On May 12, 2023, the "AI digital twin" of Gu, a chief analyst covering the media industry at a leading securities firm, met the public for the first time. In the video, the digital twin introduced itself as follows:
"I have his voice and appearance, and moreover the multimodal interaction and generation capabilities derived from a large model... As the countless digital twins of a chief media analyst at a certain securities firm and co-head of the TMT group, I can simultaneously appear at roadshow venues, at press conferences, in research report interpretations, on analyst conference calls, and wherever any client needs me."
More than three years on, every clause of that statement now corresponds to a regulatory rule.
On August 26 of this year, the official AI digital twin of Fu, a well-known macroeconomist, went live on an AI investment research platform. At roughly the same time, the Interim Measures for the Administration of Anthropomorphic Interactive Services Based on Artificial Intelligence took effect on July 15, and on September 7 the Supreme People's Court issued the Opinions on the Lawful Trial of Cases Involving Artificial Intelligence Disputes, the first document of adjudicative rules concerning AI issued by the highest judicial organ. The industry has only just started running, and the rules have landed at the same time; the gap in between is exactly what this article sets out to clarify.
People who create digital twins usually hold to one line: I am merely putting my own views onto an AI; I have not done anything else. This article sets out to take that line apart. A digital twin simultaneously amplifies three things: influence, reach, and the frequency of errors. The first two are commercial value; the third is risk exposure; and they are inherently the same thing, so it is impossible to want only the first two.
One premise first: to date, there is no public case in which a "financial expert AI digital twin" has been directly penalized. This article does not review incidents that have already occurred; instead, it places two lines that are currently converging side by side to examine their intersection: the line of securities advisory qualifications and the line of AI personality rights. I will not pretend that on-point precedents exist; that is the bottom line.
What truly determines the magnitude of risk has never been how convincingly the technology is built, but the answers to three questions: who you are, what it says, and who bears the loss when something goes wrong.
Three gates: who you are, what it says, and who bears the loss
First question: who you are, and do you hold that license
When regulators determine whether you are "doing anything else," they do not use your own set of standards. The 2012 CSRC document specifically governing "stock recommendation software" defines things in a rather distinctive way: it does not look at what technology you use, only at what you output:
The "stock recommendation software" referred to in these provisions means software products, software tools, or terminal devices that have one or more of the following securities investment advisory service functions:
(1) providing investment analysis opinions concerning specific securities investment varieties, or predicting the price trends of specific securities investment varieties;
(2) providing recommendations on the selection of specific securities investment products;
(3) providing recommendations on the timing of purchases and sales of specific securities investment products;
(4) providing other securities investment analysis, forecasts, or recommendations.
Software products, software tools, or terminal devices that have the function of aggregating securities information or compiling historical data statistics on securities investment products, but do not have the functions listed in items (1) to (4) above, do not constitute "stock recommendation software."
Article 2 further provides that selling or providing stock recommendation software and directly or indirectly obtaining economic benefits constitutes engaging in securities investment consulting business, and a license from the CSRC shall be obtained.
This document took effect in 2013, when large models did not yet exist, but it precisely captures AI products in 2026. This is because it governs what is output, not how it is calculated. As long as the output points to analysis, forecasts, selection recommendations, or purchase and sale timing for specific targets, it is stock recommendation software, and "we only provide technical tools" does not constitute a defense.
Judgments have also been rendered. A Shanghai company made stock quantitative software called "Xunmou Quantitative." Clients paid RMB 28,800 to become VIPs and, based on the data, models, and parameters provided by the company, set their own conditions; once triggered, the software automatically bought and sold stocks. On its face, the decision-making power lay with the clients, and the company defended itself on this basis. On May 19, 2025, the Shanghai No. 2 Intermediate People's Court upheld the original judgment on final appeal, reasoning that although clients could independently set some parameters, those parameters played a relatively minor role, and the stock selection model provided by the company played a decisive role in stock selection,and the act of developing a stock selection model should be recognized as an act of recommendationThe actual controller, Zhong, was sentenced to five years and nine months for the crime of illegal business operations and three years and nine months for the crime of copyright infringement, with the sentences combined to run seven years and nine months, plus a fine of RMB 5 million; more than ten others in the same case, from co-founders and R&D directors to ordinary sales staff, were also sentenced, and no link in the chain was absolved of liability on the grounds of "only doing technology" or "only handling sales."
