---
title: "What the 15th Five-Year Informatization Plan Signals for AI and Data Compliance Through 2030"
author: "DCC Editorial"
published: 2026-10-26T12:00:00.000Z
url: https://datacompliancechina.com/posts/informatization-15th-fyp-ai-data-compliance-signals/
description: "数据何规 (What Rules for Data) reads the Central Cyberspace Affairs Commission's 15th Five-Year Plan for National Informatization, published October 23, 2026, for what it means for AI and data compliance over the next five years. Foundational AI legislation and judicial interpretations on AI and personal information are now formal tasks, though the law's name, form, and timing are not settled. On AI regulation, the plan pairs an unexplained 'optimization' of generative AI filing with a new security risk assessment system for applications in key sectors, and with assessment and filing for AI agents, on-device large models, and anthropomorphic services. The author reads that as a shift from model-level to use-level scrutiny. On data, the author reads cross-border facilitation as clearer boundaries and lower costs for the three existing export routes, not their abolition, and notes that it runs alongside the CAC's special inspections of data export. The plan also singles out personal information testing of smart devices and biometric information management. The author's bottom line: a plan creates no new obligations, but it marks where the next rules will land."
tags: ["five-year-plan", "ai-legislation", "ai-agents", "genai-filing", "cross-border-data", "smart-devices", "biometrics"]
laws_cited: ["national-informatization-15th-five-year-plan", "genai-services-interim-measures", "ai-agent-standardization-innovation-opinion", "ai-anthropomorphic-interaction-measures", "spc-ai-disputes-opinions", "cross-border-data-flows-provisions", "facial-recognition-technology-application-measures", "pipl"]
domains: ["ai-governance", "cross-border", "personal-information"]
account: "data-he-gui"
original_title: "从“十五五”规划，看未来五年AI与数据合规的变化"
original_author: "数据何规"
original_publication: "数据何规 WeChat Official Account"
original_url: "https://mp.weixin.qq.com/s/S_T1ACv81tnY7SYx_WRjsg"
source_language: "zh"
---

> **Source: Data Compliance China** — https://datacompliancechina.com/posts/informatization-15th-fyp-ai-data-compliance-signals/ · China data law, translated and annotated for overseas counsel. Cite as: Data Compliance China, "What the 15th Five-Year Informatization Plan Signals for AI and Data Compliance Through 2030", https://datacompliancechina.com/posts/informatization-15th-fyp-ai-data-compliance-signals/
> *Editor's Note — DCC.*
>
> On October 23, 2026, the CAC published the Central Cyberspace Affairs
> Commission's **15th Five-Year Plan for National Informatization**
> (国家信息化"十五五"规划), the master plan for China's digital build-out
> through 2030. DCC has translated it in full:
> [15th Five-Year Plan for National Informatization](/laws/national-informatization-15th-five-year-plan/).
> Most of its 14 pages are about infrastructure and industry. The passages
> that matter for compliance are Sections X and XI, Box 4 (AI agents), and
> Box 8 (cross-border data).
>
> This brief translates a reading of those passages published the next
> day by 数据何规 (What Rules for Data). The post names no author. Page
> numbers refer to the plan's official PDF. The author cites the CAC's
> first upload; DCC compared its text with the copy now on the page, and
> they are identical. Section headings and the order follow the original.
> Links to DCC pages are DCC's.

The *15th Five-Year Plan for National Informatization* runs to 14 pages and
covers artificial intelligence, information infrastructure, data security,
personal information protection, and more. Documents like this are heavy on
policy language, but a careful sift turns up a fair amount that AI and data
compliance practitioners should watch. In particular, foundational AI
legislation, related judicial interpretations, and assessment and filing for
new forms such as AI agents are now expressly listed as institution-building
tasks.[1]

These arrangements help us judge where the work will concentrate over the
next few years. Risk assessment of key applications and privacy protection
for smart devices are likely to tighten further. Cross-border
data will continue down the facilitation path. How generative AI filing will
be "optimized" remains to be seen. The plan itself does not create new
obligations for companies. Below, we read the original text against the
current rules to see which changes are worth studying ahead of time.

