On September 7, the Supreme People's Court issued the Opinions on the Lawful Trial of Cases Involving Artificial Intelligence Disputes (Fa Fa [2026] No. 10). The document comprises five parts and twenty-four articles. Article (20) is devoted specifically to criminal matters and identifies seven categories of criminal conduct carried out using artificial intelligence. This article provides an initial overview.
If you are building AI products, or have already integrated AI into your business processes, this list is worth checking against item by item. Not because you would engage in these seven types of conduct, but because those who do engage in them are very likely using your model, your API, or your export function. Each category on the list corresponds to a way in which you could be drawn in.
The specific provision reads as follows:
(20) Lawfully punish criminal activities carried out using artificial intelligence. Where a person uses artificial intelligence to commit fraud, insult, defamation, damage to commercial reputation or product reputation, infringement of citizens' personal information, illegal acquisition of computer information system data, or production, sale, or dissemination of obscene materials, and such conduct constitutes a crime, criminal liability shall be pursued in accordance with law. Where an actor, after activating an assisted driving function, uses privately installed components to evade monitoring by the assisted driving system and thereby causes a road traffic accident, and such conduct constitutes a crime, criminal liability shall be pursued in accordance with law.
What exactly are these seven categories?
Counting in the order listed in the provision, the seven categories correspond to six existing articles of the Criminal Law:
The crime of insult and the crime of defamation share Article 246, so the seven categories of conduct fall under six articles. Not a single new offense is created.
There are also two details that recent summaries have generally omitted.
One is the phrase "and other conduct" at the end of the list. The presence of "other" shows that this is not a closed list. It is not only these seven categories that attract criminal liability, and it is certainly not the case that anything outside these seven categories is safe. As discussed below, the offense that poses the greatest threat to companies legitimately doing AI business is precisely the one not on the list.
The other is that Article (20) actually contains two sentences. The second sentence addresses the situation where, after activating an assisted driving function, a person uses privately installed components to evade system monitoring and thereby causes a traffic accident; it points to dangerous driving and traffic offenses, which are entirely different from the seven categories above. The so-called "seven categories" count the first sentence.
Why do existing offenses need to be listed again?
Since not a single new offense is created, what is the significance of this article?
The document number of the Opinions is "Fa Fa" rather than "Fa Shi": the former denotes a judicial guidance document, while only the latter constitutes a judicial interpretation. A judicial interpretation may be directly cited in a judgment as the basis for adjudication; a judicial guidance document may not. What it unifies is the adjudicative standards of courts at all levels. More importantly, under the principle of legality, such a document cannot create a new offense, cannot expand the elements of an offense, and cannot lower the threshold for criminalization. Therefore, reading it as "the Supreme People's Court has added seven new categories of AI crimes" reverses its direction.
What it actually does is two things. First, it identifies the points of assessment: these existing offenses apply equally in AI scenarios and do not cease to apply merely because a model has been interposed. Second, it marks the enforcement priorities: these seven categories are the most concentrated problems at present, and the standards of courts across jurisdictions should be aligned.
There are also five characters that are easily overlooked: "constituting a crime." These five characters mean that using AI does not equate to criminalization; each category must still satisfy all the elements of that offense, without exception. What follows, category by category, is exactly where these elements become difficult in AI scenarios.
Fraud: AI changes the cost, not the offense
Article 266: Whoever defrauds public or private property, if the amount is relatively large, shall be sentenced to fixed-term imprisonment of not more than three years, criminal detention, or public surveillance, and shall also, or shall only, be fined; if the amount is huge or there are other serious circumstances, shall be sentenced to fixed-term imprisonment of not less than three years but not more than ten years, and shall also be fined; if the amount is especially huge or there are other especially serious circumstances, shall be sentenced to fixed-term imprisonment of not less than ten years or life imprisonment, and shall also be fined or have property confiscated. Where otherwise provided by this Law, those provisions shall prevail.