If "stock selection model" in this reasoning is replaced with "AI avatar," not a single word of the logic needs to change. The corpus, rules, and evaluation question banks behind the avatar are all set by humans, and responsibility follows whatever is output.
The disparity in consequences should also be made clear. For unlicensed business operations, the administrative ceiling is roughly twice the illegal gains, and the real leap occurs at the criminal threshold: business volume of RMB 1 million or illegal gains of RMB 100,000. Once crossed, the matter shifts to the crime of illegal business operations under Article 225 of the Criminal Law. And the most valuable features of an avatar—around-the-clock availability, one-to-many operation, and unlimited replicability—are precisely the features that drive one toward this amount threshold.
Holding a license does not equal safety. The Securities Law likewise prohibits sharing profits with clients and managing assets on behalf of clients. A license only resolves "whether one may speak"; it does not resolve "what one says."
Second question: what does it say, and where exactly is the line drawn?
Once you know to avoid specific securities, the next thought is inevitably: then I'll switch to knowledge sharing, investor education, or methodology training — that should be fine, right?
That fallback has also been closed off. An education and training company in Shanghai had "securities knowledge training" listed in the business scope on its business license. Its owner, Liao Mouqiang, recruited a group of lecturers who, in addition to teaching securities theory and technical knowledge, also analyzed and predicted market hotspots, broad market and sector trends, and indicated buy and sell points for relevant individual stocks. The court found that this constituted securities investment consulting business and was "conducted under the guise of securities knowledge teaching and training"; the illegal business amount exceeded RMB 500 million and the individual's illegal gains exceeded RMB 91 million, and he was sentenced to eight years' imprisonment and a fine of RMB 100 million.
For those producing content, the most useful part of the judgment is this passage setting out the dividing line, which is worth reading word for word:
Generally speaking, securities knowledge training mainly involves basic securities knowledge, related theories, and securities technical operations, and is intended to help investors master securities-related theoretical knowledge and operational skills, without directly affecting investors' investment decisions. Under the above provisions, however, securities investment consulting business involves providing the public with analysis, forecasts, or recommendations regarding trends in the securities market and securities varieties and the feasibility of investing in securities, and directly affects investors' investment decisions.
The line is drawn at the six characters "directly affects investment decisions." When designing the conversational boundaries of a digital twin, this sentence should be posted on the wall.
The second layer of risk is hallucination. A common misunderstanding needs correcting here: in this industry, an AI saying something wrong is not a technical defect; it is a ground for administrative liability. On the evening of August 26, 2025, Xu Mou, an investment adviser at a securities investment consulting institution in Shenzhen, forwarded a piece of false information to 618 contracted clients of the institution without verifying its source, falsely claiming that it had "received a notice from the securities regulatory bureau"; two hours later he worked it into an article and further disseminated it through a self-media account with more than 87,000 subscribers. The Shenzhen Securities Regulatory Bureau found that this constituted fabricating and disseminating false information to disrupt the securities market and imposed a fine of RMB 200,000 under Article 193, Paragraph 1 of the Securities Law.
The point is this: that was one person, one forwarding, 618 clients. A digital twin, by contrast, is automated, operates around the clock, and speaks to everyone. The same wrong statement, when spoken by a person, spreads only once each time it is forwarded; when spoken by a digital twin, it is restated anew in every conversation.
The third layer of risk is unique to digital twins: temporal dislocation. What the digital twin says may be a judgment the expert made two years ago, but the user understands it as "the expert's view at this moment." The training materials the aforementioned economist provided to the platform included articles and diaries from 1999 to the present, annual PPT yearbooks of four to five hundred pages, and research memoranda and trading records from past years. This material can indeed reconstruct which variables he looks at first when encountering a problem and what evidence would lead him to revise a conclusion, but being able to reconstruct "how he thinks" does not mean being able to reconstruct "how he should think today." Those who build digital twins themselves acknowledge this: historical content can help an AI imitate a person, but it is not sufficient to reconstruct his complete judgment process.
