China PIPL AI Compliance Checklist: Ten Items Before a Prompt Leaves the Mainland

The PIPL has covered automated decisions since 1 November 2021, three years before most jurisdictions wrote AI into statute. The Cyberspace Administration of China (CAC) enforces it, with the Interim Measures for the Administration of Generative AI Services in force since 15 August 2023 and the Measures for Labelling AI-Generated Synthetic Content since 1 September 2025.

This checklist follows the order a CAC review tends to take: identity and classification records first, then legal basis and separate consent, then cross-border transfers, then automated decisions and breach readiness. Each item pairs the action with the evidence it produces, because Article 55 assessments describe a design and a review asks what the deployed system actually did.

1. Bind identity to every AI request

Route AI traffic so a named user or agent, and not a shared service key, is attached to each prompt. Evidence is a per-request record showing which identity sent which prompt to which model, which every downstream PIPL obligation depends on once a regulator asks who did this.

2. Classify the personal information in the prompt

Evaluate the classification of the context window before it leaves, separating ordinary personal information from the Article 29 sensitive categories covering biometrics, religious belief, medical health, financial accounts, location tracking, and the data of minors under 14. Evidence is a per-request classification decision recorded at the boundary.

3. Enforce legal basis and separate consent by role

Block prompts carrying sensitive personal information when the caller's role lacks the separate consent Article 29 requires or a valid Article 13 basis. Evidence is the per-request policy decision showing what each role was permitted to send into a model.

4. Record the destination jurisdiction of every transfer

Log the model endpoint and its jurisdiction for each request carrying personal information. Evidence is a destination log that answers the Articles 38 to 40 cross-border question directly rather than through a vendor inventory.

5. Count individuals against the transfer thresholds

Track how many individuals are described in personal information leaving the mainland each year, because the March 2024 Provisions on Promoting and Regulating Cross-Border Data Flows set the mechanism by volume: CAC security assessment above 1 million individuals or 10,000 with sensitive personal information, standard contractual clauses with filing between 100,000 and 999,999, and no CAC mechanism below 100,000 non-sensitive. Evidence is a running count derived from the request log.

6. Enforce transfer rules at the boundary

Route prompts carrying regulated classifications only to endpoints in permitted jurisdictions or under an approved mechanism, and block the rest. Evidence is the enforcement log, and AI data residency controls are how this becomes operational rather than contractual.

7. Produce a per-decision record for automated decisions

For any AI output that significantly affects an individual's rights or interests, write a record binding the input prompt to the output and the applied logic. Evidence is decision lineage, the operational backing for the Article 24 rights to explanation and refusal, mirroring GDPR Article 22 handling.

8. Retain the processing record for three years

Keep the Article 55 impact assessment report alongside the operational processing records for at least three years, as Article 56 requires. Evidence is a retained, queryable log covering the assessed period, which is what distinguishes a filed assessment from a demonstrated one.

9. Replace static API keys with per-role, per-route policy

Remove shared credentials granting permanent full model access to any caller, satisfying the Article 51 duty to adopt classification-based management and technical security measures proportionate to risk. Evidence is an access policy plus the enforcement log showing which roles reached which models.

10. Keep the record independent and pre-build the Article 57 breach path

Ensure the compliance log is written by a system separate from the one making the AI call, so it survives selective logging, suppression, and crash-loss, as argued in You Own the AI Liability, Not the Vendor. Confirm you can reconstruct an AI-channel exposure, because Article 57 requires notifying the regulator and affected individuals with specified content. My honest take: Article 66 exposure runs to RMB 50 million or 5% of prior-year turnover, and a notification you cannot populate is the worst position to occupy on the day.

How the checklist maps to the controls

Items 1 through 10 resolve to a handful of enforcement points at the request boundary, laid out in the PIPL controls mapping. The audit-evidence view covers what each artifact looks like when the CAC asks. Together they turn this list into a running system with evidence attached.

DeepInspect

Nine of these ten items produce evidence at one place: the boundary between your users or agents and the LLM APIs they call. DeepInspect sits inline at that boundary. It binds identity to each request, classifies the prompt, enforces consent and destination policy, counts what crosses the border, and writes a signed per-decision record before the response returns. The checklist becomes a query rather than a scramble.

For a processor facing CAC scrutiny of Article 24 decisions and the transfer thresholds, items 5 and 7 are the two that a review will reach first. Book a technical deep dive at deepinspect.ai.