China AI rules vs the EU AI Act: one inventory, two launch architectures

Multiple instruments address generative AI, deep synthesis, algorithms, content, cybersecurity, data and personal information.

The horizontal AI Act uses risk-based tiers alongside GDPR, product-safety and other EU law.

Maintain two control matrices connected to one system inventory.

Classify service type, public-facing features, content risk and data or cyber interfaces.

Classify the use case, AI-system risk tier and general-purpose model implications where triggered.

Map every user-facing feature to both lenses; never assign a single global status.

Provider duties may include safety, content controls, labelling, data provenance and assessment or filing themes.

Transparency and other obligations depend on classification; general-purpose model rules may apply.

Pair China content controls with the applicable EU risk and model documentation.

Deep-synthesis labelling and misuse controls apply; some recommendation services have filing and transparency themes.

Certain AI-generated content has transparency duties; recommendation use may intersect risk or transparency categories.

Build labelling once, configure it per market, and maintain a China algorithm inventory.

Map provider, platform, deployer and local-partner responsibilities under the relevant instruments.

Map provider, deployer, importer and distributor roles under the AI Act.

Contractual allocations must name China and EU roles separately and match actual control.

Internal tools still engage privacy, employment and security; public-service filing duties may differ.

Internal uses can still be regulated, including HR, credit or other potentially high-risk cases.

Do not classify a system as out of scope merely because it is B2B or internal.

Maintain assessment materials, model and content policies, testing records and Chinese notices.

Maintain applicable technical documentation, quality systems, logs and instructions for use.

Share factual evidence; preserve region-specific conclusions, approvals and document sets.

Regulator, platform and app-store action can make content takedown and remediation operationally immediate.

Market surveillance, administrative fines and conformity bottlenecks shape response.

Use regional release gates and an incident playbook naming both China and EU owners.

Apply PIPL notices, processing grounds and the applicable China outbound-transfer pathway.

Apply GDPR bases, DPIAs and international-transfer tools where applicable.

Make AI and privacy owners share one data-flow inventory with separate legal fields.

Document legitimacy, personal-information handling, intellectual property and content controls.

Document applicable data-governance, copyright and model-governance expectations.

Keep provenance, permissions, exclusions and testing evidence central and versioned.

Tag public versus internal service status and maintain China content, labelling and filing work.

Tag risk candidates and maintain prohibited-practice, high-risk, transparency and model work as applicable.

Share inventory, evaluations, monitoring and base contracts; branch controls and release packs.

Close the assessment or filing calendar, notices, partner roles and China data pathway.

Close the applicable conformity, transparency, role and EU data-transfer pack.

Record residual risk per region and block launch where either required pack remains open.