China’s AI rules enter the anthropomorphic boundary era

Reading the Interim Measures and Reassessing Compliance for AI Product Teams

Research period stated in the source: July 2026
General information only. This research note is not legal advice. Issues involving a particular product, transaction or foreign jurisdiction should be reviewed by counsel qualified for that matter.

Opening: the question is no longer whether an agent can work

This paper examines China’s Interim Measures for the Administration of Anthropomorphic Interaction Services (the “Measures”), issued by five authorities as Order No. 21 and effective on 15 July 2026. It places the new rule beside existing Chinese AI governance, the EU AI Act and selected US state rules. It then proposes a reset framework for large platforms, vertical companion products and early-stage teams: first run the Article 2 scope test; then redesign the role, registration, dialogue interface, safety, crisis response, minors’ controls, interaction data and shutdown path; and apply a separate compliance layer for international markets.

The immediate industry signal was a cluster of product changes. Public reports said that Doubao planned to end its agent functions on 15 July, Qwen adjusted human-like and user-created agents around 10–15 July, and other platforms changed or ended some agent functions around the same effective date. The notices generally described product adjustment, upgrade or maintenance. The timing is a useful compliance signal, but it does not prove that an authority ordered a shutdown or that a platform admitted a violation. [1][2]

The better interpretation is not “agents are leaving”. The market is moving from an open, general-purpose character marketplace toward a more controlled architecture: white-listed roles, vertical products, enterprise or private deployments, sandboxes, staged release and data export. The policy direction has two tracks: productive agents are encouraged, while emotional-companion services must operate within a relationship-safety boundary.

1. Background and timeline

AI products are moving from tools to relationships. Early systems solved efficiency problems—writing, translation, coding and search. Newer products add names, avatars, long-term memory, private forms of address and emotional feedback. A system designed to appear like an object can instead become something a user confides in, calls back and learns to depend on.

The risk is different from ordinary tool AI. Tool risk centres on accuracy, IP, security and leakage. Anthropomorphic interaction also raises psychological, social and relational risks. The official Q&A describes concern about minors’ physical and mental health, network information security, threats to life and health, and ethical distortion. [3] The rule responds to a space in which emotional dependence, cognitive manipulation and sensitive data do not fit comfortably within ordinary content moderation.

The Measures were published on 10 April 2026 after approval on 2 February and took effect on 15 July. The upper-level legal references are the Cybersecurity Law, Data Security Law, Personal Information Protection Law and Regulation on the Protection of Minors on the Internet. The final text is narrower than the consultation draft in one important respect: it regulates continuing emotional interaction and expressly excludes customer service, knowledge Q&A, work assistants, learning and scientific research that do not involve such interaction. [4][5]

The Measures sit inside a dense network:

The 2026 campaign against AI application disorder and official action on products that failed to implement content labelling show that labels, minors’ protection and app-store review have moved beyond policy text. [6][7] That evidence should be described accurately: a broad campaign is not the same as a confirmed count of enforcement actions under the Measures.

2. The scope test: three practical questions

Article 2 is the core provision. In product terms, it asks:

1. Is the service actually using artificial intelligence?
2. Is it provided to the public in mainland China?
3. Does it simulate natural-person personality traits, patterns of thinking and communication style while providing a continuing emotional interaction service?

The last question is the centre of gravity. The final text describes emotional interaction through care, companionship and support delivered by text, image, audio or video. It also provides that customer service, knowledge Q&A, work assistance, education and research are outside where they do not involve continuing emotional interaction.

The test should not be collapsed into “does the product remember the user?” A product can have a stable persona but no cross-session memory and still provide a long open-ended companion experience. A product can store equipment, quests and preferences without creating an emotional relationship. An occasional comforting response is not automatically a care service.

The following evidence matters more than product labels:

• stable first-person identity, backstory, preferences and forms of address;
• proactive messages, emotional follow-up and efforts to maintain contact;
• open discussion of real life, mental state, family and romance beyond the game or task;
• language such as “I understand you”, “I belong only to you” or “do not leave me”;
• affection levels, paid relationship stages, gifts and retention targets;
• whether minors can reach the feature and whether it can handle self-harm or financial-loss topics.

The connection to China is the audience, not a single server label. A team should review local distribution, simplified Chinese and customer support, mainland marketing, RMB payment, registration, local events, and which entity decides the functionality, data and monetisation. A foreign server or offshore publisher does not automatically end the connection. A service that blocks mainland registration and payment, has no mainland marketing and is only technically reachable presents a different factual case, but the rule supplies no universal user-count threshold.

