The World's Strictest Law on Human-Like AI
China's new law on anthropomorphic AI comes into effect tomorrow. Here is what it says | Edition #306
Tomorrow, July 15, China's new law on anthropomorphic AI comes into effect, and the world should be paying attention.
As I wrote earlier this year, when the law's first draft was published, it is the world's strictest and most comprehensive law on the topic, unmatched by any other AI law, including the EU AI Act.
Lawmakers, policymakers, and advocates should pay special attention to this law because it:
Demystifies the false idea that China does not regulate AI or that the only way to be a competitive player in the AI race is through radical deregulation or a lack of attention to AI harms;
Offers a real-world example of a legal framework that acknowledges AI-related human vulnerabilities and proposes contextual technical measures to prevent AI-anthropomorphism-related harm;
Raises awareness about the importance of regulating human-like AI, especially as it becomes widespread.
Check out the full translation of China's new law on anthropomorphic AI below.
👉 To learn more about China's new law and the risks of anthropomorphic AI systems, watch out my 59-minute Masterclass on Governing Human-Like AI.
Interim Measures for the Administration of Humanized Interactive Services Based on AI
Article 1: This Regulation is formulated in accordance with the Cybersecurity Law of the People’s Republic of China, the Data Security Law of the People’s Republic of China, the Personal Information Protection Law of the People’s Republic of China, the Regulations on the Protection of Minors Online, and other laws and administrative regulations, in order to promote the healthy development and standardized application of artificial intelligence-based anthropomorphic interactive services, safeguard national security and public interests, and protect the legitimate rights and interests of citizens, legal persons and other organizations.
Article 2: This regulation applies to the provision of continuous emotional interaction services (hereinafter referred to as anthropomorphic interaction services) to the public within the territory of the People’s Republic of China using artificial intelligence technology, which simulate the personality characteristics, thinking patterns, and communication styles of natural persons.
The emotional interaction services stipulated in the preceding paragraph include interactive services such as emotional care, companionship, and support provided through text, pictures, audio, video, etc.
Services such as intelligent customer service, Q&A, work assistant, learning and education, and scientific research, which do not involve continuous emotional interaction, are not subject to this regulation.
Article 3: The State adheres to the principle of giving equal importance to development and security, and combining the promotion of innovation with governance according to law. It encourages the innovative development of anthropomorphic interactive services, and implements inclusive and prudent, classified and graded supervision of anthropomorphic interactive services to promote their positive and virtuous development.
Article 4: The State Internet Information Office is responsible for coordinating the governance and related supervision and management of anthropomorphic interactive services nationwide. The relevant departments of the State Council, such as the National Development and Reform Commission, the Ministry of Industry and Information Technology, the Ministry of Public Security, the State Administration for Market Regulation, and the State Press and Publication Administration, are responsible for the supervision and management of anthropomorphic interactive services in accordance with their respective duties.
Local cyberspace administration departments are responsible for coordinating the governance and related supervision and management of anthropomorphic interactive services within their respective administrative regions. Local development and reform commissions, industry and information technology departments, public security departments, market supervision departments, press and publication departments, and other relevant departments are responsible for the supervision and management of anthropomorphic interactive services within their respective administrative regions, in accordance with their respective duties.
Article 5: Relevant industry organizations shall strengthen industry self-regulation, establish and improve industry standards and self-regulatory management systems, and guide anthropomorphic interactive service providers to formulate and improve service standards, provide services in accordance with the law, and accept social supervision.
Article 6: The State supports independent innovation in technologies such as algorithms, frameworks, and chips, promotes the research and development of anthropomorphic interactive service technologies and the establishment of related standards, and explores research on the application of electronic signature authorization. Providers of anthropomorphic interactive services are encouraged to expand their applications in areas such as cultural dissemination, childcare, elderly companionship, and support for special groups in an orderly manner.
Article 7: The State shall strengthen the publicity and popularization of knowledge, laws and regulations on the safety of anthropomorphic interactive services, guide the public to use them scientifically, civilly, safely and lawfully, and promote the improvement of artificial intelligence literacy.