None of the elements of this offense has been relaxed because of AI: there must be fabrication of facts or concealment of the truth; the other party must thereby fall into a mistaken understanding; property must be delivered on the basis of that mistaken understanding; and the amount must reach the relatively large threshold. If any one of these four links is missing, completed fraud is not established.
What AI changes here is the cost. The Supreme People's Court stated plainly at the press conference that with AI voice-cloning technology, a voice can be "stolen" for a few yuan, with an effect sufficient to pass as genuine. There is a widely cited case: wrongdoers, based on public information about a multinational company on social platforms, imitated the images and voices of several executives, impersonated them in a video conference, and induced a finance employee of the company's Hong Kong branch to transfer funds, involving HK$200 million. Five years ago, forging a multi-person video conference to this degree required a professional team and a considerable budget; now a few clips of public appearances suffice.
But a decline in cost does not mean a decline in the threshold. Producing a technical demonstration of face-swapping, even one that passes as genuine, is not fraud so long as it is not used to fabricate facts to obtain property; conversely, if it is used to obtain money by deception, the offense is established even if the technology is crude. The judgment always turns on the conduct, not on the level of technology.
Insult, defamation, and damage to business reputation: the thresholds of the three categories differ
These three categories are often grouped together as "AI-generated rumors," but in criminal law they are three different mechanisms.
Insult and defamation share one article:
Article 246: Whoever publicly insults another person by violence or other methods, or fabricates facts to defame another person, if the circumstances are serious, shall be sentenced to fixed-term imprisonment of not more than three years, criminal detention, public surveillance, or deprivation of political rights.
The offense in the preceding paragraph shall be handled only upon complaint, except where it seriously endangers social order and national interests. Where a person commits the act specified in the first paragraph through an information network and the victim files a complaint with a people's court but has genuine difficulty in providing evidence, the people's court may request the public security organ to provide assistance.
The second paragraph is the key to this article. The crimes of insult and defamation are, in principle, cases of private prosecution, requiring the victim to bring a complaint before the court, and the public security organ does not initiate a case on its own motion. However, the second paragraph leaves a public-prosecution outlet, namely the exception for "seriously endangering social order and national interests," and the Supreme People's Court and the Supreme People's Procuratorate have issued a separate judicial interpretation on cases of defamation committed through information networks that specifies in detail the circumstances under which a case is converted to public prosecution.
This structure determines the different trajectories of the two categories of AI cases. Where AI is used to synthesize indecent images to humiliate a specific individual, the nature of the act most closely resembles the crime of insult, and in practice most such cases proceed through the public-prosecution outlet, because once such content spreads, it is extremely difficult for the victim to produce evidence on their own. AI-generated rumors in bulk are more likely to fall under defamation, and the difficulty there is that the victim often cannot even ascertain who posted them. The sentence in the second paragraph, "the people's court may request the public security organ to provide assistance," was written precisely for such difficulties.
Damage to business reputation follows a different logic:
Article 221: Whoever fabricates and disseminates false facts to damage another person's commercial reputation or product reputation, thereby causing significant losses to another person or involving other serious circumstances, shall be sentenced to fixed-term imprisonment of not more than two years or criminal detention, and shall also, or shall only, be fined.
When an enterprise is targeted by AI-generated rumors in bulk, this article looks the most applicable but is the hardest to use, and the difficulty lies in three respects. First, it requires that "fabricating and disseminating" be present simultaneously, whereas the typical form of the illicit AI content-rewriting industry is to piece together and rewrite rumors already circulating online, and whether this counts as fabricating on one's own is disputed. Second, it requires significant losses or other serious circumstances, yet the causal relationship between fluctuations in an enterprise's share price or decline in sales and a particular AI-generated article is extremely difficult to establish under the criminal standard of proof. Third, the statutory penalty is only not more than two years, which, compared with the crime of infringing on citizens' personal information,()carries a maximum of seven years, differs by an order of magnitude.
