ARCHETYPAL

Perform required security assessments

AIR-0029859136 · version 2 · Security · candidate interpretation

Covered GenAI service providers must perform required security assessments.

Situation & purpose

An AI system or employee activity involves required security assessments. Confirm the actor and source conditions before using this template.

Provide a traceable control for the action: perform required security assessments.

Examples

Meets the rule
Covered GenAI service providers performs the required action "perform" for required security assessments within these source conditions: Services with public-opinion attributes or social mobilization capability, and retains evidence.
Does not meet the rule
Covered GenAI service providers omits the required action "perform" for required security assessments while those source conditions apply.
Outside scope
The actor, activity, jurisdiction, or applicability conditions in this source variant do not match.

Evidence & enforcement

  • Dated record of the action
  • Responsible actor and approval, where required
  • Applicable source edition and scope

Human or authorized system adapter required. Machine-executable: no. Convert to a reviewed organization contract and validate the adapter before deployment.

Limits

A rule card is an interpretation aid, not an applicability determination.

Equivalent intent does not make different source obligations interchangeable.

Owner review

Record your interpretation decision. This does not adopt a policy for an organization.

Owner sign-in

JSON rule card
{
  "id": "AIR-0029859136",
  "version": 2,
  "title": "Perform required security assessments",
  "text": "Covered GenAI service providers must perform required security assessments.",
  "topic": "Security",
  "intent": "perform required security assessments",
  "status": "candidate",
  "semanticStatus": "human-validation-required",
  "variants": [
    {
      "sourceId": "cn-genai-interim",
      "control": "Article 17",
      "sourceVersion": "Order 15; effective 2023-08-15",
      "url": "https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm",
      "actor": "Covered GenAI service providers",
      "modality": "must",
      "action": "perform",
      "object": "required security assessments",
      "condition": "Services with public-opinion attributes or social mobilization capability",
      "exception": "Article 2 scope and cross-referenced Chinese laws apply",
      "timing": null,
      "authority": "binding-within-scope",
      "jurisdiction": "China",
      "checkedAt": "2026-10-03",
      "status": "interpretation-needs-review",
      "examples": {
        "meetsRule": "Covered GenAI service providers performs the required action \"perform\" for required security assessments within these source conditions: Services with public-opinion attributes or social mobilization capability, and retains evidence.",
        "doesNotMeetRule": "Covered GenAI service providers omits the required action \"perform\" for required security assessments while those source conditions apply.",
        "outOfScope": "The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."
      }
    }
  ],
  "situation": "An AI system or employee activity involves required security assessments. Confirm the actor and source conditions before using this template.",
  "purpose": "Provide a traceable control for the action: perform required security assessments.",
  "examples": {
    "meetsRule": "Covered GenAI service providers performs the required action \"perform\" for required security assessments within these source conditions: Services with public-opinion attributes or social mobilization capability, and retains evidence.",
    "doesNotMeetRule": "Covered GenAI service providers omits the required action \"perform\" for required security assessments while those source conditions apply.",
    "outOfScope": "The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."
  },
  "evidence": [
    "Dated record of the action",
    "Responsible actor and approval, where required",
    "Applicable source edition and scope"
  ],
  "enforcement": {
    "mode": "policy-template",
    "adapter": "Human or authorized system adapter required",
    "machineExecutable": false
  },
  "limitations": [
    "A rule card is an interpretation aid, not an applicability determination.",
    "Equivalent intent does not make different source obligations interchangeable."
  ],
  "createdAt": "2026-10-03",
  "updatedAt": "2026-10-03"
}
Back to registry