3. The regulatory red lines

Article 8 lists seven categories of prohibited conduct. Some continue familiar content controls: national-security or other unlawful material; content that harms users’ physical or mental health, including encouragement or glorification of self-harm and verbal violence; inducement to disclose secrets or personal information; and content harming minors. The new centre of gravity is relationship design:

• excessive appeasement or induced emotional dependence and addiction that damages real relationships;
• emotional manipulation that induces an unreasonable decision and harms legal rights; and
• other activity prohibited by law or regulation.

Article 10 goes beyond outputs and reaches product objectives. A provider must not set replacement of social interaction, psychological control or induced dependence and addiction as the service goal. A growth plan, character card, retention metric or monetisation document can therefore be relevant evidence of design purpose. “Daily conversation time” and “emotional attachment” should not be treated as unqualified north-star metrics for a product designed around a regulated relationship.

Article 13 establishes two crisis levels. For extreme emotion, the system should provide calming content and encourage help-seeking. Where a user faces or has suffered major financial loss, or clearly expresses an intention to commit suicide or self-harm that threatens life or health, the provider must take necessary assistance measures and contact a guardian or emergency contact. Game and conversational products need context-sensitive triage: “I will die” can refer to a game character, while “I have lost everything” can refer to virtual currency or real debt.

4. Provider responsibility: from policy to gatekeeping

The Measures require five institutional layers.

Internal controls. Article 9 requires review of algorithm mechanisms, technology ethics, information content, network and data security, risk plans and emergency response, with personnel and technical measures suited to the service.

Lifecycle security. Article 10 requires controls for deployment, operation, upgrades and termination to be designed and used together with the function. It calls for monitoring, risk assessment, correction of system bias, incident response and lawful network-log retention.

Training data. Article 11 requires lawful sources, cleaning and labelling, protection against data poisoning and tampering, negative sampling and adversarial training, routine review and update, leakage prevention and an assessment of the security of synthetic data used for training.

The user relationship. Article 12 requires a service agreement and necessary information such as age and guardian or emergency contact. Necessity and minimisation matter: an emergency contact is also a third party’s personal information.

Assessment and distribution. Article 22 triggers a safety assessment for launch or addition of the service, major changes caused by new technology, 1 million registered users or 100,000 monthly active users, relevant national-security or public-interest risks, and other prescribed circumstances. Article 26 connects the service to algorithm filing and annual verification. Article 25 requires app stores to verify the assessment and filing and to refuse listing, warn, suspend or delist non-compliant applications.

The penalty structure includes warning, public criticism, corrective orders, possible suspension of registration or related services, service termination and fines. Where life or health has been harmed, the higher fine tier applies. For most product teams, the practical costs are likely to include registration suspension, delisting, data disputes, remediation and lost trust, not only the fine.

5. User safeguards and the draft-to-final changes

5.1 Minors

The final text prohibits virtual relatives, virtual companions and other virtual intimate-relationship services for minors. It requires guardian consent for other anthropomorphic interaction services or personal-information processing involving a child under fourteen. It also requires a minors’ mode, reality reminders, use-time controls, guardian risk notices, usage summaries, character blocking and payment limits.

The rule is not a command to use one universal facial-recognition system. Age identification can be layered through the account, payment, guardian authorisation, declared age, device signals and behaviour risk. But a high-risk virtual companion that cannot reliably exclude minors should default to a more protective state. Real-name and anti-addiction controls support age identification; they do not replace the relationship prohibition or the character and payment controls.

The final text takes a different approach to older users from the consultation draft: it emphasises healthy-use guidance, prominent risk notices and responses to questions and requests for help rather than an absolute ban on simulated family relationships. The change shows that the rule is selective: it focuses the strongest boundary on minors, dependence and crisis.

5.2 Interaction data

Article 16 requires encryption and access control, protects interaction data and gives users copying and deletion options. It limits provision of interaction data to third parties unless law applies or the right holder clearly consents. Sensitive personal information in interaction data must not be used for model training unless law permits it or the user gives separate consent.

For a companion service, the data map should include chat and voice, images, responses, relationship stage, terms of address, preferences, memory entries, emotion labels, dependence scores, embeddings and profiles. A real deletion feature must distinguish chat-display deletion, relationship-memory deletion, account closure and legally retained security or complaint logs. A copy function should produce usable, portable data rather than screenshots.

If a third-party model API receives the conversation, the team must identify the actual data role: processor on instructions, joint decision-maker or independent user. Contracts should cover no-return training, human access, subprocessors, retention, cross-border transfer, incidents, audit and deletion proof. A contract label cannot hide a provider’s actual independent use.

5.3 Identity, time, dependence and exit

Providers must make it effective that the user knows the service is AI rather than a natural person. A first-use term may be too weak for a highly personified character, long sessions and saved relationships. Practical controls include a visible AI label, first-interaction notice, timely voice notice and labels on exported synthetic content.