Taken together, these three points explain a counterintuitive phenomenon. In the cases of AI content-rewriting and rumor-mongering to farm traffic that have emerged intensively over the past two years, the publicly characterized charges generally do not fall on the crime of damaging business reputation.()In the case of rumors about Xiaomi announced by the Xi'an police in June 2026, 1,357 accounts were involved; in the AI content-rewriting case announced in Jinzhong in August, more than 7,800 real-name accounts were involved and more than 500,000 yuan in illegal gains. In both cases, the charges fell on the crime of infringing on citizens' personal information. In the case of a certain tea beverage enterprise in Shanghai disclosed in May 2025, the perpetrator used their own accounts, and the official characterization remained at fabricating and disseminating online rumors to damage the enterprise's rights and interests, without any specific charge being announced.
The outward conduct in the three cases is almost identical, with only one difference: where the accounts came from. Where there was a bulk account-purchasing step, the case-handling authorities flipped the upstream switch; where there was no account-purchasing step, the downstream rumor-mongering was instead difficult to criminalize on its own.
This is the pattern this article most wants to make clear: what determines where the charge falls is never which segment of conduct looks the most glaring, but which segment has the clearest constitutive elements, the strongest evidence, and the heaviest statutory penalty. How many accounts were purchased and how much money was made are certain facts lying in the fund flow records and backend data; how much the rumors caused the enterprise to lose is not.
Comparison of where charges fall
Therefore, when a company encounters AI-generated defamatory content at scale, I usually recommend pursuing the civil and administrative routes first, with criminal reporting as a means of exerting pressure rather than the primary expectation. If criminal proceedings are genuinely to be pursued, the focus should also be placed on identifying the source of the opposing party's accounts.
Personal information and computer data: the corpus-collection line is the most dangerous
These two categories are the most damaging on the list to companies legitimately engaged in AI, because the technical steps involved in illicit data acquisition and lawful corpus collection are highly overlapping.
Article 253-1: Whoever, in violation of the relevant provisions of the State, sells or provides citizens' personal information to others, where the circumstances are serious, shall be sentenced to fixed-term imprisonment of not more than three years or criminal detention, and shall also, or shall only, be fined; where the circumstances are especially serious, shall be sentenced to fixed-term imprisonment of not less than three years but not more than seven years, and shall also be fined.
Whoever steals or otherwise unlawfully obtains citizens' personal information shall be punished in accordance with the provisions of the first paragraph.
Article 285: Whoever, in violation of the provisions of the State, intrudes into a computer information system other than those specified in the preceding paragraph, or employs other technical means to obtain data stored, processed or transmitted in that computer information system, or implements unlawful control over that computer information system, where the circumstances are serious, shall be sentenced to fixed-term imprisonment of not more than three years or criminal detention, and shall also, or shall only, be fined; where the circumstances are especially serious, shall be sentenced to fixed-term imprisonment of not less than three years but not more than seven years, and shall also be fined.
First, the most recent form within the personal information category, commonly referred to as doxxing. In the Opinions, this is in fact addressed on two tracks: Article (5) treats it as a matter of the right to privacy and proceeds civilly; the criminal law anchor point is only found in Article (20).
(5) Regulate in accordance with law acts such as "online doxxing" and "human flesh searching" carried out using artificial intelligence that infringe upon the right to privacy of natural persons. Where, for the purpose of prying into privacy, artificial intelligence is used to track and analyze publicly available information such as the telephone numbers, online accounts and social media of a specific natural person, to obtain private information, or to leak or disclose the private information so obtained, or to use the information so obtained to disturb the peace of private life, this shall be determined to constitute an infringement of the right to privacy. Where artificial intelligence is used to photograph, peep at, eavesdrop on or otherwise act upon the private spaces, private activities and the like of a specific natural person, this shall be determined to constitute an infringement of the right to privacy, unless otherwise provided by law or the natural person has given explicit consent.
Please note the actions described in this passage: tracking and analyzing publicly available information to obtain private information. This is a genuinely new problem brought about by AI. Viewed individually, each item is public—a mobile phone number suffix, a location tag in a social media post, the background of a group photo—but pieced together they become private information. In the past, this work required manual searching, with limited efficiency; now a model can, within minutes, align fragments scattered across the entire internet to the same individual.