## I. AI legislation and judicial interpretations: the tasks are set

### 1. Foundational AI legislation deserves continued attention

> Advance foundational legislation on artificial intelligence, the digital
> economy, telecommunications, the prevention and control of cybercrime,
> combating cyber violence, and related areas. Strengthen legislative
> research in emerging fields such as autonomous driving and the
> low-altitude economy. Improve the systems of laws and regulations in
> cybersecurity, data security, personal information protection,
> informatization development, and related fields, and increase the supply
> of laws, regulations, and institutions for governing new technologies,
> new applications, and new business models.[1] (p. 13)

The line that matters most is "advance foundational legislation on
artificial intelligence". The State Council's 2026 Legislative Work Plan,
issued in May 2026, already called for accelerating comprehensive
legislation on the healthy development of AI. The national 15th Five-Year
Plan Outline also provides for algorithm filing, transparency management,
and security assessment, as well as rules on the ownership of rights in
generated outputs and on the allocation of rights and responsibilities
among developers, operators, and users.[2][3] The three documents
corroborate one another: comprehensive AI legislation is now a formal work
item. But the law's final name, form, and timing cannot yet be determined.

What deserves more attention is what the legislation sets out to solve.
Comprehensive legislation may add obligations; it may also clarify the
boundaries of liability and coordinate the existing regimes.

### 2. Judicial rules are developing too

> Focusing on hot issues such as AI, personal information protection, and
> online ecosystem governance, research and issue relevant judicial
> interpretations. Expand the building of foreign-related rule of law in the
> cyber field.[1] (p. 13)

This means that over the next few years, besides tracking administrative
rules, practitioners should watch how courts apply existing law. In
personal information processing, the relationship between consent and
contract, damages and the burden of proof, AI training data, and
infringement by generated content all merit continued study.

There has already been progress on the judicial side. In September 2026 the
Supreme People's Court issued its
[Opinions on Trying Cases Involving Artificial Intelligence Disputes in Accordance with Law](/laws/spc-ai-disputes-opinions/),
which address torts caused by AI hallucination, product defects, model
training, and other issues. That is a judicial document setting rules for
adjudication, and it should be distinguished from a "judicial
interpretation".[4] Filing does not resolve every liability question.
Practical measures such as product testing, risk warnings, and the handling
of anomalies may also bear on how liability is judged in a dispute.

## II. AI regulation: agents and specific applications move to the center

### 1. Filing optimization and application assessment proceed together

> Improve agile governance mechanisms for artificial intelligence, and
> strengthen the building of a cryptographic protection system for AI.
> Optimize the generative AI filing mechanism, establish a security risk
> assessment system for applications in key sectors, and improve assessment
> and filing for new forms such as AI agents, on-device large models, and
> anthropomorphic interaction services.[1] (p. 12)

This passage contains at least three tasks, and they cannot be merged into a
single verdict of "tightening" or "loosening". The text does not say how
generative AI filing will be optimized. But establishing assessment for
applications in key sectors, and improving assessment and filing for new
forms, show that regulators will pay more attention to what business a
model is used for and what operations it can perform. When the same model
is used for general Q&A, assisted diagnosis, or financial transactions, the
application risk cannot be explained by a single report on the underlying
model. The scope of the "key sectors", who carries out the assessment, and
the procedure must await specific rules.

The current regime already draws distinctions. The 2023
[Interim Measures for the Management of Generative Artificial Intelligence Services](/laws/genai-services-interim-measures/)
apply to services provided to the public within China; enterprises'
internal R&D and applications that are not provided to the public fall
outside them. Article 17 sets security-assessment and algorithm-filing
requirements for services with public opinion attributes or social
mobilization capacity.[5] An official announcement in September 2026 shows
that applications or features that directly call the capabilities of an
already-filed model are registered by local cyberspace administrations. The
filings in the same period already included on-device services on phones,
so "runs locally" cannot be read as "exempt from filing".[6]

Anthropomorphic interaction services also already have dedicated rules;
they are not only a matter for future study. The
[relevant measures](/laws/ai-anthropomorphic-interaction-measures/) took
effect in July 2026. They impose security assessment, algorithm filing, and
other requirements, while expressly excluding ordinary customer service,
knowledge Q&A, work assistants, and other services that involve no
sustained emotional interaction.[8] Whether they apply therefore turns on
actual functions, not on whether a product imitates a human tone. The
plan's "improve" should also be watched against the rules already in place.