Therefore, the product must continuously display the AI identity, allow users to view cited materials, and indicate data dates and content versions. This is not a user-experience issue; it is a matter of isolating liability. If users can see that "this judgment is based on a research memorandum from March 2024," the room for misunderstanding is compressed — and the part that is compressed is precisely the part that could become a dispute in the future.
Third question: who bears the ultimate responsibility when something goes wrong — start with the authorization chain
This section offers the greatest informational value, because when most people build a digital twin they think of only one thing: this is my own face and voice, so what could possibly go wrong?
The legal basis is Article 1023, Paragraph 2 of the Civil Code:
The protection of a natural person's voice shall be governed by reference to the relevant provisions on the protection of the right to portrait.
The truly critical question, however, is this:who is entitled to hand over your voice for AI processing?。
On April 23, 2024, the Beijing Internet Court ruled on China's first AI-generated voice infringement case. Voice actor Yin Mouzhen was commissioned to record audio products; a certain cultural company was the copyright owner of the audio products. The cultural company licensed the recording data to a software company for AI processing, generating text-to-speech products for sale, and the voice at issue accumulated 3.25 billion plays. The court established two rules: for a voice processed by AI, so long as the general public can identify a specific natural person based on timbre, intonation and pronunciation style, that person's voice rights and interests extend to the AI voice; andthe copyright owner of an audio product does not have the right to authorize others to use the voice for AI processing. The Data Authorization Letter in the case was not signed by the person himself, and the authorization had no lawful source of rights. The court ordered the cultural company and the software company to bear joint and several liability for compensation of RMB 250,000.
Translated into a securities firm scenario: an institution holds an analyst's roadshow recordings, conference call recordings and video research reports from past years. The copyright in these materials may indeed belong to the institution, but the institution's ownership of the copyright does not mean the institution has obtained authorization to AI-process the analyst's voice. These are two entirely different consents; having signed one does not mean having signed the other.
Copyright in the materials does not equal authorization to AI-process the voice
The second judgment one must know is that "technological neutrality" likewise does not hold in the field of personality rights. A certain bookkeeping mobile app allowed users to create their own "AI companion" virtual characters. A public figure, He Mou, without authorization, was set up as a companion character by a large number of users using his name and portrait; the operating company classified these characters through algorithms, pushed them to other users, and also set up a "training" mechanism allowing users to upload materials to form character corpora. The company argued: the characters were created by users and the images were uploaded by users; we are merely a technical service provider.
The Beijing Internet Court did not accept this. The judgment found that the company, "through rule-setting and algorithm design, organized and encouraged users to create infringing materials, and jointly created virtual images with them"; the product design and algorithm application directly determined the realization of the software's core functions, and the company was no longer a neutral technical service provider but should bear infringement liability as a network content service provider, and was ordered to pay RMB 183,000 in economic losses and RMB 20,000 in compensation for mental distress. The court added: as a public figure, He Mou's personality interests should be subject to certain limitations, but the acts complained of clearly exceeded reasonable limits.
Rule-setting, algorithmic classification, proactive pushing, review and release, and incentivizing users to produce materials. The more these five actions appear, the less tenable "we are just a platform" becomes.
After September 7 of this year, these rules scattered across individual cases were unified by the Supreme People's Court into a nationwide adjudicative standard. The three sentences of Article 4 of the Opinions cover the full range of personality-right risks associated with digital avatars:
Unless otherwise provided by law, where, without the consent of a natural person, artificial intelligence is used to process the natural person's name, portrait, or the like to generate a virtual digital image identifiable as that natural person and to use or publicly disclose it, and the natural person asserts that the actor infringed upon his or her personality rights and interests, such as the right to name and the right to portrait, the people's court shall support the claim in accordance with law.
Unless otherwise provided by law, where, without the consent of a natural person, the natural person's voice is used as training corpus to imitate the natural person's timbre, intonation, pronunciation style, or the like to generate a synthesized voice capable of identifying that natural person, and the natural person asserts that the actor infringed upon his or her voice rights and interests, the people's court shall support the claim in accordance with law.
Where a synthesized virtual digital image or voice capable of identifying a specific natural person is manipulated to carry out improper acts or make false statements, thereby lowering the social evaluation of that natural person or others, the people's court shall determine in accordance with law that the right to reputation has been infringed.
