On 14 September 2026 the Cyberspace Administration of China (CAC) published its July–August filing list under the Interim Measures for the Management of Generative AI Services. It adds 124 filed services, 7 of them running on mobile devices. A further 133 applications that call already-filed models were registered with local offices. As of 31 August, the cumulative totals are 1,112 filed services and 731 registered applications or features. The previous batch, for May–June, added 120 services.
The numbers are best read as a regime that is working at scale. They are not a sign of a crackdown or of a loosening.
The strongest case for the regime
Regulators have a real argument. Generative systems can produce fraud scripts, impersonation and defamation at near-zero marginal cost. A pre-launch gate, an accountable named provider, and a rule that every live product must show its model name and filing number are all legible, enforceable consumer protections. The CAC's notice requires launched products to disclose which filed or registered service they use, in a prominent place or on the product detail page. Traceability of that kind is something many democracies are still debating. It also lets a buyer or a user ask who is responsible for a given output.
The Measures are a joint instrument of seven agencies. The CAC published them as Order No. 15, and they took effect on 15 August 2023. Article 17 applies the security-assessment and filing track to services with "public opinion attributes" or "social mobilisation capacity". That wording is where the content-governance weight sits.
What the gate actually governs
The same Measures bind providers under Article 4 to uphold "core socialist values" and to avoid content that incites subversion of state power. That is a content standard, and the gate enforces it before launch, not after harm occurs. This is the main difference from proportionate, harm-based regulation. A filing certifies that a service passed a political and security review. It does not certify that the service is accurate, safe or commercially sound. Commentary on the latest list notes that the notice gives no approval rates, review times or rejection counts. Applicants can't see how criteria are applied, and outsiders can't tell how strict the gate is.
A speech-protective approach would test outputs against specific, published harms. Fraud, non-consensual deepfakes and child safety are examples. It would not make launch depend on conformity with a broad ideological standard. Vague standards push providers toward over-compliance. Models trained to avoid anything politically sensitive become less useful, even for lawful research, journalism and education.
Scale, and a two-tier structure
The design is notable for how it distributes the burden. Direct model providers file nationally. Applications built on already-filed models register locally. The result is a layered chain of custody: big models carry the review cost, and downstream apps inherit it by reference. Registrations have grown faster than filings since the end of 2025, according to one third-party analysis, which suggests that the application layer is where growth is happening. That analysis counts roughly 49% growth in filings and 68% in registrations.
The pace is steady. The 120 services in May–June and 124 in July–August show a pipeline with predictable throughput, which Digital Policy Alert's tracker records as a recurring bimonthly release. Predictability is a real benefit to firms. A company that can plan around a known review process faces less uncertainty than one facing ad hoc enforcement.
The seven mobile-side services point to where scrutiny is moving. On-device generation is harder to monitor than a cloud API. How regulators treat hybrid or local processing is an open question, and the notice does not address it.
The cost to openness
The gate shapes the wider ecosystem too. Beijing blocked Hugging Face in 2023, and domestic platforms such as ModelScope and MoArk have since grown to fill the gap. Rest of World reports that authorities quietly tolerate labs bypassing the block to share Chinese models abroad, even as ordinary developers say they prefer the global hub. The state wants a sealed domestic information space and open links for its top researchers. Those two goals pull against each other, and every filed model is a point where they meet.
It is worth being plain about the trade-off. A filing system that clears over a thousand services shows that compliance is achievable at scale. It does not show that the standard being applied is proportionate. Innovation under a pre-approval regime tends to cluster in firms with legal and policy teams, because the cost of a rejected filing falls on small developers hardest.
What other regulators should take from this
There are two lessons.
- Transparency has value, but the content standard matters more. Requiring products to disclose the underlying model and registration number is a cheap, auditable idea. Democracies can adopt it without adopting prior review.
- Publish the criteria. If a gate exists, applicants and the public should know what it tests, what the approval rate is, and how appeals work. Counting approvals is not accountability.
The July–August list is evidence that China's generative AI governance is stable, scaled and growing. It is not evidence that the model is a good one to copy. The disclosure mechanics deserve study. The pre-launch ideological gate does not.