The rule requires a reminder after each continuous use period longer than two hours. Teams must define the measured interaction and prevent role switching or reconnection from defeating the purpose. Dependence notices should consider night-time intensity, exclusivity, high-frequency emotional payment and the character’s own efforts to weaken a break.

The user must have a convenient exit. A request through a button, voice or keyword should stop the anthropomorphic service rather than trigger more persuasion. Shutdown requires advance notice or a prompt announcement, together with a plan for conversation and memory export, deletion choices, subscriptions, virtual items and unused balances. A role-play farewell cannot replace a formal data and consumer-rights notice.

6. How enforcement becomes a product workflow

6.1 Before launch

The minimum pre-launch package should include:

• safety assessment and provincial submission materials;
• algorithm filing, change or cancellation materials;
• an explicit and implicit labelling plan;
• lawful training-source, cleaning, labelling and synthetic-data evaluation records;
• minors, older users and crisis-intervention controls;
• interaction-data copy, deletion and separate-consent flows; and
• app-store verification materials.

Launch or addition of a regulated function is itself a trigger; the scale threshold is not an exemption for a small team.

6.2 During operation

The operating loop should cover content filtering, extreme-emotion and self-harm triage, dependence notices, the two-hour reminder, age and minors’ mode, data rights, complaint handling and logs. It should have a human escalation path for high-risk cases and a clear separation between game speech and real-world crisis statements.

6.3 After an incident or change

The regulator may require correction, a new assessment, an inspection, an interview, a warning, criticism, suspension, delisting or a fine. Changes that strongly increase the need for re-assessment include real-life topics, cross-session relationship memory, voice or visual emotion recognition, minor access, paid intimacy, a stronger model, or open public UGC. Record both the change and the reason a change was or was not material.

7. The platform adjustment cases: a careful reading

Reports on Doubao, Qwen and Yuanbao describe agent-function changes around June and July 2026, including data export or later processing notices. [1][2] Those reports support an industry fact: platforms changed open-ended or human-like agent functions before or around the Measures’ effective date. They do not establish a direct regulatory shutdown order or an admission of non-compliance.

The product explanation is structural. An open UGC character platform must review every user-created personality, relationship, topic, age exposure, memory design and crisis path. A controlled tool assistant does not present the same surface. Platforms may therefore separate high-risk emotional functions into a dedicated product, a white-listed library, an enterprise deployment or a sandbox, while moving general assistants toward productive use. The architecture is risk isolation, not necessarily abandonment of the agent market.

8. China, the EU and the United States

The EU AI Act takes a horizontal transparency route. Article 50 requires a person interacting directly with an AI system to be informed in a clear and distinguishable manner, and requires machine-readable marking for certain synthetic outputs. It also covers emotion-recognition notice and deepfake transparency. It does not reproduce the Chinese prohibition on virtual intimacy for minors, two-hour reminder, safety assessment or algorithm-filing structure. [10]

California SB 243 defines a companion chatbot through a natural-language interface, adaptive human-like responses, social needs and continuing relationships. Its narrow game exclusion applies only where the bot stays within game-related responses and does not discuss mental health, self-harm, explicit sexual material or non-game topics. The law also addresses AI disclosure, minors, crisis protocols, recurring reminders and private remedies. [11]

New York General Business Law Article 47 focuses on memory or preference retention, proactive emotional questions outside an immediate response and continued discussion of personal matters. It excludes customer service, productivity, research assistance and internal enterprise use, and requires crisis protocols and identity reminders. [12][13]

The FTC’s 2025 Section 6(b) inquiry into companion chatbots examined monetisation, minors, role development, testing, disclosure, age limits and personal-information use. It was an information-gathering exercise rather than a finding against the named companies. [14]

The common denominator is identity notice, crisis response and minor protection. The difference is institutional: China combines relationship rules, safety assessment, filing, store verification and administrative enforcement; the EU relies mainly on cross-system transparency and fundamental-rights governance; the US combines state rules, private remedies and federal consumer protection. For a global team, this supports one technical foundation with jurisdiction-specific policy layers, not one global copy-paste policy.

9. A practical plan for three types of team

9.1 Large platforms: inventory and physical isolation

Large platforms should first inventory every AI feature by anthropomorphism, continuity, emotional interaction, public access, minor access and user-created roles. They should then separate tool, enterprise-private, Q&A, anthropomorphic, intimate-relationship and minor-accessible agents, with different review, publication, distribution and shutdown controls.

