Compliance
NVIDIA TensorRT-LLM in China (mainland)
Structured issue-spotting for deploying NVIDIA TensorRT-LLM in China (mainland), read against the rules for that jurisdiction.
- Source
- Rules engine over a generic brief — no anchored quote on this page
- Verified
- Evidence not verified
- Confidence
- Low
Structured issue-spotting to support your own review — not legal advice. Verify against the cited primary sources and your counsel.
01What this reading assumes
- Jurisdiction
- China (mainland)
- Principal framework
- Personal Information Protection Law (PIPL), in force since 1 November 2021. Requires a lawful basis, notice, and separate consent for defined activities including providing personal information to a third party, publicising it, processing sensitive personal information and sending it abroad. Sensitive personal information needs a specific purpose, sufficient necessity and strict protective measures. A personal information protection impact assessment is required before high-risk processing, including any outbound transfer. Article 38 sets the outbound routes. Entrusted processing must be governed by a contract that fixes purpose, period, method and protective measures.
- Delivery assessed
- Self-hosted
- Data leaves the network
- no
- Vendor home jurisdiction
- United States
- Verified vendor positions
- none — every vendor position below is a question, not an assurance
- Rules evaluated
- 39
- Rules fired
- 11
Assumptions about use
- An internal deployment used by employees, not a public-facing product.
- A person reads the output before acting on it — but that is not recorded, so the engine reports it as a gap rather than assuming it.
- No significant automated decision is taken about a person by the system alone.
02Issues to work through
China
Classify the data before deciding where it may go
The Data Security Law establishes a data classification and grading protection system, with heavier duties attaching to important data. Until the corpus has been classified, it is not possible to say whether important data is in it — and every downstream decision about processing location and outbound transfer depends on that answer.
- Required checks
- Classify the repositories in scope against the applicable sector catalogue before indexing.
- Record the classification and who made it, because it will be asked for.
- Re-check when the corpus expands; the classification is about content, not about the system.
- Technical controls
- Carry the classification label through ingestion so it constrains where a document may be processed.
Human review required — take this to your counsel
A personal information protection impact assessment, kept for three years
PIPL requires an impact assessment before processing sensitive personal information, using personal information for automated decision-making, entrusting processing or providing information to another handler, and sending it abroad. The assessment and the processing record must be retained. An AI deployment usually triggers more than one of these at once.
- Required checks
- Run one assessment covering every trigger the deployment engages, rather than several partial ones.
- Record the retention period for the assessment itself.
- Vendor questions
- Will you provide the technical detail we need to complete the assessment?
Human review required — take this to your counsel
Settle whether the generative AI measures reach this service
The Interim Measures apply to using generative AI technology to provide content-generation services to the public inside China. Services with public-opinion attributes or social mobilisation capability must undergo a security assessment under the applicable rules. An internal enterprise assistant is normally outside that scope, but the scope question has to be settled and recorded, because the answer drives filing and assessment obligations.
- Required checks
- Decide whether the service is provided to the public in China, and write down why.
- If it is, establish whether it has public-opinion attributes or social mobilisation capability.
- Where either applies, plan for the security assessment and algorithm filing lead time.
- Vendor questions
- Have you completed the security assessment and algorithm filing for your service in China?
Human review required — take this to your counsel
PIPL — a basis, and a notice that matches what you are doing
PIPL applies to processing the personal information of natural persons inside China, and Article 3 extends it to processing outside China aimed at offering products or services to people in China or analysing their behaviour. Processing needs a statutory basis and a notice that truthfully describes the purposes, methods, categories and retention period. An AI feature added to an existing system usually changes all four, which means the notice changes too. A separate set of simplified measures for handlers of fewer than 100,000 individuals’ personal information takes effect on 1 September 2026 and was not yet applicable when this page was reviewed.
- Required checks
- Rewrite the notice for the AI processing rather than appending a sentence to the old one.
- Identify the statutory basis; consent is common but not the only route.
- Check whether the organisation would fall inside the small-handler simplified measures once they apply.
Cross Cutting
Self-hosting moves the security obligation to you
Keeping data on your own hardware answers the transfer question and creates an operations question. Patching, backups, key management, monitoring and incident response are now yours, and an unpatched inference server on the office network is a worse outcome than a well-run vendor.
- Required checks
- Name the person responsible for patching each component, and the cadence.
- Confirm backups exist, are encrypted, and have been restored at least once.
- Confirm there is an incident response path that includes this system.
- Technical controls
- Encrypt at rest and in transit, including between the application and the inference server.
- Centralise authentication through the existing identity provider rather than local accounts.
- Keep an audit log of who queried what, and protect it from the people it records.
- Subscribe to security advisories for each component and track upgrade lag.
Being able to reconstruct a decision months later
The question that arrives after a complaint is what the system was shown and what it produced on a particular day. Models change, prompts change, and indexes are rebuilt, so the answer has to be recorded at the time. Without it, the only available response is that the output cannot be reproduced.
- Required checks
- Decide what is recorded per interaction: model and version, prompt template version, retrieved document ids, output, reviewer and outcome.
- Set how long those records are kept, balanced against the retention duties that also apply to them.
- Vendor questions
- Does the vendor pin model versions, and how much notice is given before a model is retired or changed?
- Technical controls
- Version prompt templates in source control and log the version used.
- Log the model identifier and version returned by the provider, not the one you requested.
Confidentiality duties bind independently of data protection law
Material can be entirely free of personal data and still be the material a contract stops you disclosing. Client retainers, non-disclosure agreements, supplier contracts and common-law duties are the usual sources, and several of them require consent before a third party processes the material at all — which a model API call is.
- Required checks
- Review the confidentiality clauses in the contracts covering the material going into the system.
