ARCHETYPAL

Establish a lawful basis for training on personal information

AIR-231E86FCF1 · version 2 · Privacy · candidate interpretation

Covered GenAI service providers must establish a lawful basis for training on personal information.

Situation & purpose

An AI system or employee activity involves a lawful basis for training on personal information. Confirm the actor and source conditions before using this template.

Provide a traceable control for the action: establish a lawful basis for training on personal information.

Examples

Meets the rule
Covered GenAI service providers performs the required action "establish" for a lawful basis for training on personal information within these source conditions: Consent or another legal basis, and retains evidence.
Does not meet the rule
Covered GenAI service providers omits the required action "establish" for a lawful basis for training on personal information while those source conditions apply.
Outside scope
The actor, activity, jurisdiction, or applicability conditions in this source variant do not match.

Evidence & enforcement

  • Dated record of the action
  • Responsible actor and approval, where required
  • Applicable source edition and scope

Human or authorized system adapter required. Machine-executable: no. Convert to a reviewed organization contract and validate the adapter before deployment.

Limits

A rule card is an interpretation aid, not an applicability determination.

Equivalent intent does not make different source obligations interchangeable.

Owner review

Record your interpretation decision. This does not adopt a policy for an organization.

Owner sign-in

JSON rule card
{
  "id": "AIR-231E86FCF1",
  "version": 2,
  "title": "Establish a lawful basis for training on personal information",
  "text": "Covered GenAI service providers must establish a lawful basis for training on personal information.",
  "topic": "Privacy",
  "intent": "establish a lawful basis for training on personal information",
  "status": "candidate",
  "semanticStatus": "human-validation-required",
  "variants": [
    {
      "sourceId": "cn-genai-interim",
      "control": "Article 7(3)",
      "sourceVersion": "Order 15; effective 2023-08-15",
      "url": "https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm",
      "actor": "Covered GenAI service providers",
      "modality": "must",
      "action": "establish",
      "object": "a lawful basis for training on personal information",
      "condition": "Consent or another legal basis",
      "exception": "Article 2 scope and cross-referenced Chinese laws apply",
      "timing": null,
      "authority": "binding-within-scope",
      "jurisdiction": "China",
      "checkedAt": "2026-10-03",
      "status": "interpretation-needs-review",
      "examples": {
        "meetsRule": "Covered GenAI service providers performs the required action \"establish\" for a lawful basis for training on personal information within these source conditions: Consent or another legal basis, and retains evidence.",
        "doesNotMeetRule": "Covered GenAI service providers omits the required action \"establish\" for a lawful basis for training on personal information while those source conditions apply.",
        "outOfScope": "The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."
      }
    }
  ],
  "situation": "An AI system or employee activity involves a lawful basis for training on personal information. Confirm the actor and source conditions before using this template.",
  "purpose": "Provide a traceable control for the action: establish a lawful basis for training on personal information.",
  "examples": {
    "meetsRule": "Covered GenAI service providers performs the required action \"establish\" for a lawful basis for training on personal information within these source conditions: Consent or another legal basis, and retains evidence.",
    "doesNotMeetRule": "Covered GenAI service providers omits the required action \"establish\" for a lawful basis for training on personal information while those source conditions apply.",
    "outOfScope": "The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."
  },
  "evidence": [
    "Dated record of the action",
    "Responsible actor and approval, where required",
    "Applicable source edition and scope"
  ],
  "enforcement": {
    "mode": "policy-template",
    "adapter": "Human or authorized system adapter required",
    "machineExecutable": false
  },
  "limitations": [
    "A rule card is an interpretation aid, not an applicability determination.",
    "Equivalent intent does not make different source obligations interchangeable."
  ],
  "createdAt": "2026-10-03",
  "updatedAt": "2026-10-03"
}
Back to registry