China’s Ethics Review Measures for AI Research

The Measures, issued jointly in September 2023 by China’s Ministry of Science and Technology and other agencies, set procedures for ethics review of scientific and technological activities. They apply to work involving human research participants, including the use of personal-information data; experimental animals; activities without direct human or animal subjects that may create ethical risks to health, the environment, public order, or sustainable development; and other activities specified by law or policy. AI appears expressly in the institutional responsibilities. Universities, research organizations, medical institutions, and companies are responsible for ethics review management within their organizations. Organizations conducting AI research in ethically sensitive areas should establish an ethics review committee. Committees should assess scientific and social value, risks and benefits, safeguards, data and algorithm practices, fairness, transparency, reliability, controllability, user rights, and emergency plans. They also provide consultation, monitor approved work where required, train staff, manage conflicts, and handle complaints. The procedure is not a one-time formality: review can include follow-up and oversight. A project lead should first conduct an ethics risk assessment and determine whether the activity falls within the measures’ scope. If review is required, the application describes the project, methods, risks, mitigation, qualifications, data sources, consent, and conflicts. The committee selects the review procedure; standard review is generally by meeting, while specific provisions allow expedited or simplified paths. If the organization’s committee cannot review the work, the measures provide for written referral to another suitable committee. International collaborative work in scope must satisfy ethics-review requirements in the participating countries. The measures do not mean that any use of AI automatically needs external ethics approval, nor do they replace privacy, cybersecurity, or sector-specific law. Institutions should map research activities, participants, data, and potential impacts to the defined triggers and retain decisions, conditions, and monitoring records.