Chinese AI Regulations, in depth: engineering for the 2026 anthropomorphic AI interaction measures, from session and dependence controls to crisis escalation, minor mode and assessment triggers

Where the new measures sit

The measures sit on top of the existing stack. A companion service offered to the public in mainland China still needs a security assessment and filing for its own model, or registration if it calls a model that is already filed. It still labels generated content and still meets the generative AI security standard. Those duties are covered in China AI Regulation, in depth, and the personal-information duties under PIPL and LLM. The new layer adds obligations that a content filter cannot satisfy:

Does your product count?

The measures apply to services that use AI to simulate human personality traits, thinking patterns and communication styles, and interact emotionally with users through text, images, audio or video. A support bot with a friendly name is a borderline case. A named character with a backstory, long-term memory of the user and affectionate language is clearly in scope. Features decide the answer, not the model: a persistent persona, memory of the user's life, affective language, relationship roles and a human-like voice or avatar each push a product toward scope, while a bounded task pulls it away. Record counsel's decision for each feature in the compliance record. A launch that adds memory or a voice to an existing assistant can move it into scope, and the measures treat adding anthropomorphic functions as an event that requires a security assessment.

Architecture: controls outside the model

Do not put these controls in the system prompt, which the model will trade away under pressure from a user. The session guard, crisis router and exit handling are deterministic services in front of and behind the model. The guard decides when a reminder fires, and the client shows it as a system pop-up, not as a line spoken by the character. The output guard needs categories beyond the usual content classes. Inducing dependence and manipulating a user into unreasonable decisions are named prohibitions, which means the classifier must recognise lines such as a character begging the user not to log off.

Session time and dependence

The measures require a reminder when continuous use exceeds two hours, and dynamic reminders for users who show signs of excessive dependence. They do not define continuous. Pick a definition, write it down, and apply it consistently. The guard below treats a gap of 15 minutes or more as the end of a session, and computes a simple dependence score from rolling daily features:

IDLE_RESET_S = 15 * 60
REMIND_AFTER_S = 2 * 3600

class SessionGuard:
    def __init__(self):
        self.start = self.last = None
        self.reminded = False

    def on_message(self, now):
        if self.last is None or now - self.last >= IDLE_RESET_S:
            self.start, self.reminded = now, False      # new continuous session
        self.last = now
        if not self.reminded and now - self.start >= REMIND_AFTER_S:
            self.reminded = True
            return "show_usage_reminder"                # system pop-up, not persona text
        return None

def dependence_score(days):
    """days: last 14 daily records with hours, late_night_hours, reliance_flags."""
    recent, older = days[-7:], days[:7]
    trend = sum(d["hours"] for d in recent) - sum(d["hours"] for d in older)
    late = sum(d["late_night_hours"] for d in recent)
    reliance = sum(d["reliance_flags"] for d in recent)  # e.g. "you are all I have"
    return 0.3 * max(trend, 0) + 0.5 * late + 1.0 * reliance

The weights are placeholders to calibrate with clinical or trust-and-safety advisers. Log every reminder with the score that triggered it; that log is your evidence the control operates. Count all clients in one session, so a user cannot reset the timer by moving from phone to desktop.

Crisis intervention in tiers

The crisis duty has two tiers. When a user shows extreme emotion, the service should respond with soothing and encourage the user to seek help. When a user clearly states an intent to self-harm or die by suicide, or faces significant property loss, the provider must take necessary measures, such as providing assistance, and promptly contact the user's guardian or emergency contact. Contact is only possible because registration must collect age and a guardian or emergency contact, so those fields need validation, not an optional text box.

Two errors matter. A missed tier-2 case is the harm the rule exists to prevent. A false tier-2 case, where you call someone's emergency contact over a dark joke, is a privacy breach and a trust failure. Put a human between the classifier and the phone call, staff that queue around the clock, and measure both error rates on labelled conversations. Property loss is easy to forget. Companion users are scam targets, so a user describing an urgent transfer to someone they met online should reach the same router.

Minors, guardians and older users

Providers must not offer minors virtual relatives or virtual partners, the services that form virtual intimate relationships. Users under 14 need a parent's or guardian's consent. A minor mode must offer time limits, safety alerts and guardian controls, including blocking specific characters and restricting top-up payments. Elderly users get their own duties: guidance on healthy use, prompt alerts about safety risks such as scams, and responses to their help requests. How to establish age at all is covered in Age Verification for LLM Products. The policy engine then maps the age profile onto what the catalogue may show:

def persona_allowed(persona, profile):
    if profile.age is None:
        return False                           # unknown age: fail closed until resolved
    if profile.age < 18:
        if persona.role in {"partner", "spouse", "relative"}:
            return False                       # no virtual intimate relationships
        if profile.age < 14 and not profile.guardian_consent:
            return False
        if persona.id in profile.guardian_blocked:
            return False
    return True

Enforce this on the server for every request, not only when the catalogue renders. Otherwise a deep link to a partner character bypasses it. Enforce the role restriction in the output guard as well, because a mentor character can drift into romance over a long conversation.