- Identify any contract requiring notice or consent before a subcontractor processes the material.
- Decide whether the deployment needs a confidentiality carve-out negotiated into new contracts.
- Vendor questions
- Will the vendor accept a confidentiality undertaking beyond its standard terms?
- Which staff at the vendor can access customer content, under what controls?
- Technical controls
- Segregate the most sensitive corpora into an index that the general assistant cannot reach.
Human review required — take this to your counsel
We were not told whether a person reviews the output
Where output influences a decision about a person, the reviewer has to be able to disagree with it. That needs three things a rubber-stamp review lacks: enough information to judge, enough time to judge, and an override that is used often enough to be real. Design it before the volume makes it impossible.
- Required checks
- Name the role that reviews the output and what they see when they do.
- Decide what evidence is retained about each review, so the practice can be shown to exist.
- Set a threshold below which the system must not act without review.
- Vendor questions
- Does the product expose the retrieved context and the confidence behind a suggestion, or only the answer?
- Technical controls
- Show the reviewer the retrieved sources next to the suggestion, not the suggestion alone.
- Record the reviewer’s decision, including overrides, as part of the audit trail.
Human review required — take this to your counsel
An AI deployment creates new copies of the data
Vector indexes, prompt logs, completion caches, evaluation datasets, fine-tuning checkpoints and backups are all copies of the source material in places the existing retention schedule does not mention. Deletion requests are the moment this is discovered, because deleting the source document does not delete its embedding.
- Required checks
- List every store the deployment creates and add each to the retention schedule.
- Establish how a deletion request propagates to the index, the caches and the logs.
- Establish how long backups keep material that has been deleted from the live system.
- Vendor questions
- What does the vendor retain, where, and for how long after we delete our copy?
- Technical controls
- Store the source document id with every embedding so deletion can cascade.
- Set time-to-live on prompt and completion logs rather than relying on manual cleanup.
Who can reach the model, the index and the weights
A self-hosted stack has three access surfaces that are easy to leave open: the inference endpoint, the vector index, and the weights on disk. Retrieval also carries an authorisation problem an ordinary application does not have — the index must not return a document to someone who could not open it in the source system.
- Required checks
- Confirm the inference endpoint is not reachable from outside the network and requires authentication.
- Confirm retrieval filters by the requesting user’s permissions, not only by relevance.
- Confirm who can read the model files and the index volume at the operating-system level.
- Technical controls
- Bind the inference server to a private interface and put an authenticating proxy in front of it.
- Carry document-level access control into the index and enforce it at query time.
- Encrypt the volume holding the weights and the index, and restrict it to the service account.
- Rotate API keys and keep them out of client-side code and container images.
What ends up in a prompt, and where it goes next
Even with inference inside the network, prompts and retrieved context accumulate in logs, traces and caches, and system prompts can often be extracted from the output. The leak path is internal rather than external, but it is still a copy of the source material in a new place.
- Required checks
- Write down which categories of information may be entered into a prompt, and tell people.
- Establish what the system prompt contains and whether disclosing it would matter.
- Establish which shadow tools staff are already using; the policy has to name the permitted ones.
- Vendor questions
- Are prompts and completions retained, for how long, and can retention be set to zero?
- Are prompts used for abuse monitoring, and if so who can read them and for how long?
- Technical controls
- Redact or block high-risk patterns before the prompt leaves the application.
- Keep prompt and completion logs out of general-purpose observability tools.
- Set an explicit retention period on prompt logs and enforce it.
Structured issue-spotting to support your own review — not legal advice. Verify against the cited primary sources and your counsel.
03What this reading does not know
- Whether any of the data falls into a special or sensitive category.
- Whether any material is covered by legal professional privilege.
- Whether a person reviews the output before it is acted on.
04Instruments these issues point at
- statutePIPLChina’s personal information law. Requires a lawful basis and separate consent for defined activities, imposes heightened rules on sensitive personal information, requires a personal information protection impact assessment for high-risk processing, and sets the outbound transfer routes in Article 38. It applies to processing inside China and, in defined cases, to processing abroad.
- statuteDSLEstablishes a data classification and grading protection system, with heavier duties for important data. Article 36 prohibits organisations and individuals in China from providing data stored in China to a foreign judicial or law-enforcement authority without approval from the competent Chinese authority.
- statuteCSLChina’s network security statute, republished after the 28 October 2025 amending Decision. The amendment added support for artificial intelligence research and for AI ethics and risk monitoring, cross-referenced the PIPL, raised penalty ceilings, and renumbered the articles from 79 to 81.
- regulationSmall Handler Simplified MeasuresCreates a lighter PIPL compliance tier for a small personal information handler, defined as one processing the personal information of fewer than 100,000 individuals. Published on 24 July 2026 and applicable from 1 September 2026, so it was adopted but not yet applicable when this page was reviewed.
- regulationGenerative AI Interim MeasuresApplies to the use of generative AI technology to provide text, image, audio or video generation services to the public inside China. Services with public-opinion attributes or social mobilisation capability must undergo a security assessment and complete algorithm filing under the applicable rules. In-house tools that are not offered to the public fall outside the stated scope.
05Vendor documents being watched
- Data processing agreementhttps://www.nvidia.com/en-us/agreements/data-processing-addendum/nvidia-cloud-services-data-processing-addendum/not yet fetched
- Privacy policyhttps://www.nvidia.com/en-us/about-nvidia/privacy-policy/not yet fetched
- Security pagehttps://www.nvidia.com/privacy-center/not yet fetched
- Terms of servicehttps://developer.nvidia.com/legal/termsnot yet fetched
06Ask about your own deployment
This page reads the rules against a generic organisation. Your size, industry, data and existing contracts change which of these issues matter and which fall away.