China PIPL AI Controls Mapping: PIPL Articles to AI Enforcement Points

The PIPL governs AI without a single amendment, because each obligation attaches to the handling of personal information rather than to the technology doing the handling. When a developer in Shanghai sends a customer record into a model hosted in Singapore, the Personal Information Protection Law treats that as processing, as automated decision-making if a decision follows, and as a cross-border transfer. The Cyberspace Administration of China (CAC) enforces the result, with the Interim Measures for Generative AI Services of 15 August 2023 and the AI content labelling measures of 1 September 2025 layered on top.

Chinese AI compliance work tends to concentrate on filings and assessments, both of which describe a system before it runs. The mapping from an article to the control that enforces it, at the point personal information actually leaves the network, usually goes unwritten. I want to set that out article by article.

The control point: one HTTPS request

Every mapping below resolves to the same moment: an HTTPS POST carrying a context window to a model endpoint. That request is where identity is known, where classification can be evaluated, where the destination jurisdiction is chosen, and where a decision is recorded or refused. A control living in a PIPIA report describes the article without enforcing it.

Article 24: automated decision-making

Article 24 requires transparency and fair outcomes in automated decision-making, bars unreasonable differential treatment on transaction terms, and gives an individual the right to an explanation and to refuse decisions made solely by automated means where they significantly affect that person. The control is a per-decision record binding input to output and the applied policy, plus a route flag for decisions that must support refusal or human handling. This parallels GDPR Article 22 handling, and the evidence is the decision lineage a CAC review reads when an individual exercises the right.

Articles 13 and 29: legal basis and separate consent

Article 13 lists the legal bases for processing, and Article 29 requires separate consent for sensitive personal information covering biometrics, religious belief, medical health, financial accounts, location tracking, and the data of minors under 14. A prompt carrying sensitive personal information into a model needs a basis that supports that use. The control is prompt-level classification tied to per-role policy, so a caller whose role lacks separate consent for health data gets blocked before transmission. The evidence is the per-request classification and the policy decision recorded against it.

Articles 38 to 40: cross-border transfer

A prompt to a model hosted outside mainland China is a cross-border transfer. The March 2024 Provisions on Promoting and Regulating Cross-Border Data Flows set volume thresholds: CAC security assessment above 1 million individuals a year, or 10,000 or more individuals' sensitive personal information, or any transfer by a critical information infrastructure operator or of important data; standard contractual clauses with filing or certification between 100,000 and 999,999 individuals and for sensitive personal information below 10,000; and no CAC mechanism for non-sensitive data covering fewer than 100,000 individuals. The control is destination-aware routing with volume accounting, and the evidence is a per-request destination, classification, and count log implemented through AI data residency controls.

Articles 55 and 56: impact assessment and records

Article 55 requires a personal information protection impact assessment before sensitive-data processing, automated decision-making, entrusted processing or disclosure, and cross-border transfer. Article 56 requires the report and processing records to be retained for at least three years. The control that covers the operational half is a continuous processing record generated by enforcement, so the retained evidence describes what the system did rather than what the assessment predicted.

Article 51: security measures

Article 51 requires classification-based management, technical security measures, and internal management systems proportionate to risk. For AI traffic the control is access governance on the model channel: per-role, per-route policy replacing shared static keys, failing closed on ambiguity. The evidence is a continuous access record rather than a point-in-time attestation, which matches how the CAC tests whether the boundary held.

The mapping at a glance

The Article 57 breach row

One row activates only after an incident. Article 57 requires notifying the regulator and affected individuals of a leak, distortion, or loss of personal information, with the content of the notice specified. When an AI channel is implicated, you cannot describe the categories of information involved or the individuals affected without reconstructing the traffic. The independent per-request record turns that into a timeline query, and it is the same artifact behind the PIPL audit-evidence view. My frank opinion: the transfer thresholds are the most under-instrumented obligation in Chinese AI programmes, because a threshold expressed as a count of individuals silently assumes somebody is counting.

DeepInspect

Each row above resolves to an enforcement point, and DeepInspect is that point. It sits inline between your users or agents and the LLM APIs they call, evaluates identity, classification, and destination on every request, enforces per-role and per-route policy, and writes a signed record of the decision before the response returns. The PIPL mapping stops being a set of filed assessments and becomes a running control with evidence attached.

For a processor facing CAC scrutiny of Article 24 decisions and the transfer thresholds, that means each obligation has a per-decision record standing behind it, with Article 66 exposure of up to RMB 50 million or 5% of prior-year turnover on the other side of the ledger. Book a technical deep dive at deepinspect.ai.