每周数据法律资讯 Data Law Weekly（20260406—20260412）

1. 五部门公布《人工智能拟人化互动服务管理暂行办法》，7月15日起施行

4月10日，国家互联网信息办公室、国家发展和改革委员会、工业和信息化部、公安部、国家市场监督管理总局联合公布《人工智能拟人化互动服务管理暂行办法》，自2026年7月15日起施行。拟人化互动服务系指模拟自然人人格特征、思维模式和沟通风格的持续性的情感互动服务，包括通过文字、图片、音频、视频等形式，提供的情感照护、陪伴、支持等互动服务。提供智能客服、知识问答、工作助手、学习教育、科学研究等服务，不涉及持续性的情感互动的，不适用《办法》规定。

【点击查阅《办法》全文：

https://mp.weixin.qq.com/s/6mBUtSdD6kkNh-T2yDrTNQ】

【《人工智能拟人化互动服务管理暂行办法》合规要点提示：

1. 用户保护：拟人化互动服务提供者除要求用户依法依约进行注册外，还需提供用户年龄、监护人或者紧急联系人等必要信息。发现用户正在面临或者已经遭受重大财产损失、明确表示实施自残自杀等威胁生命健康的极端情境的，应当采取提供相应援助等必要措施予以干预，并及时联络用户监护人或者紧急联系人。

2. 未成年人保护：不得向未成年人提供虚拟亲属、虚拟伴侣等虚拟亲密关系的服务；向不满十四周岁未成年人提供其他拟人化互动服务的，应当取得未成年人的父母或者其他监护人的同意；应当建立未成年人模式；采取有效措施识别未成年人用户身份。

3. 个人信息保护：应当向用户提供交互数据复制、删除等选项，用户可以选择对聊天记录等历史交互数据进行复制、删除等；除法律、行政法规另有规定或者取得用户单独同意外，不得将属于用户敏感个人信息的交互数据用于模型训练。

4. 内容标识：履行人工智能生成合成内容标识义务，采取有效措施提示用户正在与人工智能服务而非自然人进行互动；对用户连续使用拟人化互动服务每超过2个小时的，应当以对话或者弹窗等方式提醒用户注意使用时长。

5.安全评估：上线拟人化互动服务，或者增设拟人化互动服务相关功能的，或者注册用户100万以上或者月活跃用户10万以上的等情形下，应当开展安全评估，并向所在地省级网信部门提交评估报告】

Five Departments Issue the “Interim Measures for the Administration of Anthropomorphic Interactive Services in Artificial Intelligence,” Effective July 15

On April 10, the Cyberspace Administration of China (“CAC”), the National Development and Reform Commission, the Ministry of Industry and Information Technology (“MIIT”), the Ministry of Public Security, and the State Administration for Market Regulation jointly issued the “Interim Measures for the Administration of Anthropomorphic Interactive Services in Artificial Intelligence,” which will take effect on July 15, 2026. “Anthropomorphic Interactive Services” refer to continuous emotional interactive services that simulate the personality traits, thinking patterns, and communication styles of natural persons, including interactive services such as emotional care, companionship, and support provided through text, images, audio, video, and other forms. Services such as intelligent customer service, Q&A, work assistants, educational training, and scientific research that do not involve continuous emotional interaction are not subject to the provisions of these Measures.

[Click to view the full text of the Measures:

https://mp.weixin.qq.com/s/6mBUtSdD6kkNh-T2yDrTNQ]

[Key Compliance Points for the “Interim Measures for the Administration of Anthropomorphic Interactive Services in Artificial Intelligence”:

1. User Protection: In addition to requiring users to register in accordance with the law and contractual agreements, providers of anthropomorphic interactive services must also obtain necessary information such as the user’s age, guardian, or emergency contact. If a user is found to be facing or has already suffered significant financial loss, or has explicitly expressed threats to life and health such as self-harm or suicide, the provider shall take necessary measures to intervene, such as providing appropriate assistance, and promptly contact the user’s guardian or emergency contact.

2. Protection of Minors: Services involving virtual intimate relationships, such as virtual relatives or virtual partners, must not be provided to minors; when providing other anthropomorphic interactive services to minors under the age of fourteen, consent must be obtained from the minor’s parents or other legal guardians; a “minor mode” must be established; and effective measures must be taken to verify minor users.

3. Personal Information Protection: Users must be provided with options to copy or delete interaction data, and users may choose to copy or delete historical interaction data such as chat logs; unless otherwise provided by laws or administrative regulations or with the user’s separate consent, interaction data constituting the user’s sensitive personal information must not be used for model training.

4. Content Labeling: Fulfill the obligation to label AI-generated synthetic content, and take effective measures to alert users that they are interacting with an AI service rather than a natural person; When a user continuously uses anthropomorphic interactive services for more than 2 hours, the service provider shall remind the user of the duration of use via dialogue or pop-up windows. 

5. Security Assessment: When launching anthropomorphic interactive services, adding related features to such services, or when the number of registered users exceeds 1 million or the number of monthly active users exceeds 100,000, a security assessment shall be conducted, and an assessment report shall be submitted to the provincial-level cyberspace administration department where the service provider is located.]