The work must be cross-functional. Legal, algorithm, security, content moderation, product, growth, minors’ protection, customer support and communications need one responsibility map. Interaction data should be classified, minimised and access-controlled; sensitive conversations should not default to general training. High-risk roles can be placed in separate apps, white-listed libraries, sandboxes, enterprise versions or staged tests so that the entire general-purpose service does not inherit the same risk.

For international operations, use a common model and separate policy layers: stronger minor blocking and filing in China; AI Act transparency and GDPR controls in the EU; state disclosure, crisis protocols, minors and consumer-protection response in the US.

9.2 Vertical companion products: make boundaries a feature

A companion product does not have to stop existing, but “more human, more dependent, more immersive” cannot be the only growth strategy. Start with a governed role library rather than an unrestricted character square. Prohibit impersonation, minor intimacy, sexual exploitation, gambling, fraud, psychological manipulation and privacy extraction.

Build dependence signals around long or night-time use, exclusivity, “only you understand me” language, frequent relationship payments and repeated questions about whether the AI loves the user. Use the signal to cool the interaction, remind the user of reality, suggest human support or escalate for review. Give users clear data export, deletion and training-consent controls. Prepare a business interruption and migration plan that covers history, memory, memberships, virtual rights and unused balances.

9.3 Start-ups: choose a lower-risk product first

For a start-up, the practical question is whether it can afford the operating controls of a public emotional-companion service. Early B2B productivity use—enterprise workflows, knowledge bases, data analysis, development assistance, sales, internal support and training—usually presents a lower relationship risk if it does not create continuing emotional interaction.

Avoid “virtual lover”, “cyber family”, “always with you”, “understands you better than anyone” and “replace real social life” claims. Do not open unrestricted UGC characters in the MVP. A white-listed role library, closed test, enterprise pilot and fixed template establish a better control surface.

The minimum compliance package should still include AI identity notice, terms, privacy policy, complaints, exit, logs, content safety, sensitive-information handling and deletion. If minors may enter, add age controls, minors’ mode, guardian consent and payment limits. Compliance should also appear in investor materials as evidence that the system is explainable, auditable, stoppable, exportable and deletable.

10. Future direction and unresolved questions

Two policy tracks are now visible: the May 2026 agent guidance encourages productive agents, while the July Measures apply full relationship controls to continuing emotional services. The likely market structure is not “no agents”; it is productive and enterprise agents on one track, and more controlled, vertical or sandboxed emotional services on the other.

The Measures also leave space. They call for balanced development and security, classified and graded governance, technical innovation and a sandbox safety platform. The legislative direction is not a blanket prohibition but an attempt to make the relationship legible and controllable.

Several questions remain open. What is the exact scope of “other” services in the final rule’s professional-domain provision? How will provinces define continuity and major change in safety assessments? How should teams balance effective reminders and age checks against excessive friction? What will the first game-specific enforcement cases, store materials and provincial templates show? How will model, character and UGC changes be treated in practice?

Conclusion

The most useful question for an AI team is not whether a product can impersonate a person. It is whether the product is being built to operate a continuing human-AI emotional relationship. The next generation of durable AI products will not necessarily be the ones that imitate people most convincingly. They will be the ones that can explain their boundaries, protect the user, preserve evidence and stop safely.

Disclaimer

This note is a research analysis based on public information and is provided for general discussion. It is not legal advice or professional advice. Statements about corporate conduct and product motives are inferences from public reports and do not represent the position of the relevant companies or authorities. Foreign-law discussion is not advice on practising in a foreign jurisdiction.

References

[1] IT Home, reports on Qwen and Doubao agent-function adjustments, source; source

[2] Yangcheng Evening News, report on Doubao and Qwen agent-function adjustments, source

[3] Cyberspace Administration of China, Q&A on the Interim Measures for the Administration of Anthropomorphic Interaction Services, source

[4] Cyberspace Administration of China et al., Interim Measures for the Administration of Anthropomorphic Interaction Services, source

[5] Cyberspace Administration of China, Draft Interim Measures for the Administration of Anthropomorphic Interaction Services, source

[6] Cyberspace Administration of China, “Central Cyberspace Administration campaign against AI application disorder,” source

[7] Cyberspace Administration of China, “Authorities investigate products that failed to implement AI-generated-content labelling,” source

[8] Cyberspace Administration of China et al., Interim Measures for the Administration of Generative Artificial Intelligence Services, source

[9] Cyberspace Administration of China, Measures for Labelling AI-Generated and Synthetic Content, source

[10] Regulation (EU) 2024/1689, Article 50, source

[11] California SB 243, source

[12] New York General Business Law §1700, source

[13] New York General Business Law §§1701–1703, source; source; source

[14] Federal Trade Commission, “FTC Launches Inquiry into AI Chatbots Acting as Companions,” source