Every brief.
The full run, most recent first.
- § 01 · ENFORCEMENT
CVERC Names 82 Apps for PI Violations, and 28 From Its August Batch Are Now Off the Stores
On 23 September 2026 the National Computer Virus Emergency Response Center (国家计算机病毒应急处理中心, CVERC) named 82 mobile apps whose collection and use of personal information failed its testing, carried out between 29 July and 4 September under the 2026 CAC + MIIT + MPS joint special campaign. The notice is published as text, and DCC translates it in full: twelve violation categories, 118 findings, and every app, consolidated into one table. Three things set it apart from the MIIT and CAC notices in DCC's tracker. First, a published retest loop: of the 75 apps CVERC named in August, 28 still failed on retest and have been taken down by the distribution platforms. Second, the taxonomy has moved past the 2019 Identification Method into PIPL's statutory text. Five categories track PIPL Articles 23, 24, 30, 31 and 51 almost word for word: separate consent for sharing with another handler, an opt-out from automated-decision push, notice of why sensitive personal information is needed, dedicated rules for children under 14, and security measures. Third, the perimeter: 29 mini-programs on WeChat, Baidu and Alipay, three WeChat service accounts, two TV apps, a standalone ad SDK, and twelve builds downloaded from third-party download sites. Eight hospital channels are named, among them United Family Healthcare's mini-program, and hospitals account for four of the eleven findings of sharing personal information without separate consent.
- § 02 · ENFORCEMENT
CAC's 15 September 2026 Enforcement Typical Cases (执法典型案例) — Ten Cases, and the Four That Change How You Test
On 15 September 2026 the Cyberspace Administration of China (国家网信办) published ten enforcement typical cases (执法典型案例) across cybersecurity, data security and personal information protection. Six are the familiar perimeter failures — weak passwords, unpatched vulnerabilities, unauthorized-access holes, an app forcing unnecessary permissions. Four are new, and they are the ones that should change how compliance teams test: a Chongqing property company fined for running facial recognition on 5,000+ customers for marketing without separate consent, apparently the first public penalty to turn directly on PIPL Article 26; a Shanghai company fined for exporting personal information through a Windows desktop client with no data-export security assessment; a Sichuan company's WeChat mini-program ordered offline for failing to add explicit and implicit labels to AI-generated content; and a Jiangsu company warned for running two websites as an "API relay station" (API中转站) over third-party LLM APIs without a security assessment. DCC tables all ten from the CAC notice and reads the four against PIPL, the Cross-Border Data Flows Provisions, the AI Content Labeling Measures and the 2018 Security Assessment Provisions.
- § 03 · SPC
'Whoever Invests, Whoever Contributes, Whoever Benefits': The Supreme People's Court Explains Its First Data-Rights Guiding Cases
Full translation of the Q&A given by the head of the Supreme People's Court's Research Office on the 47th batch of guiding cases (Guiding Cases Nos. 262–267), the Court's first thematic batch on judicial protection of data rights and interests, released 28 August 2025 under Fa [2025] No. 150. Six questions. On the batch's character: the cases span unfair competition, tort, personal-information protection and enforcement, and — the point the Court presses hardest — they are guiding cases, not 'typical cases', so courts at every level shall refer to them and may cite them in the reasoning of a judgment. On the Data Twenty Articles: No. 262 protects the data processor's operational interest on a 'whoever invests, whoever contributes, whoever benefits' principle; No. 263 protects the data source subject's ability to move its own data between platforms; No. 264 protects the right to process and use data by refusing tort liability for a lawfully compiled price index. On the Anti-Unfair Competition Law: data disputes cluster in unfair competition because copyright cannot reach the operational interest in an aggregate — but from 15 October 2025 courts must apply the revised AUCL's dedicated data clause, Article 13(3), to this conduct. On personal information: Nos. 265 and 266 are a deliberate positive-and-negative pair on PIPL Article 13(1)(2) 'contractual necessity' — a login screen with no alternative is not voluntary consent; a credit check for an 'enjoy now, pay later' fare service is contractually necessary and minimally invasive. On enforcement: No. 267 holds that delivering a platform account means changing the real-name verification too, and that the applicant may ask the court to order the platform to make the change. Plus the Court's stated next steps.
