What the 15th Five-Year Informatization Plan Signals for AI and Data Compliance Through 2030

Editor’s Note — DCC.

On October 23, 2026, the CAC published the Central Cyberspace Affairs Commission’s 15th Five-Year Plan for National Informatization (国家信息化”十五五”规划), the master plan for China’s digital build-out through 2030. DCC has translated it in full: 15th Five-Year Plan for National Informatization. Most of its 14 pages are about infrastructure and industry. The passages that matter for compliance are Sections X and XI, Box 4 (AI agents), and Box 8 (cross-border data).

This brief translates a reading of those passages published the next day by 数据何规 (What Rules for Data). The post names no author. Page numbers refer to the plan’s official PDF. The author cites the CAC’s first upload; DCC compared its text with the copy now on the page, and they are identical. Section headings and the order follow the original. Links to DCC pages are DCC’s.

The 15th Five-Year Plan for National Informatization runs to 14 pages and covers artificial intelligence, information infrastructure, data security, personal information protection, and more. Documents like this are heavy on policy language, but a careful sift turns up a fair amount that AI and data compliance practitioners should watch. In particular, foundational AI legislation, related judicial interpretations, and assessment and filing for new forms such as AI agents are now expressly listed as institution-building tasks.[1]

These arrangements help us judge where the work will concentrate over the next few years. Risk assessment of key applications and privacy protection for smart devices are likely to tighten further. Cross-border data will continue down the facilitation path. How generative AI filing will be “optimized” remains to be seen. The plan itself does not create new obligations for companies. Below, we read the original text against the current rules to see which changes are worth studying ahead of time.

I. AI legislation and judicial interpretations: the tasks are set

1. Foundational AI legislation deserves continued attention

Advance foundational legislation on artificial intelligence, the digital economy, telecommunications, the prevention and control of cybercrime, combating cyber violence, and related areas. Strengthen legislative research in emerging fields such as autonomous driving and the low-altitude economy. Improve the systems of laws and regulations in cybersecurity, data security, personal information protection, informatization development, and related fields, and increase the supply of laws, regulations, and institutions for governing new technologies, new applications, and new business models.[1] (p. 13)

The line that matters most is “advance foundational legislation on artificial intelligence”. The State Council’s 2026 Legislative Work Plan, issued in May 2026, already called for accelerating comprehensive legislation on the healthy development of AI. The national 15th Five-Year Plan Outline also provides for algorithm filing, transparency management, and security assessment, as well as rules on the ownership of rights in generated outputs and on the allocation of rights and responsibilities among developers, operators, and users.[2][3] The three documents corroborate one another: comprehensive AI legislation is now a formal work item. But the law’s final name, form, and timing cannot yet be determined.

What deserves more attention is what the legislation sets out to solve. Comprehensive legislation may add obligations; it may also clarify the boundaries of liability and coordinate the existing regimes.

2. Judicial rules are developing too

Focusing on hot issues such as AI, personal information protection, and online ecosystem governance, research and issue relevant judicial interpretations. Expand the building of foreign-related rule of law in the cyber field.[1] (p. 13)

This means that over the next few years, besides tracking administrative rules, practitioners should watch how courts apply existing law. In personal information processing, the relationship between consent and contract, damages and the burden of proof, AI training data, and infringement by generated content all merit continued study.

There has already been progress on the judicial side. In September 2026 the Supreme People’s Court issued its Opinions on Trying Cases Involving Artificial Intelligence Disputes in Accordance with Law, which address torts caused by AI hallucination, product defects, model training, and other issues. That is a judicial document setting rules for adjudication, and it should be distinguished from a “judicial interpretation”.[4] Filing does not resolve every liability question. Practical measures such as product testing, risk warnings, and the handling of anomalies may also bear on how liability is judged in a dispute.

II. AI regulation: agents and specific applications move to the center

1. Filing optimization and application assessment proceed together

Improve agile governance mechanisms for artificial intelligence, and strengthen the building of a cryptographic protection system for AI. Optimize the generative AI filing mechanism, establish a security risk assessment system for applications in key sectors, and improve assessment and filing for new forms such as AI agents, on-device large models, and anthropomorphic interaction services.[1] (p. 12)

This passage contains at least three tasks, and they cannot be merged into a single verdict of “tightening” or “loosening”. The text does not say how generative AI filing will be optimized. But establishing assessment for applications in key sectors, and improving assessment and filing for new forms, show that regulators will pay more attention to what business a model is used for and what operations it can perform. When the same model is used for general Q&A, assisted diagnosis, or financial transactions, the application risk cannot be explained by a single report on the underlying model. The scope of the “key sectors”, who carries out the assessment, and the procedure must await specific rules.

