China GB/T 45654-2025 Basic Security Requirements for Generative AI Services 4.1.1: Training data source selection: sample before and after collection, reject sources above five per cent illegal or unhealthy content

What does 4.1.1 require?

Before collecting from a prospective data source, the provider must run a random-sample security evaluation of it and must not collect from a source where more than five per cent of the sampled content is illegal or unhealthy information; after collection it must run a random-sample security check on the data collected from each source and must not use the data from a source where more than five per cent of the sample is illegal or unhealthy information. A source means a domain, a data supplier or an open-source dataset; sampling may be by manual inspection, keyword checks or classifier models, and the risks counted are the 29 in Appendix A groups A.1 to A.4.