China GB/T 45654-2025 Basic Security Requirements for Generative AI Services for DPOs

China's national standard for generative AI service security: the training data requirements (source sampling with a five per cent threshold, diversity, provenance and licences, corpus filtering, intellectual property and personal information protection, annotator qualification, annotation rules, accuracy review and isolated storage), the model requirements (content security as a training objective, framework audits and backdoor detection, a ninety per cent output pass rate, refusal behaviour, synthetic content labelling, input monitoring, reassessment after major updates, training and inference isolation) and the security measures (use-case justification, high-risk scenario and minor protection, transparency, opt-out from training on user input, complaints, abusive input handling and monitoring staff, continuity and on-device model security), with the 31-risk taxonomy and the assessment method. Under China GB/T 45654-2025 Basic Security Requirements for Generative AI Services, which defines 22 controls, a DPO's work is deciding which controls you own outright, which you share and which belong to another team, then holding the evidence for the first group.