### 2. Agents: identity, permissions, and tiered governance

> Advance mutual trust, interconnection, and interoperability among agents,
> and accelerate the development of multi-agent systems, agent swarms, and
> the like. Formulate needs guidelines for priority scenarios, build an
> evaluation system for agent technology maturity, and develop standards on
> agent identity identifiers and related matters.[1] (p. 6)

This can be read alongside the May 2026
[Implementation Opinions on the Standardized Application and Innovative Development of AI Agents](/laws/ai-agent-standardization-innovation-opinion/).
That document proposes exploring an agent registration platform that
provides digital identity, discovery, and capability-declaration services.
It also requires a distinction between decisions the user makes personally,
decisions made under authorization, and autonomous agent decisions, and
operations may not exceed the scope of the authorization. On governance,
sensitive fields and key industries are subject to filing, testing, and
similar measures, while some low-risk fields are governed through
self-testing, information reporting, and distribution-platform
management.[7] That is closer to the policy's intent than "uniform filing
for all agents": different scenarios may call for governance of different
intensity.

For enterprises that connect third-party agents, identity and authorization
will soon become practical problems. How does a platform confirm which
agent is calling, and which user it represents? Does one authorization
permit continuous reading of account data? Do payments or file deletions
require reconfirmation? Each of these involves a concrete mechanism.
Permissions, tool calls, logs, and risk interception are worth assessing in
advance. But controls should be proportionate to risk: requiring
confirmation at every step erodes the gains from automation, and keeping
full logs adds privacy and storage costs.

### 3. Adoption now has a quantified target

Page 2 of the plan lists the "adoption rate of new-generation smart
terminals, AI agents, and similar applications" as a main indicator: 40% in
2025, with a 2030 target above 90%. It is an anticipatory indicator, and it
bundles smart terminals, agents, and other applications together; it
cannot be read to mean that more than 90% of the population will use
standalone AI agents.[1] But it shows that the policy expectation is to
push these products into wide use, and the permission and privacy questions
that come with them may gradually become routine compliance matters for all
kinds of companies.

## III. Personal information and cross-border data: facilitation alongside supervision

### 1. The direction on cross-border facilitation is clear

> Promote and regulate cross-border data flows, and implement efficiently
> the data export security assessment, the personal information outbound
> standard contract, the personal information outbound certification, and
> related systems.[1] (p. 12)

Box 8 of the plan also provides for compliance guidelines in key
industries, negative lists in pilot free trade zones, and cross-border data
service centers offering policy interpretation, assistance with
declarations, and other services. This continues the direction of the 2024
[Provisions on Promoting and Regulating Cross-border Data Flows](/laws/cross-border-data-flows-provisions/):
reducing or waiving procedures for qualifying activities and making the
regime more efficient to run.[9] Further facilitation is more likely to
take the form of clearer boundaries of application and lower handling
costs. The three existing mechanisms are not abolished by the plan.

Facilitation does not mean companies can ignore their actual data flows,
however. An official CAC report in March 2026 described simplified
materials and progress on negative lists on the one hand; on the other, it
expressly announced special inspections of data export by key enterprises
and institutions.[10] Companies should reassess which of their businesses
qualify for exemptions, and verify specific activities such as overseas
access, API calls, and log uploads. Exemption from export procedures does
not exempt a company from the personal information protection and security
obligations that otherwise apply by law. Being able to judge exemptions
accurately, and to explain how business changes affect the conditions for
them, will be of more lasting value than knowing the filing templates.

### 2. Smart devices and biometric information are singled out

> Strengthen personal information protection testing and assessment of
> smart devices, and strengthen management of the technical application of
> biometric feature information.[1] (p. 12)

AI glasses, wearables, smart-home products, and similar devices push
personal information processing further beyond the filling-in, clicking,
and uploading of a traditional app. A device may capture the images and
voices of bystanders, who may never get a chance to see a notice or make a
choice; and the purchaser's consent does not by itself settle the
lawfulness of the manufacturer's processing of that information. The plan
does not directly create a new, unified testing procedure, but it expressly
names device testing and assessment and the management of biometric
applications. The standards and supervisory practice that follow deserve
close tracking.