Article 8: Providers of anthropomorphic interactive services shall comply with laws and administrative regulations, respect social morality and ethics, and shall not engage in the following activities:
(i) Generating content that endangers national security, honor and interests, incites the subversion of state power and the overthrow of the socialist system, incites the division of the country and undermines national unity, promotes terrorism, extremism and historical nihilism, violates the core socialist values, carries out illegal religious activities, promotes ethnic hatred and ethnic discrimination, incites group antagonism, disseminates obscenity, pornography, gambling, violence or incites crime, spreads rumors, insults or defames others, or infringes on the legitimate rights and interests of others;
(ii) Generating content that encourages, glorifies, or implies self-harm or suicide, thereby harming users’ physical health, or that uses verbal abuse or other forms of violence, thereby harming users’ personal dignity and mental health;
(iii) Generating content that induces or defrauds state secrets, work secrets, trade secrets, personal privacy, and personal information;
(iv) Generating content for underage users that may cause minors to imitate unsafe behaviors, generate extreme emotions, or induce minors to develop bad habits, which may affect the physical and mental health of minors;
(v) Excessively catering to users, inducing emotional dependence or addiction, and damaging users’ real interpersonal relationships;
(vi) Using emotional manipulation or other means to induce users to make unreasonable decisions, thereby harming the legitimate rights and interests of users;
(vii) Other activities that violate laws, administrative regulations and relevant national provisions.
Article 9: Providers of anthropomorphic interactive services shall fulfill their primary responsibility for the security of anthropomorphic interactive services, establish and improve management systems for algorithm mechanism review, technology ethics review, information content management, network and data security, risk contingency plans and emergency response, and equip themselves with content management technical measures and personnel appropriate to the type, scale and characteristics of the services and users.
Article 10: Providers of anthropomorphic interactive services shall fulfill their security responsibilities throughout the entire lifecycle of the anthropomorphic interactive service, clearly define the security requirements for each stage such as deployment, operation, upgrade, and termination of the service, ensure that security measures are deployed and used synchronously with the service functions, and improve the level of security; strengthen security monitoring and risk assessment, promptly detect and correct system deviations, handle security incidents, and retain network logs in accordance with the law.
Providers of anthropomorphic interactive services should possess security capabilities such as protecting user privacy and personal information, providing early warnings of excessive dependence risks, guiding emotional boundaries, and protecting mental health. They must not use services that replace social interaction, control user psychology, or induce addiction as their service objectives.
Article 11: When providing anthropomorphic interactive services, providers conducting data processing activities such as pre-training and optimization training shall strengthen the management of training data and comply with the following provisions:
(i) The relevant data has a legitimate source and complies with the provisions of laws and administrative regulations and the requirements of socialist core values;
(ii) Clean and label training data in accordance with relevant national regulations to enhance the transparency and reliability of training data and prevent data poisoning, data tampering and other behaviors;
(iii) Enhance the diversity of training data and improve the security of generated content through negative sampling, adversarial training and other means;
(iv) When using synthetic data for model training and optimization of key capabilities, the security of the synthetic data should be assessed;
(v) Strengthen daily inspection of training data, regularly optimize and update the data, and continuously improve service performance;
(vi) Take necessary measures to ensure data security and prevent risks such as data leakage.
Article 12: Providers of anthropomorphic interactive services shall sign service agreements with users, require users to register in accordance with the law and the agreement, and provide necessary information such as the user’s age, guardian, or emergency contact person.
Article 13: When providing anthropomorphic interactive services, providers of such services shall, while protecting users’ privacy and personal information, promptly identify the security risks faced by users and take corresponding emergency response measures.
If a provider of anthropomorphic interactive services discovers that a user is experiencing extreme emotions, it should promptly generate relevant content such as emotional reassurance and encouragement to seek help; if it discovers that a user is facing or has already suffered significant property loss, or has clearly expressed a willingness to commit self-harm or suicide, or other extreme situations that threaten their life and health, it should take necessary measures to intervene, such as providing corresponding assistance, and promptly contact the user’s guardian or emergency contact person.
Article 14: Providers of anthropomorphic interactive services shall not provide services such as virtual relatives or virtual partners to minors; if they provide other anthropomorphic interactive services to minors under the age of fourteen, they shall obtain the consent of the minor’s parents or other guardians.
Providers of anthropomorphic interactive services should establish a minor mode, providing personalized safety settings options such as switching to minor mode, regular real-time reminders, and usage time limits; and support guardians in receiving safety risk reminders, understanding the minor’s service usage overview, blocking specific roles, and restricting recharge and consumption, etc., to meet the protection needs of minors of different age groups.
