China's AI Compliance Roadmap 2025–2026: What Professional Services Firms Must Know Now

China's AI regulatory landscape has moved from principle to enforcement at a pace that has caught many international businesses off guard. For professional services firms and global enterprises with operations, clients, or data flows touching China, the window for a casual approach has closed. What follows is a clear account of where the framework now stands, what is coming, and what your organisation needs to do about it.

The Regulatory Architecture: More Layers, More Obligations

The Cyberspace Administration of China (CAC) remains the central authority, but the framework it oversees has grown considerably more complex. The foundation is a trio of laws — the Personal Information Protection Law (PIPL), the Data Security Law, and the Cybersecurity Law — that together govern how data is collected, processed, stored, and transferred. On top of this, a suite of AI-specific regulations has been built, and it continues to expand.

The "Interim Measures for the Management of Generative Artificial Intelligence Services," which came into force in August 2023, set the initial standard: content monitoring, data security, and algorithm registration for generative AI providers. That baseline is now being reinforced by technical standards and labelling requirements that carry real operational weight.

The September 2025 Deadline: AI Content Labelling

The most immediate deadline for many firms is 1 September 2025. From that date, the "Measures for Labeling Artificial Intelligence-Generated Content" and mandatory national standard GB 45438-2025 come into effect. These rules require both explicit and implicit labelling of AI-generated content — visible indicators for end users and embedded metadata for traceability.

The obligation does not fall solely on AI developers. Online content distribution platforms must detect and reinforce these labels. For professional services firms that publish AI-assisted reports, analyses, marketing materials, or client communications through digital channels in China, this is a live compliance question, not a future consideration. If your firm uses generative AI tools to produce content that reaches Chinese audiences or platforms, you need to have assessed your labelling obligations before September.

Alongside these labelling rules, two further national standards take effect in 2025: GB/T 45654-2025 on basic security requirements for generative AI services, and GB/T 45652-2025 on security specifications for pre-training and fine-tuning data. These standards address the quality and provenance of training data and the security architecture of AI models — matters of direct relevance to any firm building, fine-tuning, or procuring AI systems for use in China.

Emerging Rules: Agents, Virtual Persons, and a Comprehensive AI Law

Looking into 2026, the regulatory perimeter is expanding to cover more sophisticated AI deployments. Draft rules on "digital virtual persons" and "AI agents" were released in April and May 2026 respectively. Both focus on autonomous AI systems, the nature of their interactions with users, and the requirement for meaningful human oversight. For professional services firms exploring AI-driven client interaction, automated advisory tools, or AI-assisted workflows, these draft rules signal the direction of travel clearly.

More significant in the longer term is the proposed comprehensive Artificial Intelligence Law, introduced to the National People's Congress in June 2025. Its final legislative timeline remains uncertain, but its anticipated content — a risk-based classification system and mandatory ethics impact assessments for certain AI deployments — mirrors frameworks being developed in the European Union and elsewhere. Firms already navigating the EU AI Act should treat China's proposed law as a parallel obligation requiring its own dedicated compliance analysis, not an afterthought.

Enforcement Is Active: Cross-Border Data Transfers Under Scrutiny

Regulatory frameworks are only as consequential as their enforcement, and China's enforcement record is now substantial. The RMB 8.026 billion fine imposed on a major ride-hailing company in 2022 — approximately $1.2 billion USD — demonstrated that the authorities are prepared to act at scale.

More instructive for international professional services firms are the enforcement actions from September 2025. A European luxury brand's Shanghai subsidiary faced administrative action for transferring personal information to its French headquarters without completing a security assessment, executing Standard Contractual Clauses, or obtaining PIPL certification. The company also failed to inform users adequately and obtain separate consent for the transfer, and lacked appropriate technical safeguards. A separate case in Guiyang saw a company receive an administrative warning for synchronising cloud data to public IP addresses without meeting cross-border data transfer security obligations.

These cases are not outliers. The CAC has run active enforcement campaigns targeting unlawful personal information processing, and cross-border data transfers have been placed firmly in the enforcement spotlight. For any international organisation that routinely moves data between a China entity and its global headquarters — for HR, finance, client management, or technology operations — the message is unambiguous: the transfer mechanism matters, the documentation must be in order, and user consent must be properly obtained and recorded.

What This Means for International Organisations

The China compliance challenge is not contained to firms with large in-country presences. Professional services businesses face exposure across several dimensions:

Data governance. If personal data collected in China flows to systems or teams outside the country — as it almost invariably does in a global enterprise — the PIPL's transfer requirements apply. Security assessments, Standard Contractual Clauses, and certification are not optional extras.

AI tool deployment. Firms using generative AI platforms for work involving Chinese operations, employees, or clients must understand whether those platforms meet China's content, labelling, and security requirements.

Procurement and vendor management. Where AI capabilities are sourced from third-party providers, the compliance obligations do not transfer with the contract. Your organisation retains responsibility for ensuring the tools you deploy meet Chinese standards.

Multi-jurisdictional coherence. China's framework increasingly parallels — but does not replicate — the EU AI Act, GDPR, and emerging regulations in Singapore, the UK, and the United States. Firms operating across multiple jurisdictions need a compliance architecture that accommodates divergence, not a single-market approach applied repeatedly.

The Cost of a Wait-and-See Approach

The September 2025 labelling deadline is weeks away. The AI agent and virtual person draft rules are already in circulation. The comprehensive AI Law is in the legislative pipeline. Enforcement of PIPL and cross-border transfer rules is demonstrably active.

Waiting for final texts before beginning compliance work is no longer a viable strategy. The firms that will navigate this landscape most effectively are those that have mapped their AI use cases and data flows now, established governance structures that can adapt as standards are finalised, and built relationships with advisers who understand both the technical requirements and the enforcement context.

How Ops Intel Can Help

Ops Intel works with international professional services firms and global enterprises to design and implement AI compliance programmes that hold up across multiple jurisdictions — including China. Whether you need a rapid assessment of your current exposure, support structuring cross-border data transfer mechanisms, or a comprehensive AI governance framework built to accommodate evolving standards, our team has the expertise to move you from uncertainty to defensible compliance.

Contact Ops Intel to discuss your China AI compliance obligations and find out how we can help your organisation stay ahead of a regulatory environment that is not slowing down.