Existing rules already provide a basis for constraint. The
[Personal Information Protection Law](/laws/pipl/) sets strict conditions
for sensitive personal information such as biometrics, and the dedicated
[facial recognition measures](/laws/facial-recognition-technology-application-measures/)
further require necessity assessments and alternative verification methods,
and set requirements, with exceptions, on on-device storage and internet
transmission.[11][12] A specific product still has to separate ordinary
photography, identity recognition, inference about a person's state, upload
for analysis, and reuse for training, each under its own rules. On-device
processing can reduce some transmission risk, but it does not by itself
cure over-collection, and it may involve trade-offs in battery life,
computing power, and performance.

AI legislation and judicial liability rules, assessment of applications in
key sectors, governance of agent permissions, privacy protection for smart
devices, and the actual application of cross-border facilitation policy
will be the priorities.

## References

1. *15th Five-Year Plan for National Informatization* (国家信息化"十五五"规划), official CAC PDF, 14 pages; pages 2, 6, 12, and 13 cited. https://www.cac.gov.cn/rootimages/uploadimg/1794509046730333/1794509046730333.pdf
2. *Notice of the General Office of the State Council on Issuing the State Council's 2026 Legislative Work Plan* (国办发〔2026〕14号), May 8, 2026, Part II; text as reposted on the Ministry of Ecology and Environment website. https://www.mee.gov.cn/zcwj/gwywj/202605/t20260514_1152263.shtml
3. *Outline of the 15th Five-Year Plan for National Economic and Social Development of the People's Republic of China*, Chapter 14, Section 2; full text as published on the Ministry of Education website, March 14, 2026. https://www.moe.gov.cn/jyb_xwfb/xw_zt/moe_357/2026/2026_zt03/yw/202603/t20260314_1430877.html
4. Supreme People's Court, release of the *Opinions on Trying Cases Involving Artificial Intelligence Disputes in Accordance with Law* (法发〔2026〕10号), September 7, 2026, with the document. https://www.court.gov.cn/zixun/xiangqing/511101.html
5. *Interim Measures for the Management of Generative Artificial Intelligence Services*, published July 13, 2023, effective August 15, 2023, Articles 2 and 17. https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm
6. CAC, *Announcement on Publishing Information on Filed Generative AI Services (July–August 2026)*, September 14, 2026. https://www.cac.gov.cn/2026-09/14/c_1791136833136332.htm
7. *Implementation Opinions on the Standardized Application and Innovative Development of AI Agents*, CAC, NDRC, and MIIT, published May 8, 2026, items 4, 6, and 11. https://www.cac.gov.cn/2026-05/08/c_1779979789523320.htm
8. *Interim Measures for the Management of AI Anthropomorphic Interaction Services*, published April 10, 2026, effective July 15, 2026, Articles 2, 22, and 26. https://www.cac.gov.cn/2026-04/10/c_1777558395078289.htm
9. *Provisions on Promoting and Regulating Cross-border Data Flows*, published and effective March 22, 2024, Articles 2–11. https://www.cac.gov.cn/2024-03/22/c_1712776611775634.htm
10. CAC, *Two Years of the Provisions on Promoting and Regulating Cross-border Data Flows: Data Export Security Management Reaches a New Level*, March 23, 2026. https://www.cac.gov.cn/2026-03/23/c_1775999628849905.htm
11. *Personal Information Protection Law of the People's Republic of China*, adopted August 20, 2021, effective November 1, 2021, Articles 13, 28–30, 38–39, and 55–56; full text on the SAMR website. https://www.samr.gov.cn/zw/zfxxgk/fdzdgknr/bgt/art/2023/art_f374e8245320413181742e6d1baf4366.html
12. *Administrative Measures for the Application Security of Facial Recognition Technology*, published March 21, 2025, effective June 1, 2025, Articles 2, 4, 8–10, and 19. https://www.cac.gov.cn/2025-03/21/c_1744174262156096.htm

---

— *数据何规 (What Rules for Data), 从"十五五"规划，看未来五年AI与数据合规的变化
(What the 15th Five-Year Plan Says About Changes in AI and Data Compliance
Over the Next Five Years), October 24, 2026.
[Original (Chinese).](https://mp.weixin.qq.com/s/S_T1ACv81tnY7SYx_WRjsg)*

— Not legal advice.