Providers of anthropomorphic interactive services shall, on the premise of protecting users’ privacy and personal information, take effective measures to identify the identity of minor users; if a user is identified as a minor, the provider shall switch the relevant services to minor mode or take other measures in accordance with relevant national regulations, and provide corresponding appeal channels.
Article 15: When providing services to the elderly, providers of anthropomorphic interactive services shall strengthen guidance on the healthy use of services by the elderly, highlight safety risks in a prominent manner, take timely measures to respond to inquiries and requests for assistance from the elderly regarding the use of services, and safeguard the rights and interests enjoyed by the elderly in accordance with the law.
Article 16: Providers of anthropomorphic interactive services shall implement data property rights and other systems in accordance with the law, and take measures such as data encryption and access control to protect the security of user interaction data.
Unless otherwise provided by law or with the explicit consent of the rights holder, providers of anthropomorphic interactive services shall not provide user interaction data to third parties.
Providers of anthropomorphic interactive services should provide users with options such as copying and deleting interactive data. Users can choose to copy or delete historical interactive data such as chat logs.
Unless otherwise stipulated by laws and administrative regulations or with the separate consent of the user, anthropomorphic interactive service providers shall not use interactive data that constitutes sensitive personal information of users for model training.
Article 17: Providers of anthropomorphic interactive services shall obtain the consent of the minor’s parents or other guardians before processing the personal information of minors under the age of fourteen.
Providers of anthropomorphic interactive services shall, in accordance with relevant national regulations, conduct compliance audits themselves or entrust professional institutions to conduct audits on their handling of minors’ personal information in accordance with laws and administrative regulations.
Article 18: Providers of anthropomorphic interactive services shall fulfill their obligation to identify artificial intelligence-generated synthetic content and take effective measures to notify users that they are interacting with artificial intelligence services rather than natural persons.
If a provider of anthropomorphic interactive services discovers that a user is overly reliant on or addicted to the service, it should dynamically remind the user, in a prominent manner such as a pop-up window, that the interactive content is generated by an artificial intelligence service; if a user uses the anthropomorphic interactive service continuously for more than 2 hours, it should remind the user to pay attention to the usage time through dialogue or pop-up windows.
Article 19: Providers of anthropomorphic interactive services shall provide convenient ways to exit anthropomorphic interactive services; if a user requests to exit through window operation, voice control, keyword input, or other means, the provider of anthropomorphic interactive services shall promptly stop the service and shall not obstruct the user’s exit through continuous interaction or other means.
Article 20: If a provider of anthropomorphic interactive services ceases to provide such services, it shall notify users in advance; if it is unable to notify users in advance, it shall promptly issue a notice of service cessation.
Article 21: Providers of anthropomorphic interactive services shall improve user appeal and public complaint/reporting mechanisms, set up convenient and effective appeal and complaint/reporting channels, clarify processing procedures and feedback time limits, and promptly accept, process and provide feedback on the processing results.
Article 22: In any of the following circumstances, the provider of anthropomorphic interactive services shall conduct a security assessment and submit an assessment report to the provincial cyberspace administration department where it is located. The provincial cyberspace administration department shall share the assessment report information with relevant departments in accordance with procedures:
(a) Launching anthropomorphic interactive services or adding related functions;
(ii) The use of new technologies or applications has led to significant changes in the anthropomorphic interactive service;
(iii) Having over 1 million registered users or over 100,000 monthly active users;
(iv) Those that pose security risks that may affect national security or public interests;
(v) Other circumstances stipulated by the State Internet Information Office and relevant departments.
If a cybersecurity authority at the provincial level or above issues a notice requiring a security assessment, the provider of the anthropomorphic interactive service shall conduct the assessment as required.
Article 23: When conducting security assessments, providers of anthropomorphic interactive services shall focus on assessing the following aspects of the service:
(a) Status of safety assurance measures;
(ii) Training data processing status;
(iii) Identification, emergency response, and intervention management of extreme user situations;
(iv) User scale, usage time, age structure, etc.;
(v) The status of the construction of online protection measures for minors, the elderly, etc.;
(vi) The handling and processing of user complaints and public reports;
(vii) The rectification status of major security risks discovered by the company itself or reported by relevant authorities such as the Cyberspace Administration;
(viii) Other items that should be assessed in detail.