The threshold on the criminal side is far more specific. What counts as citizens' personal information, what counts as unlawful acquisition, and how many items constitute serious circumstances are all determined by the 2017 judicial interpretation of the Supreme People's Court and the Supreme People's Procuratorate. A few figures are worth remembering: the account names and passwords of real-name online accounts constitute citizens' personal information; purchasing, receiving or exchanging them constitutes "otherwise unlawfully obtaining" them, and there is no need to prove that you used technical means to steal them; the criminalization threshold for general personal information is 5,000 items or 5,000 yuan in unlawful gains, and reaching ten times that amount constitutes especially serious circumstances—that is, unlawful gains of 50,000 yuan cross into the bracket of not less than three years but not more than seven years. The interpretation separately relaxes the threshold to 50,000 yuan in profits for purchases made for lawful business operations, but the switch is the phrase "lawful business operations"; once the purchased accounts are used for defamatory content to farm traffic, this opening is closed.
As for the computer data category, Article 285, paragraph 1 governs systems in the fields of State affairs, national defense construction and cutting-edge science and technology, while ordinary commercial scenarios fall under paragraph 2. Writing a crawler to capture data is the same act in both cases: what the illicit operators capture is information that can identify individuals, while what you capture is training corpus; the illicit operators circumvent a website's protective measures, while you capture only public pages. The dividing line between the two is not in the technical act but in the chain of authorization.
For this very reason, Article (6) of the Opinions specifically opens a channel for model training: processing personal information that an individual has made public themselves or that is otherwise already lawfully public within a reasonable scope for training purposes, where the individual has not explicitly refused, is generally not determined to be an infringement; where it has a significant impact on individual rights and interests, the individual's consent must still be obtained. This channel is very useful, but one thing must be made clear: Article (6) addresses the boundary of civil liability and does not directly exempt criminal liability. To determine whether a batch of corpus was obtained cleanly, one must ultimately return to the authorization documents, collection records and transaction contracts.
Producing and creating pornography: the two switches are profit-making and dissemination
The seventh category is producing and creating pornography, and disseminating synthesized adult content. The AI pornography short-drama industry chain that has emerged this year falls within this category. Under criminal law it splits into two provisions with a clear boundary:
Article 363: Whoever, for the purpose of profit-making, produces, reproduces, publishes, sells or disseminates obscene materials shall be sentenced to fixed-term imprisonment of not more than three years, criminal detention or public surveillance, and shall also be fined; if the circumstances are serious, shall be sentenced to fixed-term imprisonment of not less than three years but not more than ten years, and shall also be fined; if the circumstances are especially serious, shall be sentenced to fixed-term imprisonment of not less than ten years or life imprisonment, and shall also be fined or have property confiscated.
Article 364: Whoever disseminates obscene books, periodicals, films, audio-visual materials, pictures or other obscene materials, if the circumstances are serious, shall be sentenced to fixed-term imprisonment of not more than two years, criminal detention or public surveillance.
Article 363 requires the purpose of profit-making; Article 364 does not require profit-making but requires dissemination and serious circumstances. Reading these two provisions side by side yields a conclusion that is very important for case handling: where there is neither profit-making nor dissemination, and the content is purely generated and kept by oneself, this generally does not constitute a crime. Therefore, the real points of contention in such cases lie in evidence of profit-making and the scope of dissemination, not in the act of generation itself.
What AI changes in this category is very concrete: generation costs are greatly compressed, output is no longer the bottleneck, and the focus of investigation has therefore shifted as a whole from "who made it" to "who is selling it and who is disseminating it." Fund flows, distribution channels and membership scale are the real anchors for deciding a case.
There is also an unavoidable threshold question: do AI-generated images and videos count as obscene materials under criminal law?
Article 367: "Obscene materials" as referred to in this Law means obscene books, periodicals, films, video tapes, audio tapes, pictures and other obscene materials that concretely depict sexual acts or blatantly promote pornography.
