US Treasury Secretary criticizes AI risk warning: What compliance red lines and infringement risks do big model enterprises face
US Treasury Secretary Besson recently publicly criticized leading AI companies such as Anthropic and OpenAI, stating that they constantly exaggerate the "survival level risks" brought by AI but cannot come up with practical solutions, which is an exaggeration. This statement has pushed the debate on big model security from the technical circle to the intersection of industrial policy and legal regulation. Whether in the United States or China, AI companies are no longer just facing the public opinion issue of "whether to call risks", but where the training data comes from, whether the output content is illegal, whether the algorithm should be filed, and how to handle user data - each of which has clear legal responsibilities behind it. Guangdong Zhiming Law Firm has long served technology enterprises, and in accordance with the Interim Measures for the Management of Generative Artificial Intelligence Services, the Personal Information Protection Law, the Copyright Law, and other regulations, has sorted out the most urgent legal risks currently faced by large model enterprises.
Training data copyright: Every book fed into the big model may become a defendant
The ability of big models is built on massive data training, and a large amount of content is protected by copyright. Since 2023, there have been multiple cases in China where writers and image creators have sued AI companies for using their works to train models without permission. The court usually revolves around two core issues during the trial: first, whether the training behavior belongs to the "reasonable use" stipulated in Article 24 of the Copyright Law; The second is whether the model output constitutes a "substantial similarity" replication of the original work. At present, there is no unified standard in judicial practice, but the trend is clear - it is becoming increasingly difficult to establish a simple defense of "technical neutrality".
From the perspective of legal practice, AI companies should at least do three things: first, establish a ledger of training data sources, distinguish between public data, authorized data, and proprietary data, and prioritize obtaining copyrighted content through authorization agreements; Secondly, set filtering mechanisms for output content to avoid directly reproducing fragments of others' works; Thirdly, clarify the warranty clause for defects in rights in the user agreement, but note that this does not completely exempt the enterprise from liability for third-party infringement. Once identified as infringement, the enterprise may face consequences such as stopping training, deleting models, and compensating for losses. The amount of compensation may be calculated based on the actual losses or profits of the rights holder, and in serious cases, punitive damages may also be triggered.
Illegal output content: Platform responsibility cannot be blocked by 'technical neutrality'
Article 4 of the Interim Measures for the Administration of Generative Artificial Intelligence Services clearly requires that the provision of generative AI services shall adhere to the socialist core values, and shall not generate content that incites subversion of state power, overthrow the socialist system, endangers national security and interests, damages national image, incites separatism, undermines national unity and social stability, promotes terrorism and extremism, promotes ethnic hatred and discrimination, violence, pornography, and false and harmful information that are prohibited by laws and administrative regulations. This regulation places the responsibility for content security directly on the service provider.
In practice, some AI applications have been summoned or taken down by regulatory authorities for generating false news, insulting remarks, and illegal medical advice. If the content generated by AI infringes on the reputation, honor, and privacy rights of a specific natural or legal person, according to Articles 1024 and 1032 of the Civil Code, the victim can directly sue the platform or user. If the platform cannot prove that it has fulfilled its obligations of reasonable review and timely deletion, it is difficult to invoke the "safe harbor principle" for exemption. For AI companies, establishing a dual mechanism of manual review and machine filtering, retaining user complaints and handling records, is a fundamental action to reduce legal risks.
Algorithm registration and safety assessment: Going online without procedures is equivalent to driving without a license
According to the Administrative Provisions on the Recommendation of Algorithms for Internet Information Services and the Interim Measures for the Management of Generative AI Services, generative AI services with the attribute of public opinion or the ability of social mobilization should go through the procedures for algorithm filing and carry out security assessment in accordance with relevant national regulations. Since 2024, the Cyberspace Administration of China has released multiple batches of domestic deep synthesis service algorithm filing lists. Enterprises that provide services to the public without filing may be ordered to rectify within a specified period of time, suspend information updates, or even remove applications.
Many startups believe that 'we are just calling APIs, not service providers', which is a common misconception. The regulatory perspective focuses on the entities that actually control content and provide services to users. As long as your product directly outputs AI generated content to users, it may be recognized as a service provider. In addition, if AI services involve deep synthesis functions such as face generation and voice cloning, they must also comply with the Administrative Provisions on Deep Synthesis of Internet Information Services. The generated content must be marked conspicuously, and the logo must not be deleted or tampered with, otherwise it may constitute false publicity or fraud.
Deep forgery and infringement of personality rights: the legal cost of AI's "face swapping" and "onomatopoeia"
Anthropic and OpenAI frequently mention "abuse of risk" in risk warnings, which has a clear regulatory path under the Chinese legal system. Using someone else's portrait or voice for AI face swapping or speech synthesis without consent directly infringes upon the right to portrait as stipulated in Article 1019 and the right to voice as stipulated in Article 1023 of the Civil Code. If used for the production of obscene videos, false advertisements, and fraudulent materials, it may also violate Article 266 of the Criminal Law for fraud and Article 363 for the production, reproduction, publication, sale, and dissemination of obscene materials for profit.
In the AI face changing infringement case heard by the Beijing Internet Court in 2025, the court clearly determined that the operator's failure to obtain the consent of the obligee constituted an infringement of the portrait right, and ordered an apology and compensation for economic losses. For AI companies, the functionality involving biometric information in their products must also comply with the special provisions of Article 28 of the Personal Information Protection Law regarding sensitive personal information, obtain separate consent, and conduct a personal information protection impact assessment.
The compliance path that AI companies need to take is not easy, but it is not without solutions. From data source review, content security mechanisms, algorithm filing to user agreement design, every step requires the involvement of legal professionals. Guangdong Zhiming Law Firm can provide full process legal services for large model enterprises, including due diligence on training data copyright, compliance review of generated content, algorithm filing guidance, and response to infringement disputes, helping enterprises find feasible paths between innovation and compliance.