Please note the third sentence. The first two sentences govern whether the creation of a digital avatar was consented to by the person concerned; the third sentence governs what the avatar says. Even if the authorization chain for the image and voice is entirely clean, if the avatar makes false statements that lower social evaluation, this independently constitutes an infringement of the right to reputation. For financial avatars, the person whose social evaluation is lowered is the expert himself or herself.
There are also two risks in opposite directions that few people calculate before creating a digital avatar.
If the expert leaves, to whom does the avatar belong?The person is gone, but the company is still using his face and voice to express views. Article 1022 of the Civil Code gives portrait licensing contracts()a statutory right of termination: where no term is agreed or the term is unclear, either party may terminate at any time; even where a clear term is agreed, the portrait rights holder may still terminate for justified reasons. This means that AI portrait authorization is inherently not a buyout. After the person terminates, whether the model trained on his data can continue to run is a structural risk. The authorization term, conditions for withdrawal, and how to handle the matter after departure must be written into the agreement before the digital avatar is created.
The avatar is misappropriatedSince 2025, as many as more than 30 securities firms have encountered impersonation, and products labeled "brand-new AI digital human livestreaming system" are sold for 9.9 yuan on second-hand trading platforms. In the risk alert issued by the Shenzhen Securities Regulatory Bureau in June of this year, "impersonating staff members of licensed institutions" and "fake AI quantitative stock selection" were listed as high-incidence frauds. The more famous the expert, the higher the value of forging the avatar, and the victim's first reaction is to look for you, not the fraudster.
The other half of the fallback: what to use to prove oneself
The authorization chain addresses the question of 'whether you have the right to act,' while record-keeping addresses the question of 'whether you can prove, on the day something goes wrong, that you acted correctly.'
Beijing Zhongmou Xinfu is a long-established licensed investment advisory institution founded in 1997. The administrative penalty decision published by the CSRC on November 14, 2025, established two violations: from 2021 to 2023, it failed to fully retain the marketing service records of 13 clients, and failed to fully retain the record-keeping records for 2020 concerning business promotion, agreement signing, service provision and other stages for 221 clients; and, during the period when it was ordered to suspend accepting new clients, it actually added 223 new clients and submitted a false statement of circumstances to the regulator. The result was a fine of RMB 3 million and revocation of its securities investment consulting business license; the then legal representative, Zhang, was warned, fined RMB 600,000, and banned from the securities market for 6 years, and this 28-year-old institution thereby lost its core business qualification. At the hearing, the company argued that the documents and materials were missing for objective reasons and that there was no subjective intent; after review, the CSRC expressly responded that the relevant opinions raised by the party lacked evidentiary support and could not constitute grounds for exemption from liability.
Note that the first established fact involved a total of 234 clients, with manual services and paper records. An AI avatar, by contrast, is fully automated, round-the-clock, and one-to-many. The record-keeping obligation under the same Article 162 of the Securities Law now applies to massive volumes of model invocation logs instead of 234 manual records, while the obligation itself has not changed by a single word.
Record-keeping: every generation, on the day something goes wrong
For a compliant AI investment research product, the standard record-keeping package is roughly as follows: every model invocation, tool invocation, cited source, prompt, output content, model version and timestamp is retained in full and cannot be tampered with, and every generated sentence can be traced back to the original research report or announcement. Ordinarily these things look like costs; on the day something goes wrong, they are the only evidence. What the avatar said, what it relied on in saying it, and which model version was in use at the time — if these questions cannot be answered, that is a failure of proof.
Moreover, on the civil liability track, the value of record-keeping has just been expressly stated by the Supreme People's Court. Article 3 of the Opinions establishes that fault liability applies to AI-related infringement and lists the factors to be considered in determining fault:
Comprehensive consideration should be given to factors such as the specific scenario of the artificial intelligence application, the degree of autonomy, technical and information transparency, potential risks and scope of impact, the measures adopted and the technical feasibility for the artificial intelligence developer, provider and other relevant entities to prevent and reduce artificial intelligence infringement, and the ability of the artificial intelligence user to foresee and control the damage that may be caused by infringement committed using artificial intelligence technology.