- § 04 · SPC
Fa Fa [2026] No. 10: How the Supreme People's Court Explains Its First Adjudication Rules for AI Disputes
On 7 September 2026 the Supreme People's Court released the Opinions of the Supreme People's Court on Trying Cases Involving Artificial Intelligence Disputes in Accordance with Law (最高人民法院关于依法审理涉人工智能纠纷案件的意见), document number Fa Fa [2026] No. 10 (法发〔2026〕10号) — the first adjudication-rules document on AI from China's highest court. This brief translates the Court's own release note in full: the drafting background (the April 2025 Politburo study session, the 15th Five-Year Plan's call for rules on AI-generated output, the State Council's IP plan), the four drafting considerations (including the Court's statement that China has no dedicated AI law, so the Opinions work through the Civil Code, PIPL, Copyright Law, AUCL, Consumer Protection Law and Civil Procedure Law), and the part-by-part summary of the 24 articles. DCC then maps every article for overseas counsel — the fault-based default under Civil Code Art. 1165(1); the Article 4 rules on AI face-swapping, voice cloning and 'AI resurrection'; the Article 5 doxxing rule; Article 6 on training with lawfully public personal information; Article 7's notice-and-takedown rule for generative-AI providers; Article 8 injunctions; Article 9's physical-carrier limit on 'AI product'; Article 10 on algorithmic price discrimination and celebrity-impersonation fraud; Article 11 on autonomous and assisted driving; the IP articles 12–16 (training-data disclosure by developers, open-source exemption, AI-assisted inventions, technology contracts, data use under copyright, trade secrets and AUCL Art. 13); the procedure articles 17–20 (adverse inference, evidence review of AI output, sanctions for AI-fabricated evidence, the duty to verify and disclose AI-generated filings); and the working-mechanism articles 21–24 — and explains what a 法发 document is and is not.
- § 05 · SPC
'Inclusiveness Is Not Indulgence': The Supreme People's Court Takes Five Questions on Its AI Disputes Opinions
Full translation of the Supreme People's Court's press-conference Q&A on the Opinions on Trying Cases Involving Artificial Intelligence Disputes in Accordance with Law (关于依法审理涉人工智能纠纷案件的意见, Fa Fa [2026] No. 10), released 7 September 2026. Five questions, answered by the SPC's senior officials. On rights versus innovation: fault-based liability is the default to avoid over-burdening an early-stage industry, 'AI product' is strictly limited to products with a physical carrier (robots, autonomous cars — not AI services), training on lawfully public personal information is generally not an infringement, and algorithmic price discrimination and AI celebrity-impersonation fraud are actionable. On AI-generated content and IP: liability must match control capability and duty of care, a developer raising a non-infringement defense must produce training-data sources, training process and operating mode, and AI-enabled fake reviews and false advertising are unfair competition — while copyrightability of AI output and unlicensed training remain deliberately unaddressed. On personality rights: 'inclusiveness is not indulgence' — Article 4 on face-swapping, voice cloning and 'AI resurrection', Article 5 on doxxing, and Article 8 on personality-rights injunctions against providers. On the 'safe harbor': why Civil Code Article 1195's notice-and-takedown rule applies by analogy to generative-AI providers for both hallucinated and user-induced infringing output. On the courts themselves: AI-fabricated evidence, sham litigation, and the duty to verify and disclose AI-generated pleadings and case-search reports after courts found hallucinated case citations in filings.
- § 06 · COMPUTE-CENTERS
One Machine Room, Five Regulatory Identities: MaaS Compliance for China's AI Compute Centers
AnJie Broad partners Cai Hang and Yao Ting and associate Liu Zeqiang argue that the IDC-era compliance checklist no longer fits the AI compute center. Their thesis: one machine room now carries five regulatory identities at once — domestic IDC operator, cross-border AI service provider, service exporter under the Export Control Law, supplier of self-deployed model capability, and responsible entity for the agents it ships — each with its own logic, and each transmitting obligations to the others. The brief works through value-added telecom licensing (B11/B12), energy-conservation review and PUE caps, the continuing duties under the Regulation on Network Data Security Management (State Council Decree No. 790), the token-export exemptions in CAC Decree No. 16 and what they do not exempt, the territorial limits of the GenAI Interim Measures, the Export Control Law catch-all, the unsettled line between large-model filing (备案) and large-model registration (登记), open-weight license trigger clauses, and the criminal exposure that follows an agent's tool calls under Criminal Law Article 285.