfb/txy/art/2020/art_4a6aca0048b742ea97cfb280e981125e.html

MIIT Information Management [2023] No. 105

Notice of the Ministry of Industry and Information Technology on Carrying out the Filing of Mobile Internet Applications_Documents of the State Council Department_Chinese Government Website (www.gov.cn)

Communications management bureaus of provinces, autonomous regions, and municipalities directly under the Central Government, China Academy of Information and Communications Technology, Internet Society of China, basic telecommunications companies, public welfare Internet units, Internet access service providers, Internet data center service providers, content distribution network service providers, mobile Internet application distribution platform (including distribution of small programs, quick applications, etc.), smart terminal manufacturers, and Internet information service providers:

In order to implement the “Anti-Telecommunication Network Fraud Law of the People’s Republic of China”, “Internet Information Service Management Measures” (State Council Order No. 292) and other laws and regulations, promote the standardized and healthy development of the Internet industry, and further improve the management of mobile Internet information services, we are now organizing Mobile Internet application program (hereinafter referred to as APP) filing work.?Relevant matters are notified as follows:

1. Overall requirements

Guided by Xi Jinping Thought on Socialism with Chinese Characteristics for a New Era, in-depth study and implementation of General Secretary Xi Jinping’s important thoughts on cyber power and the spirit of General Secretary Xi Jinping’s important instructions on cracking down on telecommunications and network fraud crimes, adhere to law-based administration, openness and transparency, and convenience for the people The principle of high efficiency, safeguarding network security and public interests, protecting the legitimate rights and interests of citizens and organizations, and promoting the standardized and healthy development of the Internet industry.

2. Work content

(1) APP sponsors engaged in Internet information services within the territory of the People’s Republic of China shall perform the filing procedures in accordance with the “Anti-Telecommunication Network Fraud Law of the People’s Republic of China”, “Internet Information Service Management Measures” (State Council Order No. 292), etc. Those who have completed the filing procedures are not allowed to engage in APP Internet information services.

(2) The Ministry of Industry and Information Technology supervises and guides the national APP filing work, and the communication administrations of provinces, autonomous regions, and municipalities directly under the Central Government are responsible for implementing and supervising APP filing management.

(3) The domain name, IP address and other network resources used by the APP sponsor shall comply with the “Internet Domain Name Management Measures” (Ministry of Industry and Information Technology Order No. No.) “Notice of the Ministry of Industry and Information Technology on Regulating the Use of Domain Names for Internet Information Services” (Ministry of Industry and Information Technology Information Management [2017] No. 264) and other management requirements.

(4) The APP sponsor shall truthfully fill in the “Internet Information Service Registration Form” (hereinafter referred to as the “Registration Form”) and the relevant commitment letter.

Sponsors engaged in APP Internet information services such as news, publishing, education, film and television, religion, etc., should also submit a document approved by the relevant competent department to the provincial telecommunications management bureau where their domicile is located when performing the filing procedures.

The telecommunications authorities may adjust the contents of the “Registration Form” and relevant commitment letters based on the actual situation.

(5) The APP sponsor shall go through the filing procedures with the provincial telecommunications management bureau where its domicile is located, and its network access service provider and APP distribution platform (hereinafter referred to as the distribution platform) shall pass the “National Internet Basic Resource Management System” (i.e., ICP) /IP address/Domain name information registration management system (hereinafter referred to as the registration system) adopts the method of online application submission and inspection and review.

(6) Network access service providers and distribution platforms should check the real identity of users, network resources and other information of organizations or individuals planning to engage in APP Internet information services, and must not perform on their behalf when they know or should know that the information is inaccurate. Filing procedures.

(7) After receiving the filing materials submitted by the APP sponsor, the provincial communications management bureau shall file the filing within 20 working days if the materials are complete and accurate, issue the filing number to it, and announce it to the public through the filing system Filing information; if the materials are incomplete or inaccurate, they will not be filed and the reasons will be explained.

(8) The APP sponsor shall indicate its registration number in a prominent position on the APP, and link to the registration system website as required below the registration number for public inquiry and verification.?The distribution platform should indicate the registration number information of the APPs it distributes in a conspicuous position, and report the relevant information of the distributed APPs to the telecommunications authority.

If the APP information changes, cancels, etc., the APP sponsor shall complete the change, cancellation and other procedures with the original filing authority.

(9) Network access service providers, distribution platforms, and smart terminal manufacturers are not allowed to provide network access, distribution, preset and other services for APPs that have not completed the registration procedures.

