China’s Supreme People’s Court Issues 24 AI Liability Rules

On September 7, 2026, China’s Supreme People’s Court published 24 articles of judicial guidance on AI civil liability, covering deepfakes, voice cloning and hallucinations, the same week the EU AI Act reached general application and US states were moving faster than Washington on AI law.

China’s Layered Control Model

China’s AI governance builds outward from existing law rather than creating a single framework. The Supreme People’s Court’s September 7 opinion interprets the Civil Code and the Personal Information Protection Law to address AI-specific civil disputes, drawing clear liability lines for deepfakes, voice cloning and AI hallucinations, and covering violations of personal image, voice and reputation rights without explicit consent.

That judicial layer sits on top of a growing stack of administrative rules. The Interim Measures for the Administration of Artificial Intelligence Anthropomorphic Interaction Services, effective July 15, 2026, govern AI-powered chatbots and virtual companions, requiring content governance, data security controls and algorithm transparency, with an explicit prohibition on designs that foster addiction or harmful psychological influence. As our earlier coverage of China’s July 15 AI rules noted, these provisions are more specific than anything currently on the books in the EU or US. Earlier regulations covering algorithm recommendations (March 2022), deep synthesis (January 2023) and generative AI (August 2023) round out the content governance picture.

Enforcement is structural, not just legal. The Cyberspace Administration of China requires pre-launch algorithm registration for seven categories of AI service. By February 2026, 796 generative AI services had completed national filing. Cross-border data transfers involving significant personal or “important” data require CAC security assessments, and the revised Cybersecurity Law, effective January 1, 2026, explicitly incorporates AI risk monitoring and security supervision. For foreign firms, the practical result is often architectural separation: distinct data environments and model configurations for the Chinese market.

The EU’s Risk-Based Obligations

The EU AI Act reached general application on August 2, 2026, activating transparency duties and GPAI enforcement powers, though Annex III high-risk system obligations, covering critical infrastructure, employment and law enforcement, had already been deferred to December 2027. Providers must document risk management systems, build in human oversight, maintain audit logs and, in many cases, pass third-party conformity assessments before placing systems on the market. Fines for non-compliance can reach 7% of global annual turnover or €35 million, whichever is higher.

General-purpose AI models face a separate track. Transparency rules for GPAI have applied since August 2, 2025; models assessed as carrying systemic risk face additional requirements including red-teaming and incident reporting. The AI Office and national authorities hold enforcement powers, including the ability to demand technical documentation and evaluate models directly. The industry pushback on GPAI evaluation rules has been considerable, particularly on what counts as systemic risk.

Compliance readiness remains thin. As of April 2026, a significant portion of organisations had not taken meaningful steps toward meeting Act requirements, and over half lacked a basic AI inventory. Deadlines are also staggered: AI embedded in regulated products has until August 2, 2028, and the general Annex III high-risk category was extended to December 2, 2027 under the Digital Omnibus on AI political agreement reached on May 7, 2026.

Federal Voluntarism, State Friction

The federal picture in the US is defined less by what the June 2, 2026 Executive Order requires than by what it explicitly does not. President Trump’s order, titled “Promoting Advanced Artificial Intelligence Innovation and Security”, asks developers of covered frontier models to voluntarily share their systems with the federal government up to 30 days before public release, with the designation threshold set through a classified NSA process. It establishes an AI cybersecurity clearinghouse and directs agencies to strengthen their own cyber defences. It does not create mandatory licensing, preclearance or permitting requirements for AI model development or distribution.

Washington is also pushing back against state action. A December 2025 executive order directed the Commerce Department to identify “onerous” state AI laws, and an AI Litigation Task Force has been created to contest state statutes in court. The tension with state legislatures is already visible. New York passed a kids’ chatbot safety bill and an AI training data transparency act in June 2026. Colorado repealed its original AI Act and replaced it with SB 26-189, signed May 14, 2026, an automated decision-making technology law requiring consumer notices, adverse-outcome explanations and human review rights. Enforcement of both the original and replacement statutes remains stayed by a federal court pending further rulemaking, ahead of an effective date of January 1, 2027. Texas’s Responsible AI Governance Act, signed by Governor Abbott in June 2025, took effect January 1, 2026, focused primarily on government use of AI. The NIST AI Risk Management Framework remains the main federal compliance reference, but its voluntary status leaves companies operating across states to manage an increasingly fragmented set of obligations.

Where the Frameworks Collide

Content moderation is the sharpest point of conflict. China requires that AI outputs align with “socialist core values” and pass pre-launch security assessments with real-time content review. The EU’s framework prioritises fundamental rights including freedom of expression. The US applies no equivalent federal content requirement. A generative AI system cannot carry a single output policy that satisfies all three jurisdictions, the metadata schemas, content filters and visibility thresholds are genuinely incompatible.

Data governance creates a sequencing problem for global product launches. China’s Data Security Law and Personal Information Protection Law mandate CAC security assessments for cross-border transfers of significant personal or “important” data before a service goes live. The EU permits transfers through Standard Contractual Clauses and adequacy decisions, a different process with different timelines. The US has no equivalent federal training data requirement, though state consumer protection laws and ongoing copyright litigation create indirect obligations. The upshot is that a company launching a product globally must run three parallel compliance tracks on different schedules, with China’s pre-launch registration having no equivalent in the EU’s conformity assessment process or the US voluntary framework.

The Cost of Fragmentation

For multinationals, the practical consequence is that a single global AI product configured for one jurisdiction will likely fail the requirements of the other two. Region-specific models, datasets and governance processes are increasingly a baseline requirement, not a premium option, particularly on content filtering, data residency and algorithm transparency.

The financial exposure is material. Achieving EU AI Act compliance alone is estimated to cost large enterprises between $8 million and $15 million, with third-party certification adding $50,000 or more per AI system. Add China’s pre-launch registration costs and ongoing CAC assessment fees, plus the legal overhead of navigating state-by-state obligations in the US, and the compliance burden across all three markets is considerably heavier than voluntary frameworks alone would suggest. The three regulatory philosophies are not converging, and companies building for global deployment need to plan accordingly.