China: Closed consultation on TC260 Data Security Specifications for Generative Artificial Intelligence Pre-training Standards including design requirement

On 2 June 2024, China's National Information Security Standardization Technical Committee (TC260) closed its consultation on the draft Data Security Specifications for Generative Artificial Intelligence Pre-training and Optimisation Training of Information Security Technology standard. The standard includes a series of design requirements concerning the classification and management of pre-training and fine-tuning data, including the obligation to add metadata such as source information, URLs, dataset names, organisation names, service names, and user identification numbers to all data samples. For fine-tuning data, data samples composed of content generated by generative AI should also include metadata such as the model version and acquisition time. Data collection from websites should record the URLs, while data from organisations or individuals should have transaction contracts, agreements, or authorisation documents. Comprehensive, representative, and regularly updated keyword databases of at least 10'000 keywords should be used to identify data containing security and intellectual property infringement risks, and there should be multiple data sources for pre-training the same type of data. The classification model should completely cover all security risks listed in the appendix.