(10) APP sponsors, network access service providers, distribution platforms, and smart terminal manufacturers should establish and improve mechanisms for monitoring and handling illegal and illegal information. If they discover information that is prohibited from being released or transmitted by laws and administrative regulations, they should immediately stop transmitting the information. , take disposal measures such as elimination to prevent the spread of information, keep relevant records, report to the telecommunications authorities, and dispose according to the requirements of the telecommunications authorities.

3. Work arrangements

(1) Work preparation stage (before the end of August 2023).?The communications bureaus of each province, autonomous region, and municipality directly under the Central Government organize APP sponsors, network access service providers, distribution platforms, etc. within their jurisdiction to clarify management requirements and formulate implementation plans to ensure the steady progress of relevant work.?Network access service providers and distribution platforms should, in accordance with the requirements, build and upgrade the enterprise-side filing system, complete the docking test with the ministry-side filing system, and have functions such as reporting and verification of APP information.

(2) Existing APP registration stage (September 2023-March 2024).?APPs that have started business before the issuance of this notice should, in accordance with the requirements of this notice, complete the filing procedures with the provincial communications bureau where they are domiciled through their network access service providers and distribution platforms.?Among them, those who have completed the website registration procedures only need to supplement and complete the relevant information of their APP, and do not need to repeatedly fill in the true identity information of the organizer.?If there is no website registration information, the registration procedures shall be carried out in accordance with the provisions of this notice.

Apps that plan to carry out business after the issuance of this notice should first complete the filing procedures according to the requirements of this notice before starting business.

(3) Supervision and inspection stage (April 2024-June 2024).?The Ministry of Industry and Information Technology organizes APP registration inspections, and the communications administration bureaus of all provinces, autonomous regions, and municipalities directly urge relevant units to fill in, supplement, and update APP registration information in a timely manner, and provide access to network access service providers, distribution platforms, and smart terminal manufacturers. , distribution, and preset APPs to carry out inspections.?For APPs that fail to perform the filing procedures and engage in illegal activities, the communications bureaus of all provinces, autonomous regions, and municipalities directly under the Central Government should deal with them in accordance with relevant laws and regulations.

(4) Normalization work stage (July 2024 to long-term).?The communications bureaus of all provinces, autonomous regions, and municipalities directly under the Central Government regularly organize network access service providers, distribution platforms, and intelligent terminal manufacturers to conduct assessments on the accuracy of APP registration information, take effective technical measures to strengthen APP compliance management, and improve the level of mobile Internet supervision.

4. Work requirements

(1) Improve political standing and strengthen organizational leadership.?All units must fully understand the importance of APP registration work in strengthening the basic management of the Internet, promoting the standardized and healthy development of the Internet industry, deepening the effectiveness of preventing and controlling telecom network fraud, and maintaining network and information security. According to the work deployment, strengthen the implementation of the main responsibilities to ensure that each unit The work was completed on time and with high quality.

(2) Consolidate the main responsibilities and strictly implement the work.?All communications management bureaus must strengthen supervision and inspection of enterprises to promptly discover hidden problems and weak links.?Network access service providers, distribution platforms, and smart terminal manufacturers must strengthen work implementation and responsibility assessment, promptly handle problems encountered at work, and report to the telecommunications authorities.

(3) Strengthen technical support and provide strong support.?The China Academy of Information and Communications Technology and the Internet Society of China should do a good job in the construction, operation and maintenance of the registration system, strengthen the sharing and analysis capabilities of APP registration data, and actively cooperate with the telecommunications authorities to answer questions, publicize and guide the APP registration management work, and effectively support Various supervision work of APP.

Attachment:?Internet Information Services Registration Form.wps

Ministry of Industry and Information Technology
July 21, 2023

In accordance with the “Network Security Law of the People’s Republic of China”, the State Internet Information Office, together with the Ministry of Industry and Information Technology, the Ministry of Public Security, and the National Certification and Accreditation Administration Commission, have updated the “Catalogue of Key Network Equipment and Special Products for Network Security”, which is hereby announced. Come into force on the date of issue.

In 2017, the National Internet Information Office, the Ministry of Industry and Information Technology, the Ministry of Public Security, and the National Certification and Accreditation Administration Committee jointly issued the “Announcement on Issuing the Catalog of Key Network Equipment and Network Security Special Products (First Batch)” (2017 No. 1) the catalogs of key network equipment and special products for network security are abolished simultaneously.

Special announcement.

