Multinational technology companies face a complex landscape when developing Artificial Intelligence (AI) systems. Corporate data compliance is currently under pressure from two sets of rules operating under distinct rationales: United States directives and Chinese regulations.
As Ge Mengying, Head of Compliance at PatSnap, points out, structuring an adequate data architecture is challenging, yet attainable. What makes AI unique is that it turns data location into a continuous chain. It is necessary to map where the training corpus originated, on which machines the model was trained, who holds login permissions to the system, and where data flows during the inference phase. If a single link fails, the entire compliance investment collapses.
The United States Approach: Focus on Logical Access
In the United States, regulation has shifted from supply chain oversight to access restriction. Executive Order 13873, issued in May 2019, authorized the Department of Commerce to review technology transactions involving foreign adversaries, focusing on equipment and cloud services. However, a major shift occurred with Executive Order 14117 in February 2024 and subsequent Department of Justice rules.
The new American regulatory framework focuses on who can access data, covering both physical and logical access. In practice, even if data remains on US servers, a transaction may fall under the rule if engineers located in China have read permissions. This directly impacts AI development, which frequently relies on teams across multiple time zones to troubleshoot issues and inspect live data.
Other US mechanisms reinforce this approach:
- Investment Screening: Under Executive Order 14083 (September 2022), the Committee on Foreign Investment in the United States (CFIUS) intensified its scrutiny of data-related transactions, often requiring that information remain within the country without remote access by Chinese parties.
- Data Broker Restrictions: Legislation in effect since April 2024 prohibits the sale of sensitive personal data of US citizens to countries of concern. This requires heightened vigilance from AI companies when acquiring training datasets.
The China Approach: Cross-Border Flows and Model Regulation
In China, regulation focuses on international data transfers and market access for AI tools. Article 38 of the Personal Information Protection Law establishes three main mechanisms for outbound data transfers: security assessments, personal information protection certification, and standard contracts.
Although the Provisions on Promoting and Standardizing Cross-Border Data Flows of March 2024 exempted low-risk scenarios from mandatory assessments, they maintain strict oversight over important data and large-scale personal information. This development represents a regulatory recalibration rather than an unrestricted liberalization.
For companies providing generative AI services to the public in China, additional requirements apply. The Interim Measures for the Management of Generative Artificial Intelligence Services impose specific rules regarding:
- The legality of training data sources.
- Content security and labeling requirements.
- Algorithm filing and security assessments as prerequisites for operations.
The Practical Challenge in Data Architecture
Global AI development demands reconciling both frameworks. Designing a compliance program based solely on one approach will lead to regulatory bottlenecks. Effective compliance requires redesigning permission boundaries and development workflows, ensuring that data transfers satisfy Chinese standards while access controls strictly adhere to US regulations.
This content is for informational purposes only and does not constitute legal advice. For guidance on specific matters, consult a qualified lawyer.