The current regime already draws distinctions. The 2023 Interim Measures for the Management of Generative Artificial Intelligence Services apply to services provided to the public within China; enterprises’ internal R&D and applications that are not provided to the public fall outside them. Article 17 sets security-assessment and algorithm-filing requirements for services with public opinion attributes or social mobilization capacity.[5] An official announcement in September 2026 shows that applications or features that directly call the capabilities of an already-filed model are registered by local cyberspace administrations. The filings in the same period already included on-device services on phones, so “runs locally” cannot be read as “exempt from filing”.[6]

Anthropomorphic interaction services also already have dedicated rules; they are not only a matter for future study. The relevant measures took effect in July 2026. They impose security assessment, algorithm filing, and other requirements, while expressly excluding ordinary customer service, knowledge Q&A, work assistants, and other services that involve no sustained emotional interaction.[8] Whether they apply therefore turns on actual functions, not on whether a product imitates a human tone. The plan’s “improve” should also be watched against the rules already in place.

2. Agents: identity, permissions, and tiered governance

Advance mutual trust, interconnection, and interoperability among agents, and accelerate the development of multi-agent systems, agent swarms, and the like. Formulate needs guidelines for priority scenarios, build an evaluation system for agent technology maturity, and develop standards on agent identity identifiers and related matters.[1] (p. 6)

This can be read alongside the May 2026 Implementation Opinions on the Standardized Application and Innovative Development of AI Agents. That document proposes exploring an agent registration platform that provides digital identity, discovery, and capability-declaration services. It also requires a distinction between decisions the user makes personally, decisions made under authorization, and autonomous agent decisions, and operations may not exceed the scope of the authorization. On governance, sensitive fields and key industries are subject to filing, testing, and similar measures, while some low-risk fields are governed through self-testing, information reporting, and distribution-platform management.[7] That is closer to the policy’s intent than “uniform filing for all agents”: different scenarios may call for governance of different intensity.

For enterprises that connect third-party agents, identity and authorization will soon become practical problems. How does a platform confirm which agent is calling, and which user it represents? Does one authorization permit continuous reading of account data? Do payments or file deletions require reconfirmation? Each of these involves a concrete mechanism. Permissions, tool calls, logs, and risk interception are worth assessing in advance. But controls should be proportionate to risk: requiring confirmation at every step erodes the gains from automation, and keeping full logs adds privacy and storage costs.

3. Adoption now has a quantified target

Page 2 of the plan lists the “adoption rate of new-generation smart terminals, AI agents, and similar applications” as a main indicator: 40% in 2025, with a 2030 target above 90%. It is an anticipatory indicator, and it bundles smart terminals, agents, and other applications together; it cannot be read to mean that more than 90% of the population will use standalone AI agents.[1] But it shows that the policy expectation is to push these products into wide use, and the permission and privacy questions that come with them may gradually become routine compliance matters for all kinds of companies.

III. Personal information and cross-border data: facilitation alongside supervision

1. The direction on cross-border facilitation is clear

Promote and regulate cross-border data flows, and implement efficiently the data export security assessment, the personal information outbound standard contract, the personal information outbound certification, and related systems.[1] (p. 12)

Box 8 of the plan also provides for compliance guidelines in key industries, negative lists in pilot free trade zones, and cross-border data service centers offering policy interpretation, assistance with declarations, and other services. This continues the direction of the 2024 Provisions on Promoting and Regulating Cross-border Data Flows: reducing or waiving procedures for qualifying activities and making the regime more efficient to run.[9] Further facilitation is more likely to take the form of clearer boundaries of application and lower handling costs. The three existing mechanisms are not abolished by the plan.

Facilitation does not mean companies can ignore their actual data flows, however. An official CAC report in March 2026 described simplified materials and progress on negative lists on the one hand; on the other, it expressly announced special inspections of data export by key enterprises and institutions.[10] Companies should reassess which of their businesses qualify for exemptions, and verify specific activities such as overseas access, API calls, and log uploads. Exemption from export procedures does not exempt a company from the personal information protection and security obligations that otherwise apply by law. Being able to judge exemptions accurately, and to explain how business changes affect the conditions for them, will be of more lasting value than knowing the filing templates.