State Internet Information Office Ministry
of Industry and Information Technology Ministry
of Public Security
National Certification and Accreditation Supervision and Administration Commission
July 3, 2023

Attachment:?
Catalog of Key Network Equipment and Special Products for Network Security.pdf

http://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm

State Internet Information Office

National Development and Reform Commission, People’s Republic of China

Ministry of Education of the People’s Republic of China

Ministry of Science and Technology of the People’s Republic of China

Ministry of Industry and Information Technology of the People’s Republic of China

Ministry of Public Security of the People’s Republic of China

State Administration of Radio and Television

make

No. 15

The “Interim Measures for the Management of Generative Artificial Intelligence Services” has been reviewed and approved at the 12th office meeting of the State Internet Information Office in 2023 on May 23, 2023, and has been approved by the National Development and Reform Commission, the Ministry of Education, the Ministry of Science and Technology, the Industry and The Ministry of Information Technology, the Ministry of Public Security, and the State Administration of Radio and Television agree, and it is hereby promulgated and will come into force on August 15, 2023.

Zhuang Rongwen, director of the State Internet Information Office

Zheng Shanjie, Director of the National Development and Reform Commission

Minister of Education Huai Jinpeng

Minister of Science and Technology Wang Zhigang

Jin Zhuanglong, Minister of Industry and Information Technology

Minister of Public Security Wang Xiaohong

Cao Shumin, director of the State Administration of Radio and Television

July 10, 2023

Interim Measures for the Management of Generative Artificial Intelligence Services

Chapter 1 General Provisions

Article 1 In order to promote the healthy development and standardized application of generative artificial intelligence, safeguard national security and social public interests, and protect the legitimate rights and interests of citizens, legal persons, and other organizations, according to the “People’s Republic of China Cybersecurity Law”, “People’s Republic of China Data Security Law, “Personal Information Protection Law of the People’s Republic of China”, “Science and Technology Progress Law of the People’s Republic of China” and other laws and administrative regulations, formulate these measures.

Article 2 These Measures apply to the use of generative artificial intelligence technology to provide services for generating text, pictures, audio, video, and other content to the public within the territory of the People’s Republic of China (hereinafter referred to as generative artificial intelligence services).

If the state has other regulations on the use of generative artificial intelligence services to engage in activities such as news publishing, film and television production, and literary and artistic creation, those regulations shall prevail.

Industry organizations, enterprises, educational and scientific research institutions, public cultural institutions, and relevant professional institutions that develop and apply generative artificial intelligence technology, but do not provide generative artificial intelligence services to the domestic public, shall not be subject to the provisions of these Measures.

Article 3?The state adheres to the principles of attaching equal importance to development and security, promoting innovation and combining law-based governance, adopting effective measures to encourage the innovation and development of generative artificial intelligence, and implementing inclusive prudence and classified and hierarchical supervision of generative artificial intelligence services.

Article 4 The provision and use of generative artificial intelligence services shall abide by laws and administrative regulations, respect social morality and ethics, and abide by the following provisions:

(1) Adhere to the core values ??of socialism, and must not generate incitement to subvert state power, overthrow the socialist system, endanger national security and interests, damage national image, incite secession, undermine national unity and social stability, promote terrorism, extremism, promote Content prohibited by laws and administrative regulations such as ethnic hatred, ethnic discrimination, violence, obscenity, and false harmful information;

(2) In the process of algorithm design, training data selection, model generation and optimization, and service provision, take effective measures to prevent discrimination based on ethnicity, belief, country, region, gender, age, occupation, health, etc.;

(3) Respect intellectual property rights, and business ethics, keep business secrets, and not use algorithms, data, platforms, and other advantages to implement monopoly and unfair competition;

(4) Respect the legitimate rights and interests of others, must not endanger the physical and mental health of others, and must not infringe on the portrait rights, reputation rights, honor rights, privacy rights, and personal information rights of others;

(5) Based on the characteristics of the service type, take effective measures to improve the transparency of generative artificial intelligence services and improve the accuracy and reliability of generated content.

Chapter 2 Technology Development and Governance

Article 5 Encourage the innovative application of generative artificial intelligence technology in various industries and fields, generate positive, healthy, and positive high-quality content, explore and optimize application scenarios, and build an application ecosystem.

Support industry organizations, enterprises, educational and scientific research institutions, public cultural institutions, and relevant professional institutions to collaborate in generative artificial intelligence technology innovation, data resource construction, transformation and application, and risk prevention.

Article 6 Encourage the independent innovation of basic technologies such as generative artificial intelligence algorithms, frameworks, chips, and supporting software platforms, carry out international exchanges and cooperation on an equal and mutually beneficial basis, and participate in the formulation of international rules related to generative artificial intelligence.

Promote the construction of generative artificial intelligence infrastructure and public training data resource platforms. Promote the collaborative sharing of computing power resources and improve the utilization efficiency of computing power resources. Promote the orderly opening of public data classification and classification, and expand high-quality public training data resources. Encourage the adoption of secure and trusted chips, software, tools, computing power and data resources.