This definition does not make "performance by real persons" an element. In practice, by reference to the approach taken to anime-type obscene materials, they are generally found to constitute such materials. There is currently no dedicated judicial interpretation for AI-generated content; this is an area where arguments can be made but are not easy to win.
Another often-overlooked downstream link deserves mention: this type of illicit industry rarely stops at selling content; a more common model is first using AI to fabricate indecent content involving a specific person, then using it to demand money or property, which brings in the crime of extortion. A single chain often carries two charges at once, and the latter is heavier than the former.
When the subject shifts from illicit industries to your company
In the seven categories above, the subject is always illicit industries. At this point the subject needs to change.
Beyond the seven categories of offenses named in Article (20), there is one offense that is not named but that companies genuinely doing AI business are most likely to run into:
Article 287-2: Whoever, while clearly knowing that another person is using an information network to commit a crime, provides such person with technical support such as internet access, server hosting, network storage, or communication transmission, or provides assistance such as advertising promotion or payment settlement, and the circumstances are serious, shall be sentenced to fixed-term imprisonment of not more than three years or criminal detention, and shall also, or shall only, be fined.
This is the crime of assisting information network criminal activities, known in the industry as the crime of assisting information network criminal activities (bang xin zui). You open a model interface, and a customer uses it to generate fraud scripts in bulk; your product has a face-swapping feature, and someone uses it to forge indecent videos; you provide watermark-free export, and downstream users use it to forge evidence. In these scenarios, it is your users who commit the seven categories of offenses, but if it is determined that you "clearly knew" and still provided technical support, criminal liability falls on you.
Between "the user is suspected of illegality" and "the enterprise constitutes a crime" lie the two words "clearly knew." In judicial practice, clear knowledge does not require direct evidence and may be comprehensively inferred: obviously abnormal transaction methods, prices obviously deviating from the market, continuing to provide services after being warned by a regulatory authority or notified by a rights holder, and customizing functions specifically for illegal purposes may all be used to infer clear knowledge.
The law has in fact already written the actions for you that keep clear knowledge at bay:
Where a provider discovers that a user is using a generative artificial intelligence service to engage in illegal activities, it shall, in accordance with law and as agreed, take measures such as warning, restricting functions, suspending or terminating the provision of services to that user, preserve relevant records, and report to the relevant competent authorities.
This is Article 14, Paragraph 2 of the Interim Measures for the Administration of Generative Artificial Intelligence Services. It is ordinarily treated as an administrative compliance obligation, but in a criminal context it is direct evidence that you have done your utmost. Broken down, this article consists of three actions, and companies at different stages should start in different places.
DiscoveryYou must be able to know what your service is being used for: establish monitoring for signals such as abnormal call volumes, abnormal prompts, and bulk registrations, and conduct identity verification and authorization-chain verification for high-risk functions such as face swapping and voice imitation. A platform with zero discovery capability will find it very difficult in court to assert that it did not clearly know, because the other side will ask in response: why did you not know? If a fledgling startup team can do only one thing first, do this one, even if it is only keeping a separate log of calls to high-risk functions.
HandlingAfter discovery, you must actually act: warning, restricting functions, suspending or terminating services—the graduated steps are already set out in the statute. What is most prone to problems here is the user agreement: if the agreement does not state that you have the right to take these measures in the event of a violation, your handling itself may constitute a breach of contract. For companies that already have a certain scale and a full legal team, the focus is on aligning the contract terms with the handling actions; neither can be missing.
Record-keeping and reportingRecords of handling must be retained, and any involvement in illegal activities must be reported to the competent authorities. This step is the easiest to skip, and also the most regrettable. If you have taken the first two actions but kept no records, it is as good as doing nothing. In court, if you say you handled the matter but cannot produce records, it is no different from not having handled it at all. Those providing upstream and downstream services such as interface distribution, model agency, and computing power hosting must in particular retain materials on the identity and intended use of downstream customers, because when something goes wrong in the chain, you are the link most likely to be swept up along with it.