2. Smart devices and biometric information are singled out

Strengthen personal information protection testing and assessment of smart devices, and strengthen management of the technical application of biometric feature information.[1] (p. 12)

AI glasses, wearables, smart-home products, and similar devices push personal information processing further beyond the filling-in, clicking, and uploading of a traditional app. A device may capture the images and voices of bystanders, who may never get a chance to see a notice or make a choice; and the purchaser’s consent does not by itself settle the lawfulness of the manufacturer’s processing of that information. The plan does not directly create a new, unified testing procedure, but it expressly names device testing and assessment and the management of biometric applications. The standards and supervisory practice that follow deserve close tracking.

Existing rules already provide a basis for constraint. The Personal Information Protection Law sets strict conditions for sensitive personal information such as biometrics, and the dedicated facial recognition measures further require necessity assessments and alternative verification methods, and set requirements, with exceptions, on on-device storage and internet transmission.[11][12] A specific product still has to separate ordinary photography, identity recognition, inference about a person’s state, upload for analysis, and reuse for training, each under its own rules. On-device processing can reduce some transmission risk, but it does not by itself cure over-collection, and it may involve trade-offs in battery life, computing power, and performance.

AI legislation and judicial liability rules, assessment of applications in key sectors, governance of agent permissions, privacy protection for smart devices, and the actual application of cross-border facilitation policy will be the priorities.

References

1. 15th Five-Year Plan for National Informatization (国家信息化”十五五”规划), official CAC PDF, 14 pages; pages 2, 6, 12, and 13 cited. https://www.cac.gov.cn/rootimages/uploadimg/1794509046730333/1794509046730333.pdf
2. Notice of the General Office of the State Council on Issuing the State Council’s 2026 Legislative Work Plan (国办发〔2026〕14号), May 8, 2026, Part II; text as reposted on the Ministry of Ecology and Environment website. https://www.mee.gov.cn/zcwj/gwywj/202605/t20260514_1152263.shtml
3. Outline of the 15th Five-Year Plan for National Economic and Social Development of the People’s Republic of China, Chapter 14, Section 2; full text as published on the Ministry of Education website, March 14, 2026. https://www.moe.gov.cn/jyb_xwfb/xw_zt/moe_357/2026/2026_zt03/yw/202603/t20260314_1430877.html
4. Supreme People’s Court, release of the Opinions on Trying Cases Involving Artificial Intelligence Disputes in Accordance with Law (法发〔2026〕10号), September 7, 2026, with the document. https://www.court.gov.cn/zixun/xiangqing/511101.html
5. Interim Measures for the Management of Generative Artificial Intelligence Services, published July 13, 2023, effective August 15, 2023, Articles 2 and 17. https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm
6. CAC, Announcement on Publishing Information on Filed Generative AI Services (July–August 2026), September 14, 2026. https://www.cac.gov.cn/2026-09/14/c_1791136833136332.htm
7. Implementation Opinions on the Standardized Application and Innovative Development of AI Agents, CAC, NDRC, and MIIT, published May 8, 2026, items 4, 6, and 11. https://www.cac.gov.cn/2026-05/08/c_1779979789523320.htm
8. Interim Measures for the Management of AI Anthropomorphic Interaction Services, published April 10, 2026, effective July 15, 2026, Articles 2, 22, and 26. https://www.cac.gov.cn/2026-04/10/c_1777558395078289.htm
9. Provisions on Promoting and Regulating Cross-border Data Flows, published and effective March 22, 2024, Articles 2–11. https://www.cac.gov.cn/2024-03/22/c_1712776611775634.htm
10. CAC, Two Years of the Provisions on Promoting and Regulating Cross-border Data Flows: Data Export Security Management Reaches a New Level, March 23, 2026. https://www.cac.gov.cn/2026-03/23/c_1775999628849905.htm
11. Personal Information Protection Law of the People’s Republic of China, adopted August 20, 2021, effective November 1, 2021, Articles 13, 28–30, 38–39, and 55–56; full text on the SAMR website. https://www.samr.gov.cn/zw/zfxxgk/fdzdgknr/bgt/art/2023/art_f374e8245320413181742e6d1baf4366.html
12. Administrative Measures for the Application Security of Facial Recognition Technology, published March 21, 2025, effective June 1, 2025, Articles 2, 4, 8–10, and 19. https://www.cac.gov.cn/2025-03/21/c_1744174262156096.htm

— 数据何规 (What Rules for Data), 从”十五五”规划，看未来五年AI与数据合规的变化 (What the 15th Five-Year Plan Says About Changes in AI and Data Compliance Over the Next Five Years), October 24, 2026. Original (Chinese).

— Not legal advice.