2. 三部门印发《网络安全标识管理办法》，7月1日起施行

4月10日，国家互联网信息办公室、工业和信息化部、公安部联合印发《网络安全标识管理办法》，自2026年7月1日起施行。《办法》鼓励产品生产者提升产品网络安全能力，标注网络安全标识。网络安全标识对应的网络安全能力由低到高依次为基础级、增强级、领先级，相应的标识等级分别用一星、二星、三星表示。需要标注网络安全标识的产品，产品生产者应当依据实施规则相关要求开展网络安全能力检测，确定网络安全能力等级，取得检测报告，并通过网络安全标识备案管理平台进行备案。

【参见：

https://mp.weixin.qq.com/s/ezSqsekgW70t6EgYuJiH7g?scene=1&click_id=16】

Three Departments Issue the “Measures for the Administration of Cybersecurity Labels,” Effective July 1

On April 10, the CAC, the MIIT, and the Ministry of Public Security jointly issued the “Measures for the Administration of Cybersecurity Labels,” which will take effect on July 1, 2026. The Measures encourage product manufacturers to enhance the cybersecurity capabilities of their products and to affix cybersecurity labels. The corresponding cybersecurity capabilities for the cybersecurity labels are, in ascending order of capability, Basic Level, Enhanced Level, and Leading Level, with the respective label levels represented by one star, two stars, and three stars. For products required to display a cybersecurity label, manufacturers must conduct cybersecurity capability testing in accordance with the relevant requirements of the implementation rules, determine the cybersecurity capability level, obtain a test report, and file the label through the Cybersecurity Label Filing Management Platform.

[Reference:

https://mp.weixin.qq.com/s/ezSqsekgW70t6EgYuJiH7g?scene=1&click_id=16]

3. 国务院公布《国务院关于产业链供应链安全的规定》，自公布之日起施行

4月7日，国务院公布《国务院关于产业链供应链安全的规定》（国务院令第834号），自公布之日起施行。规定围绕总体国家安全观，建立产业链供应链安全统筹协调、风险监测预警、储备保障、应急处置与反制机制，强化关键领域安全、数据安全、国际合作与调查处置权限，维护国家经济安全与产业链供应链稳定。

【参见：

https://mp.weixin.qq.com/s/HcsVai8WEDaPGc-iNIOBqw?scene=1】

The State Council Issue the “State Council Regulations on the Security of Industrial and Supply Chains,” Effective Immediately Upon Publication 

On April 7, the State Council issued the “State Council Regulations on the Security of Industrial and Supply Chains” (State Council Order No. 834), which came into force on the date of publication. Centred on the overall national security outlook, the Regulations establish mechanisms for the coordinated management, risk monitoring and early warning, reserve safeguards, emergency response and countermeasures regarding the security of industrial and supply chains. They strengthen security in key sectors, data security, international cooperation and investigative and enforcement powers, thereby safeguarding national economic security and the stability of industrial and supply chains. 

[Reference:

https://mp.weixin.qq.com/s/HcsVai8WEDaPGc-iNIOBqw?scene=1]

4. “《汽车数据出境安全指引（2026版）》你问我答”发布

近日，国家工业信息安全发展研究中心联合中国信息通信研究院、中汽智能科技（天津）有限公司举办《汽车数据出境安全指引（2026版）》宣贯会，会上发布了《汽车数据出境安全指引（2026版）》你问我答”，对汽车数据出境场景下高频热点问题，进行了解答。

【参见：

https://mp.weixin.qq.com/s/yxAap4YASwTzS7ufNJoyBw】

Release of “Q&A on the ‘Guidelines for the Secure Cross-Border Transfer of Vehicle Data (2026 Edition)’”

Recently, the National Research Center for Industrial Information Security Development, in collaboration with the China Academy of Information and Communications Technology (CAICT) and China Automotive Intelligence Technology (Tianjin) Co., Ltd., held a promotional and implementation meeting for the “Guidelines for the Secure Cross-border Transfer of Vehicle Data (2026 Edition).” During the event, the “Q&A on the Guidelines for the Secure Cross-border Transfer of Vehicle Data (2026 Edition)” was released, addressing frequently asked questions regarding scenarios involving the cross-border transfer of vehicle data.

[Reference:

https://mp.weixin.qq.com/s/yxAap4YASwTzS7ufNJoyBw]

1. 日本内阁批准《个人信息保护法》修正案草案

4月7日，日本个人信息保护委员会（PPC）宣布内阁批准《个人信息保护法》修正案草案，将在公布后两年内实施。修正案扩大统计及AI处理的同意例外范围，强化未成年人信息保护，增设面部识别数据相关义务，并赋予监管机构新的执法权限。

【参见：

https://www.ppc.go.jp/news/press/2026/260407/】

Japanese Cabinet Approves Draft Amendment to the Personal Information Protection Act

On April 7, the Personal Information Protection Commission (PPC) of Japan announced that the Cabinet had approved the draft amendments to the Act on the Protection of Personal Information (APPI), which will come into force two years after publication. The amendments expand the scope of consent exemptions for statistical and AI processing, strengthen the protection of minors’ personal information, introduce new obligations regarding facial recognition data, and grant the regulatory authority new enforcement powers. 

[Reference:

https://www.ppc.go.jp/news/press/2026/260407/]

2. 法国CNIL发布人力资源领域员工个人信息保存期限框架

4月7日，法国国家信息与自由委员会（CNIL）发布人力资源数据保存期限参考框架，明确招聘、用工、薪酬、监控、门禁、劳动争议等场景下的数据留存期限，为企业数据留存与清理提供统一权威标准。

【参见：

https://www.cnil.fr/fr/referentiel-durees-conservation-donnees-rh】

France’s CNIL Publishes Framework on Retention Periods for Employees’ Personal Data in the HR Sector

On April 7, the French National Commission for Information Technology and Liberties (CNIL) published a reference framework for data retention periods in the human resources sector. This framework specifies data retention periods for scenarios such as recruitment, employment, remuneration, monitoring, access control and labour disputes, provides a unified and authoritative standard for corporate data retention and disposal.

[Reference: 

https://www.cnil.fr/fr/referentiel-durees-conservation-donnees-rh]