There is another detail worth mentioning separately. If your product has functions such as exporting a version without watermarks or removing labels, Article 9 of the Measures for Labeling AI-Generated Synthetic Content provides a lawful outlet: users may apply for content without explicit labels, but you must specify their labeling obligations and usage responsibilities in the agreement, and retain logs including the information of the recipients for no less than six months. Taking this outlet is compliance; bypassing it is illegality, and there is no gray area in between. And these six months of logs happen to be the most useful evidence in scenarios involving the crime of assisting information network criminal activities.
Three actions to block knowing
These three actions have an additional benefit. Article (3) of the Opinions lists "measures taken to prevent and reduce AI infringement and the technical feasibility thereof" as a factor in determining fault, so the same set of actions is also converted into your degree of fault in civil infringement cases. Do it once, and it serves both ends.
What the Supreme People's Court implies
Regarding Article (20), the discussion over the past few days has almost all stopped at "strict punishment." But the Supreme People's Court completed its statement at the press conference, and the implication is equally important:
Third, comprehensively and accurately implement the criminal policy of balancing leniency and severity, and handle criminal cases involving AI in accordance with law. On the one hand, the Opinions emphasize that criminal acts intentionally using AI to endanger national security, infringe upon citizens' rights and interests, disrupt social order, and the like must be resolutely punished in accordance with law; on the other hand, they require that innovative conduct in AI research, development, and application be handled prudently in accordance with law, and that the principles of legality of crime and punishment and of suiting punishment to crime and responsibility be strictly observed.
Two qualifiers are worth underlining: the target of strict punishment is conduct that "intentionally" uses AI to commit crimes, while for innovative conduct in research, development, and application, what is required is prudent handling and strict observance of the principle of legality of crime and punishment. This is not polite talk; it is the yardstick written for case-handling authorities, and it is also the very sentence AI companies should hold onto when facing criminal risk.
Looking back at this list, it is written for two groups at once. For the underground industry, it is a statement: changing the tool does not change the characterization; fraud committed with AI is still fraud, and pornography made with AI is still pornography. For those legitimately doing AI business, it is a reverse self-inspection checklist. You will not engage in those seven categories, but you must confirm that your product has not become the infrastructure for those seven categories.
Technology itself is neutral; the people who use it are not. And as the party providing the technology, what the law asks you is never what you want to do, but what you know and what you did.
If you are building an AI product and need to conduct a criminal risk review against these seven categories, or if you have already received regulatory inquiries, notices from rights holders, or even cooperated with an investigation, you are welcome to talk with me. The earlier such matters are handled, the lower the cost.
Reference sources
- Opinions of the Supreme People's Court on the Lawful Trial of Cases Involving Artificial Intelligence Disputes (Fa Fa [2026] No. 10), issued on September 7, 2026
- Responsible Persons of the Relevant Department of the Supreme People's Court Answer Reporters' Questions on the Opinions on the Lawful Trial of Cases Involving Artificial Intelligence Disputes, Information Bureau of the Supreme People's Court, September 7, 2026
- Criminal Law of the People's Republic of China (2023 Amendment), National People's Congress
- Interpretation of the Supreme People's Court and the Supreme People's Procuratorate on Several Issues Concerning the Application of Law in the Handling of Criminal Cases of Infringement of Citizens' Personal Information (Fa Shi [2017] No. 10)
- Interim Measures for the Administration of Generative Artificial Intelligence Services, Cyberspace Administration of China and other authorities, promulgated on July 13, 2023
- Measures for the Labeling of Artificial Intelligence-Generated Synthetic Content, Cyberspace Administration of China and other authorities
- Notice of the Cybersecurity Protection Department of the Xi'an Public Security Bureau on a Case of Rumors Fabricated Using AI Technology, June 17, 2026
- Notice of the Cybersecurity Protection Department of the Jinzhong Public Security Bureau on a Case of Fabricating Articles with AI to Obtain Traffic Rebates, August 21, 2026
- Notice of the Shanghai Changning Police on a Case of Fabricating and Disseminating Online Rumors Through AI Article Rewriting to Harm the Rights and Interests of an Enterprise, May 2025