Article 7 Generative artificial intelligence service providers (hereinafter referred to as providers) shall carry out training data processing activities such as pre-training and optimization training in accordance with the law, and abide by the following provisions:

(1) Use data and basic models with legitimate sources;

(2) Where intellectual property rights are involved, the intellectual property rights enjoyed by others shall not be infringed;

(3) Where personal information is involved, the consent of the individual shall be obtained or other circumstances that comply with laws and administrative regulations;

(4) Take effective measures to improve the quality of training data, and enhance the authenticity, accuracy, objectivity, and diversity of training data;

(5) Other relevant provisions of laws and administrative regulations such as the “Network Security Law of the People’s Republic of China”, “Data Security Law of the People’s Republic of China”, “Personal Information Protection Law of the People’s Republic of China”, and relevant regulatory requirements of relevant competent authorities.

Article 8 Where data labeling is carried out during the research and development of generative artificial intelligence technology, the provider shall formulate clear, specific, and operable labeling rules that meet the requirements of these Measures; carry out data labeling quality assessment, and conduct sampling verification of the accuracy of the labeling content; Conduct necessary training for labeling personnel, enhance awareness of respecting and abiding by the law, and supervise and guide labeling personnel to carry out labeling work in a standardized manner.

Chapter Three Service Specifications

Article 9 Providers shall legally assume the responsibility of network information content producers and fulfill network information security obligations. If personal information is involved, the responsibility of the personal information processor shall be assumed in accordance with the law, and the obligation to protect personal information shall be fulfilled.

Providers should sign service agreements with generative artificial intelligence service users (hereinafter referred to as users) who register their services, clarifying the rights and obligations of both parties.

Article 10 Providers shall clarify and disclose the applicable population, occasions, and uses of their services, guide users to scientifically and rationally understand and use generative artificial intelligence technology in accordance with the law, and take effective measures to prevent minor users from excessively relying on or indulging in generative artificial intelligence Serve.

Article 11 The provider shall fulfill the obligation to protect the user’s input information and use records in accordance with the law, shall not collect unnecessary personal information, shall not illegally retain input information and use records that can identify the user’s identity, and shall not illegally provide the user’s information to others. input information and usage records.

The provider shall accept and process the individual’s requests for reviewing, copying, correcting, supplementing, and deleting their personal information in a timely manner in accordance with the law.

Article 12 Providers shall mark pictures, videos, and other generated content in accordance with the “Regulations on the Administration of Deep Synthesis of Internet Information Services”.

Article 13 Providers shall provide safe, stable, and continuous services in the course of their services to ensure the normal use of users.

Article 14 Where a provider discovers illegal content, it shall promptly take disposal measures such as stopping generation, stopping transmission, and elimination, take measures such as model optimization training for rectification, and report to the relevant competent authority.

If the provider discovers that the user is using the generative artificial intelligence service to engage in illegal activities, it shall take measures such as warning, restricting functions, suspending or terminating the provision of services to it in accordance with the law, keep relevant records, and report to the relevant competent authority.

Article 15 The provider shall establish and improve the complaint and report mechanism, set up a convenient complaint and report portal, announce the handling process and feedback time limit, accept and handle public complaints and reports in a timely manner, and give feedback on the handling results.

Chapter IV Supervision and Inspection and Legal Responsibilities

Article 16 Departments of cybersecurity and informatization, development and reform, education, science and technology, industry and informatization, public security, radio and television, press and publication, etc., shall strengthen the management of generative artificial intelligence services in accordance with the law according to their respective responsibilities.

Relevant national authorities shall, in light of the characteristics of generative artificial intelligence technology and its service applications in relevant industries and fields, improve scientific supervision methods that are compatible with innovation and development, and formulate corresponding classification and classification supervision rules or guidelines.

Article 17 Providers of generative artificial intelligence services with public opinion attributes or social mobilization capabilities shall conduct security assessments in accordance with relevant national regulations, and perform algorithm filing, modification, and cancellation filing procedures in accordance with the “Internet Information Service Algorithm Recommendation Management Regulations”.

Article 18 If users find that generative artificial intelligence services do not comply with laws, administrative regulations and the provisions of these measures, they have the right to complain and report to the relevant competent authorities.

Article 19 The relevant competent departments carry out supervision and inspection of generative artificial intelligence services according to their duties, and the provider shall cooperate in accordance with the law, explain the source, scale, type, labeling rules, algorithm mechanism, etc. of the training data as required, and provide necessary Technical, data and other support and assistance.