The two factors of 'technical and information transparency' and 'measures adopted to prevent and reduce infringement' directly convert logs, labeling and explainability materials into evidence that reduces the degree of fault. The same set of logs is a statutory obligation on the administrative track and ammunition for exemption from liability on the civil track.
Two documents newly implemented this year raise the cost yet another notch
The Interim Measures for the Administration of Artificial Intelligence Anthropomorphic Interactive Services were published on April 10 this year and took effect on July 15. The applicable boundary is drafted in a very subtle way and is worth reading word by word in Article 2:
Where artificial intelligence technology is used to provide the public within the territory of the People's Republic of China with continuous emotional interaction services that simulate the personality traits, thought patterns and communication styles of natural persons (hereinafter referred to as anthropomorphic interactive services), these Measures apply.
The emotional interaction services referred to in the preceding paragraph include interactive services such as emotional care, companionship and support provided in the form of text, images, audio, video and other forms.
Where services such as intelligent customer service, knowledge Q&A, work assistants, learning and education, and scientific research are provided and do not involve sustained emotional interaction, these Measures do not apply.
This gap is very narrow. If a financial avatar engages in purely knowledge-based Q&A, it may fall outside the scope; once companionship, emotional reassurance, or “chatting as if with the person themselves” is added, it falls within the scope. And these are precisely the features product managers most like to add. Among the eight core capabilities publicly promoted by a licensed investment advisory company for its intelligent advisory digital human, the last item listed is “emotional companionship.” Once it falls within the scope, it must perform AI labeling and interactive-prompt obligations, conduct a security assessment upon reaching the user-scale threshold and submit a report to the provincial cyberspace administration, and perform algorithm filing and accept annual verification; where it refuses to correct or the circumstances are serious, it is ordered to stop providing the relevant services and is fined not less than RMB 10,000 and not more than RMB 100,000.
The provision that most deserves emphasis is Article 31:
Where the provision of anthropomorphic interactive services involves the provision of health, financial, or other services, it shall simultaneously comply with the provisions of the relevant competent authorities.
Dual regulation. One set on the cyberspace administration side and one set on the financial regulation side, the two overlap, and neither set can serve as a backstop for the other.
The financial regulation side also took effect on June 18 this year. The Guiding Opinions of the National Financial Regulatory Administration on the Safe Development and Application of Artificial Intelligence in the Banking and Insurance Sectors apply directly to the banking and insurance sectors, and the securities side may currently be used for reference. Several hard rules are: “generative artificial intelligence scenario applications that are directly related to customer interests and directly affect the conclusion of financial contracts” should be regarded as high-risk applications and may be implemented only after approval by the institution’s risk management committee; human oversight and intervention mechanisms must be established at key stages, with clear conditions for emergency suspension and model exit; technologies with insufficient explainability may only serve as auxiliary tools in high-risk scenarios, with humans making the final decision; and log retention periods must be no shorter than the business duration. There is another hard red line: personal information such as names, ID numbers, mobile phone numbers, and bank card numbers must not be used for training and optimizing generative artificial intelligence models; this is an absolute prohibition, with no exception that they may be used “after obtaining separate consent.”
One more instrument should be added: the Measures for Labeling Artificial Intelligence-Generated Synthetic Content took effect on September 1, 2025. Explicit labels plus implicit labels in file metadata are the basic work for all AI avatars.
How to draw the three lines: give methods but not specific targets, do not touch money or accounts, and complete authorization and record-keeping first
First, do not give specific targets or buy/sell pointsGive methods, frameworks, data, and events, but not “which stock to buy, at what price to buy.” The boundary in the Liao Mouqiang case is drawn here: “not directly affecting investment decisions” is training, while “directly affecting investment decisions” is advisory, and there is no ambiguous zone in between in which to stand.
Second, do not touch money or accountsDo not place orders on behalf of clients, do not collect funds, and do not engage in profit sharing; between advice and execution there must be a manual user confirmation. Once this rule is breached, illegal business operations will escalate toward illegal absorption of public deposits and fund-raising fraud, and the sentencing levels are not of the same order of magnitude.