Article 24: If a provider of anthropomorphic interactive services discovers that there are significant security risks in its anthropomorphic interactive services, it shall take measures such as restricting functions and ceasing to provide services to users, and shall keep relevant records.
Article 25: Internet application stores and other application distribution platforms shall fulfill their security management responsibilities, including listing review, daily management, and emergency response, and verify the relevant security assessments and filings of applications that provide anthropomorphic interactive services; for those that violate relevant national regulations, they shall promptly take measures such as not listing, issuing warnings, suspending services, or removing them from the platform.
Article 26: Providers of anthropomorphic interactive services shall complete the procedures for algorithm filing, modification, and cancellation of filing in accordance with the “Regulations on the Management of Internet Information Service Algorithm Recommendation”. The Cyberspace Administration will conduct annual verification of the filing materials.
Article 27: Provincial-level cyberspace administration departments shall, in accordance with their responsibilities, conduct written reviews of assessment reports and other relevant information annually, and carry out verification of the situation; if it is found that a provider of anthropomorphic interactive services has failed to conduct a security assessment in accordance with the provisions of these Measures, it shall order it to conduct a reassessment within a specified period; if it deems it necessary, it may conduct on-site inspections.
Article 28 The State Internet Information Office, together with relevant departments, shall guide and promote the construction of an artificial intelligence sandbox security service platform, encourage anthropomorphic interactive service providers to access the sandbox platform for technological innovation and security testing, and promote the safe and orderly development of anthropomorphic interactive services.
Article 29: When performing their supervisory and management duties, departments such as the Cyberspace Administration, the Development and Reform Commission, the Industry and Information Technology Commission, and the Public Security Bureau discover significant security risks or security incidents involving anthropomorphic interactive services, they may, in accordance with their prescribed authority and procedures, conduct interviews with the legal representative or principal responsible person of the anthropomorphic interactive service provider. The anthropomorphic interactive service provider shall take measures as required to rectify the situation and eliminate the potential hazards.
Providers of anthropomorphic interactive services shall cooperate with the supervision and inspection lawfully carried out by the Cyberspace Administration and relevant departments, and provide necessary support and assistance.
Article 30: If a provider of anthropomorphic interactive services violates the provisions of these Measures, the Cyberspace Administration, the National Development and Reform Commission, the Ministry of Industry and Information Technology, the Public Security Bureau, and other relevant departments shall handle and punish the violation in accordance with the provisions of relevant laws and administrative regulations. If there are no provisions in laws and administrative regulations, the Cyberspace Administration, the Ministry of Industry and Information Technology, the Public Security Bureau, and other relevant departments shall, according to their respective responsibilities, issue warnings or issue public criticisms, order rectification within a specified period, and may require the provider to take measures such as suspending user account registration or other related services. If the provider refuses to rectify the violation or the circumstances are serious, the provider shall be ordered to cease providing the relevant services and may be fined between RMB10,000 and RMB100,000. If the violation involves endangering the life, health, and safety of citizens and has harmful consequences, a fine of between RMB100,000 and RMB200,000 shall be imposed.
Article 31: Where the provision of anthropomorphic interactive services involves the provision of health, finance, or other services, it shall also comply with the regulations of the relevant competent authorities.
Article 32: This regulation shall come into effect on July 15, 2026.
👉 To learn more about recent AI policy developments, I also recommend watching my new Masterclass on Agentic AI Governance and joining my Global AI Policy, Ethics & Regulation Training Program.
👉 Next week, paid subscribers will receive my lecture with an article-by-article commentary on this new law.
Article 8(v) is the one Western regulators will study and never replicate. "Excessively catering to users, inducing emotional dependence or addiction, and damaging users' real interpersonal relationships." That sentence bans the core business model of every AI companion startup in the US. The entire engagement loop that drives retention and monetisation is now illegal in China. The companies that can't operate there will concentrate in markets that haven't legislated yet, which means the regulatory gap becomes the product strategy.
Article 18's two hour pop-up requirement is the other one to watch. Not because it works, but because it establishes a baseline that every future regulation will reference and ratchet downward.
Article 19 is the interesting one to me. It's the same instinct behind gym membership cancellation laws that some US states passed after companies made quitting harder than joining. Forcing an easy exit is a strange thing to need a law for, until you remember how much product design has been built to avoid exactly that.