Establish a lawful basis for training on personal information

{
  "key": "AIR-231E86FCF1@f84f67f595b58984",
  "id": "AIR-231E86FCF1",
  "version": "f84f67f595b58984",
  "kind": "rule",
  "lifecycle": "LEGACY_PUBLISHED",
  "title": "Establish a lawful basis for training on personal information",
  "statement": "Covered GenAI service providers must establish a lawful basis for training on personal information.",
  "family": "Privacy",
  "body": {
    "legacy": {
      "id": "AIR-231E86FCF1",
      "version": 2,
      "title": "Establish a lawful basis for training on personal information",
      "text": "Covered GenAI service providers must establish a lawful basis for training on personal information.",
      "topic": "Privacy",
      "intent": "establish a lawful basis for training on personal information",
      "status": "candidate",
      "semanticStatus": "human-validation-required",
      "variants": [
        {
          "sourceId": "cn-genai-interim",
          "control": "Article 7(3)",
          "sourceVersion": "Order 15; effective 2023-08-15",
          "url": "https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm",
          "actor": "Covered GenAI service providers",
          "modality": "must",
          "action": "establish",
          "object": "a lawful basis for training on personal information",
          "condition": "Consent or another legal basis",
          "exception": "Article 2 scope and cross-referenced Chinese laws apply",
          "timing": null,
          "authority": "binding-within-scope",
          "jurisdiction": "China",
          "checkedAt": "2026-10-03",
          "status": "interpretation-needs-review",
          "examples": {
            "meetsRule": "Covered GenAI service providers performs the required action \"establish\" for a lawful basis for training on personal information within these source conditions: Consent or another legal basis, and retains evidence.",
            "doesNotMeetRule": "Covered GenAI service providers omits the required action \"establish\" for a lawful basis for training on personal information while those source conditions apply.",
            "outOfScope": "The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."
          }
        }
      ],
      "situation": "An AI system or employee activity involves a lawful basis for training on personal information. Confirm the actor and source conditions before using this template.",
      "purpose": "Provide a traceable control for the action: establish a lawful basis for training on personal information.",
      "examples": {
        "meetsRule": "Covered GenAI service providers performs the required action \"establish\" for a lawful basis for training on personal information within these source conditions: Consent or another legal basis, and retains evidence.",
        "doesNotMeetRule": "Covered GenAI service providers omits the required action \"establish\" for a lawful basis for training on personal information while those source conditions apply.",
        "outOfScope": "The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."
      },
      "evidence": [
        "Dated record of the action",
        "Responsible actor and approval, where required",
        "Applicable source edition and scope"
      ],
      "enforcement": {
        "mode": "policy-template",
        "adapter": "Human or authorized system adapter required",
        "machineExecutable": false
      },
      "limitations": [
        "A rule card is an interpretation aid, not an applicability determination.",
        "Equivalent intent does not make different source obligations interchangeable."
      ],
      "createdAt": "2026-10-03",
      "updatedAt": "2026-10-03"
    },
    "sourceRelease": "2026-10-03.2",
    "adopted": false,
    "machineExecutable": false
  },
  "versions": [
    {
      "version": "f84f67f595b58984",
      "key": "AIR-231E86FCF1@f84f67f595b58984"
    }
  ],
  "provenance": [],
  "relationships": [
    {
      "id": "MAP-4176bf7b867cd930e5dd7283",
      "from": "AIR-231E86FCF1@f84f67f595b58984",
      "to": "REQ-be26153c6c755675a45d@a6a1bf3fdf49809c",
      "kind": "SUPPORTED_BY_SOURCE_REQUIREMENT",
      "status": "SOURCE_REPORTED_REVIEW_REQUIRED",
      "body": {
        "sourceKey": "cn-genai-interim@d7fc895a372e",
        "locator": "Article 7(3)"
      },
      "fromKeys": [
        "AIR-231E86FCF1@f84f67f595b58984"
      ],
      "toKeys": [
        "REQ-be26153c6c755675a45d@a6a1bf3fdf49809c"
      ],
      "resolution": "RESOLVED_REFERENCE_REVIEW_REQUIRED"
    }
  ]
}