China GB/T 45654-2025 Basic Security Requirements for Generative AI Services 4.1.3: Management and traceability of training data sources: licences, collection records, commercial contracts and user authorisation

What does 4.1.3 require?

For open-source training data the provider must comply with the dataset's open-source licence or hold the relevant authorisation documents; where a dataset aggregates links or addresses that point to or generate other content, that content is treated as self-collected data. For self-collected data (self-generated or scraped from the internet) it must keep collection records and must not collect data others have clearly marked as not collectable, such as pages protected by robots protocols or other technical restrictions, or personal information whose subject has refused collection. For commercial training data it must hold a legally effective transaction contract or cooperation agreement, must not use data where the counterparty cannot give commitments and supporting evidence on source, quality and security, and must review the data, commitments and evidence supplied. Where users' input is used as training data it must hold records of the users' authorisation.