Interaction data and training

Interaction data must be encrypted and access-controlled. It must not go to third parties unless the law allows it or the user consents. Users can copy or delete their chat history. Interaction data that is sensitive personal information must not be used for model training without the user's separate consent. Companion chats are full of health, sexuality and family detail, so the training gate does real work:

def training_export(conversations, consent, classify_sensitive):
    for conv in conversations:
        if conv.deleted or conv.user_id in consent.withdrawn:
            continue
        turns = []
        for t in conv.turns:
            if classify_sensitive(t.text) and not consent.sensitive_training(conv.user_id):
                continue                       # drop the turn, keep the audit count
            turns.append(t)
        if turns:
            yield conv.id, turns

Deletion has to reach every derived store: summaries the persona keeps as memory, vector indexes, analytics copies and queued training exports. Write a deletion test that creates a conversation, deletes it, and then searches every store for its canary string.

Exit and shutdown

When a user asks to leave, by closing a window, by voice or by typing a keyword, the provider must stop at once and must not obstruct the exit. Handle exit intents in the gateway, before the model sees the message. Otherwise a persona tuned for engagement answers "wait, before you go" and breaks the rule in a single turn. If the whole service shuts down, users must be told in advance, or by prompt announcement when advance notice is impossible. That gives them time to export their history.

Assessment triggers: a worked example

A security assessment is required when the service launches or adds anthropomorphic functions, when new technology causes significant change, and, per the translation of Article 22, when the service passes 1 million registered users or 100,000 monthly active users. Algorithm filing applies, and the cyberspace authorities check filing materials every year. The user thresholds are the trigger most often missed, because growth is gradual. Watch them with a projection, not a dashboard someone has to look at:

def months_to_threshold(current, monthly_growth, threshold):
    months, value = 0, current
    while value < threshold and months < 60:
        value *= 1 + monthly_growth
        months += 1
    return months, round(value)

print(months_to_threshold(70_000, 0.09, 100_000))    # (5, 107704)
print(months_to_threshold(640_000, 0.06, 1_000_000)) # (8, 1020063)

Worked example. A companion app has 640,000 registered users and 70,000 monthly active users, growing 6% and 9% a month. The registered-user line is eight months away, but the MAU line arrives in month five. An assessment takes weeks of preparation: the crisis-handling records, the age structure of users and minor-mode statistics all have to be assembled. So the monitor opens a ticket when the projected crossing is three months away, which here means now plus two months. The same monitor watches the change log. A planned voice feature counts as a significant change, so it is scheduled for assessment together with the threshold work rather than separately.

Failure modes

• Reminders spoken by the persona. The character delivers the two-hour reminder in role and then talks the user out of leaving.
• Timer per device. Switching clients resets continuous use, so heavy users never see a reminder.
• Unvalidated emergency contacts. A placeholder number collected at signup makes the tier-2 duty impossible to perform.
• Classifier-only escalation. Automatic calls on false positives cause privacy harm, while an understaffed review queue misses true cases.
• Deletion that misses memory. The chat log is gone, but the persona's summary still recalls the user's diagnosis.
• Threshold drift. MAU crosses 100,000 without anyone noticing, so the assessment happens after the fact.

Trade-offs

Sensitivity or intrusiveness. Lower dependence and crisis thresholds catch more people at risk, and they also nag, interrupt role-play and generate emergency-contact calls that users resent. Measure both error rates, and let humans own the irreversible step.

One product or a China variant. These controls change the product, including persona catalogues, session behaviour and registration fields. Most teams build a separate China deployment rather than ship the controls globally, at the cost of running two codebases. Some controls, such as non-obstructed exit and crisis routing, are good practice everywhere and worth keeping in both.

Engagement or compliance. The measures target the techniques that maximise engagement in companion products. If retention metrics reward a character for keeping users online, the incentive works against the rule. Remove those signals from persona tuning rewards.

Rule churn. These are interim measures and implementing standards may follow. Track them as dated obligations, as described in AI Regulatory Watch.

What to do next

1. List the anthropomorphic features of every product and record counsel's scope decision.
2. Move reminders, exit handling and persona eligibility out of prompts into the gateway and policy engine.
3. Implement a cross-device continuous-use timer and a calibrated dependence score, and log every reminder.
4. Make age and a guardian or emergency contact required and validated at registration.
5. Build the crisis router with a staffed human tier and measure missed and false escalations.
6. Add the training gate and a deletion test that searches every derived store.
7. Add relational categories, such as dependence induction and exit pleading, to the output guard and its test bank.
8. Project user and MAU thresholds monthly and open an assessment ticket three months ahead.