Third, the authorization chain and record-keeping must be completed before launch.Authorization to AI-ify a person's voice and likeness must be signed separately by that person, clearly stating the term, scope of use and conditions for withdrawal; every generation must be recorded and traceable. The Yin Mouzhen case has made the point clear: holding the copyright in the material does not mean holding the right to AI-ify that person's voice. The Zhongmou Xinfu case illustrates the same point from the other direction: record-keeping is not an internal-control recommendation but a statutory obligation, and its absence alone can bring a license to an end.
Having discussed the risks, it is time to offer a way out. Some have already got the sequence right. The investment advisory company mentioned earlier, when launching its intelligent advisory digital human, publicly identified itself as one of the first companies in China to obtain securities investment advisory qualifications from the CSRC. First the license, then the avatar. The brokerage mentioned at the outset, when creating analyst avatars, stated its technical position to the outside world as follows: "in theory, all information comes from the analyst's own research reports, and only information integrated from the relevant research reports can be output," while also setting about formulating usage procedures and standards and proactively reporting to the regulator. Neither approach is complicated; both simply put the three matters of license, content boundaries and record-keeping before the product launch rather than after.
There can be hundreds of millions of avatars, but there is only one license and only one reputation. Technology is responsible for raising efficiency; trust must still be handled by people themselves. The premise for keeping risks under control has never been that the model is smart enough, but that someone is accountable for every word it says. Who that person is must be made clear on day one.
We welcome discussion of legal issues in the Web3 and AI fields. If you are working on AI avatars, AI investment research or other AI products and are unsure about the compliance path, you are welcome to talk to me.
Reference sources
- Opinions of the Supreme People's Court on the Lawful Trial of Cases Involving Artificial Intelligence Disputes (Fa Fa [2026] No. 10, September 7, 2026)
- Interim Measures for the Administration of Anthropomorphic Interactive Artificial Intelligence Services of the Cyberspace Administration of China (issued April 10, 2026, effective July 15, 2026)
- Guiding Opinions of the National Financial Regulatory Administration on the Secure Development and Application of Artificial Intelligence in the Banking and Insurance Sectors (Jin Fa [2026] No. 8, June 18, 2026)
- Measures for the Labeling of Artificial Intelligence-Generated Synthetic Content of the Cyberspace Administration of China and Three Other Departments (effective September 1, 2025)
- Interim Provisions of the China Securities Regulatory Commission on Strengthening Supervision of Securities Investment Consulting Business Conducted Through "Stock Recommendation Software" (CSRC Announcement [2012] No. 40)
- Interim Measures for the Administration of Securities and Futures Investment Consulting of the Securities Commission of the State Council (Zheng Wei Fa [1997] No. 96)
- Articles 1022 and 1023 of the Civil Code of the People's Republic of China
- Articles 56, 162 and 193 of the Securities Law of the People's Republic of China
- Liao Mouqiang illegal business operation case, Criminal Judgment No. (2020) Hu 02 Xing Chu 4 of the Shanghai No. 2 Intermediate People's Court, People's Court Case Database entry No. 2026-03-1-169-001
- Xun Mou quantitative trading "DIY stock-trading robot" case (Zhong Mou case), first instance by the Shanghai Jing'an District People's Court, final judgment by the Shanghai No. 2 Intermediate People's Court on May 19, 2025
- Yin Mouzhen v. a software company and others, voice rights infringement case, Civil Judgment No. (2023) Jing 0491 Min Chu 12142 of the Beijing Internet Court
- "AI companion" software personality rights infringement case (He Mou case), Civil Judgment No. (2020) Jing 0491 Min Chu 9526 of the Beijing Internet Court
- Administrative Penalty Decision of the China Securities Regulatory Commission against a securities investment consulting company and its then legal representative (published in November 2025)
- Case of the Shenzhen Securities Regulatory Bureau investigating and handling securities practitioners fabricating and disseminating false information (disclosed in the investor protection column of the CSRC system)
- Reports by National Business Daily, Securities Times and The Paper on the AI digital avatar of a securities firm analyst (May 2023)
- 36Kr and PEdaily, "After Copying Faces, AI Begins Copying Experts' Brains" (August 2026)
- Reports by TMTPost and Sina Finance on the intelligent advisory digital human of a listed investment advisory company