Relevant institutions and personnel involved in the safety assessment and supervision and inspection of generative artificial intelligence services shall keep state secrets, commercial secrets, personal privacy and personal information known in the performance of their duties confidential in accordance with the law, and shall not disclose or illegally provide them to others.

Article 20: Where the provision of generative artificial intelligence services originating from outside the territory of the People’s Republic of China does not comply with laws, administrative regulations, and the provisions of these Measures, the national network information department shall notify relevant institutions to take technical measures and other necessary measures to deal with them.

Article 21 Where a provider violates the provisions of these Measures, the relevant competent authority shall, in accordance with the “Network Security Law of the People’s Republic of China”, “Data Security Law of the People’s Republic of China”, “Personal Information Protection Law of the People’s Republic of China”, “People’s Republic of China If there is no provision in the law or administrative regulations, the relevant competent department shall give a warning, circulate a notice of criticism according to its duties, and order corrections within a time limit; if it refuses to make corrections or the circumstances are serious, it shall be ordered to suspend the provision of Related Services.

If it constitutes a violation of public security management, it shall be punished according to law; if it constitutes a crime, it shall be investigated for criminal responsibility according to law.

Chapter V Supplementary Provisions

Article 22 The meanings of the following terms in these Measures are:

(1) Generative artificial intelligence technology refers to models and related technologies that have the ability to generate content such as text, pictures, audio, and video.

(2) Generative artificial intelligence service providers refer to organizations and individuals that use generative artificial intelligence technology to provide generative artificial intelligence services (including providing generative artificial intelligence services by providing programmable interfaces, etc.).

(3) Generative artificial intelligence service users refer to organizations and individuals who use generative artificial intelligence services to generate content.

Article 23: Where laws and administrative regulations stipulate that the provision of generative artificial intelligence services shall obtain relevant administrative licenses, the providers shall obtain licenses in accordance with the law.

Foreign-invested generative artificial intelligence services shall comply with the provisions of foreign investment-related laws and administrative regulations.

Article 24 These Measures shall come into force on August 15, 2023.

国家互联网信息办公室公布《数据出境安全评估办法》-中共中央网络安全和信息化委员会办公室 (cac.gov.cn)

Bing Translation:

On 7 July, the Cyberspace Administration of China promulgated the Measures for Security Assessment of Data Export (hereinafter referred to as the Measures), which came into effect on 1 September 2022. The relevant person in charge of the State Internet Information Office said that the purpose of promulgating the Measures is to implement the provisions of the Cybersecurity Law, the Data Security Law, and the Personal Information Protection Law, standardize data export activities, protect personal information rights and interests, safeguard national security and social public interests, promote cross-border security and free flow of data, and effectively ensure development with security and promote security with development.

In recent years, with the vigorous development of the digital economy, cross-border data activities have become more and more frequent, and the demand for data export by data processors has grown rapidly. Clarifying the specific provisions of data outbound security assessment is the need to promote the healthy development of the digital economy, prevent and resolve cross-border data security risks, the need to safeguard national security and the social public interest, and the need to protect the rights and interests of personal information. The Measures stipulate the scope, conditions and procedures for data export security assessment, and provide specific guidance for data export security assessment work.

The Measures make it clear that these Measures apply to the security assessment of important data and personal information collected and generated in the course of operations within the territory of the People’s Republic of China provided by data processors abroad. It is proposed that the security assessment of data export adheres to the principles of combining prior assessment and continuous supervision, and combining risk self-assessment with security assessment.

The Measures stipulate the circumstances in which a data export security assessment shall be declared, including the situation in which data processors provide important data abroad, critical information infrastructure operators and data processors that handle personal information of more than 1 million people provide personal information abroad, data processors who have provided 100,000 personal information abroad or 10,000 sensitive personal information that have been provided abroad since January 1 of last year, and other situations where data processors that need to declare data export security assessments are required as stipulated by the state internet information department.

The Measures put forward specific requirements for data export security assessment, stipulating that data processors should carry out self-assessment of data export risks before declaring data export security assessments, and clarifying key assessment matters. It is stipulated that the data processor shall clearly stipulate the responsibility and obligation for data security protection in the legal documents concluded with the overseas recipient, and shall re-declare the assessment if circumstances affecting the security of data export occur during the validity period of the data export security assessment. In addition, it also clarifies the data export security assessment procedures, supervision and management systems, legal responsibilities, and compliance rectification requirements.

Link of website:全国信息安全标准化技术委员会 (tc260.org.cn)

Link of document:
标准名称 (tc260.org.cn)

This is the latest draft version from China government regarding data cross border transfer topic:

Document Title: < Information security technology – Guideline for identification of critical data >