AI Regulation Tracker / New guidance

China's Financial Regulator Issues Its First AI Rulebook for Banks and Insurers, and Bars Customer Data From Training Generative Models

Regulatory summary: The Guiding Opinions on the Safe Development and Application of Artificial Intelligence in the Banking and Insurance Industry (关于银行业保险业人工智能安全开发应用的指导意见), issued by China's National Financial Regulatory Administration (NFRA) as Jin Fa [2026] No. 8 around June 18, 2026, is China's first comprehensive AI framework written specifically for financial institutions.

China's National Financial Regulatory Administration has issued Guiding Opinions setting 32 requirements across seven pillars for how banks and insurers build and run artificial intelligence, including full-lifecycle model management, human oversight in high-risk uses, and an outright ban on using names, ID numbers, phone numbers, and bank-card numbers to train generative AI.

Primary source

By Anthony Guerriero, Founder, The Leveraged Years · Reviewed by The Leveraged Years Editorial Desk · Published July 9, 2026 · Last updated July 9, 2026

China's Financial Regulator Issues Its First AI Rulebook for Banks and Insurers, and Bars Customer Data From Training Generative Models regulation briefing

The Leveraged Years AI Regulation Tracker

Key takeaways

China moved from general, cross-sector AI and data rules to a single sector-specific rulebook for finance. Banks and insurers now face 32 concrete requirements covering governance structure, development and deployment, data governance, computing power, risk governance, safe-development capability, and supervision. New operative duties include full-lifecycle AI management, graded risk classification, mandatory human oversight and emergency shutdown for high-risk applications, admission controls for generative-AI models, mandatory reporting to the regulator when generative AI is used in public-facing or high-risk scenarios, and an explicit prohibition on training or optimizing generative models with personal identifiers.
Model-risk and AI-governance teams at PRC banks and insurers; chief data officers and data-governance functions; compliance and internal audit; technology and information-security leads; and the AI vendors, foundation-model providers, and cloud and computing suppliers that sell into Chinese financial institutions. Multinational banks and insurers with China operations fall in scope for those operations.
Status: Issued and in effect as a supervisory framework.
Build a complete inventory of AI applications, tag which ones are high-risk or public-facing, confirm the human-oversight and kill-switch path for each, and run a data-lineage check to prove that names, ID numbers, phone numbers, and bank-card numbers are excluded from generative-AI training and tuning sets.

Regulatory Briefing

Bindingness: Regulatory guiding opinions (指导意见) issued by the national financial regulator, operative on release. Guiding opinions are supervisory documents that bind the institutions the NFRA regulates, setting expectations the regulator will inspect and enforce. This is not primary legislation and not a consultation draft. A supporting industry technical framework and classification standards are directed to follow.
Scope: Banking and insurance financial institutions operating in the People's Republic of China, referred to in the document as financial institutions. It reaches their AI governance, model-risk, compliance, data-governance, and technology functions, and extends through outsourcing and supply-chain rules to the external vendors, model providers, and cloud and computing suppliers those institutions rely on.
What Changed: China moved from general, cross-sector AI and data rules to a single sector-specific rulebook for finance. Banks and insurers now face 32 concrete requirements covering governance structure, development and deployment, data governance, computing power, risk governance, safe-development capability, and supervision. New operative duties include full-lifecycle AI management, graded risk classification, mandatory human oversight and emergency shutdown for high-risk applications, admission controls for generative-AI models, mandatory reporting to the regulator when generative AI is used in public-facing or high-risk scenarios, and an explicit prohibition on training or optimizing generative models with personal identifiers.
Who This Affects: Model-risk and AI-governance teams at PRC banks and insurers; chief data officers and data-governance functions; compliance and internal audit; technology and information-security leads; and the AI vendors, foundation-model providers, and cloud and computing suppliers that sell into Chinese financial institutions. Multinational banks and insurers with China operations fall in scope for those operations.
Current Status: Issued and in effect as a supervisory framework. Publicly announced around June 18, 2026, with the NFRA publishing an official interpretation on June 22, 2026. The regulator has committed to build out an industry technical framework, graded classification standards, monitoring, and periodic supervisory assessment.
Effective Date: Operative on issuance around June 18, 2026. The document does not set a separate transition or grace period in its interpretation; supporting standards and supervisory mechanics are to be developed on an ongoing basis.
Primary Source: NFRA, 关于银行业保险业人工智能安全开发应用的指导意见 (Jin Fa [2026] No. 8), https://www.nfra.gov.cn/cn/view/pages/governmentDetail.html?docId=1261784
Secondary Analysis: NFRA official Q&A interpretation republished by the Ningxia financial committee office (June 22, 2026); Ministry of Commerce policy database entry (policy.mofcom.gov.cn, id 9222); Jilin provincial financial bureau republication; CCTV and Sina Finance reporting (June 18, 2026).
Workflow Impact: Institutions must stand up a board-level AI committee, maintain a lifecycle management system from requirement analysis to retirement, run graded risk classification, build human intervention and emergency-shutdown procedures for high-risk uses, apply admission review to internally built and externally sourced generative models, label AI-generated content, audit algorithms for explainability, and remove personal identifiers from generative-model training and optimization data.
Operational Next Step: Build a complete inventory of AI applications, tag which ones are high-risk or public-facing, confirm the human-oversight and kill-switch path for each, and run a data-lineage check to prove that names, ID numbers, phone numbers, and bank-card numbers are excluded from generative-AI training and tuning sets.
Last Verified: July 10, 2026

Date	Jurisdiction	Rule	Affected professionals	Status or effective date
2026-07-09	China	China moved from general, cross-sector AI and data rules to a single sector-specific rulebook for finance. Banks and insurers now face 32 concrete requirements covering governance structure, development and deployment, data governance, computing power, risk governance, safe-development capability, and supervision. New operative duties include full-lifecycle AI management, graded risk classification, mandatory human oversight and emergency shutdown for high-risk applications, admission controls for generative-AI models, mandatory reporting to the regulator when generative AI is used in public-facing or high-risk scenarios, and an explicit prohibition on training or optimizing generative models with personal identifiers.	Model-risk and AI-governance teams at PRC banks and insurers; chief data officers and data-governance functions; compliance and internal audit; technology and information-security leads; and the AI vendors, foundation-model providers, and cloud and computing suppliers that sell into Chinese financial institutions. Multinational banks and insurers with China operations fall in scope for those operations.	Issued and in effect as a supervisory framework. Publicly announced around June 18, 2026, with the NFRA publishing an official interpretation on June 22, 2026. The regulator has committed to build out an industry technical framework, graded classification standards, monitoring, and periodic supervisory assessment.

Source File

Instrument: Guiding Opinions on the Safe Development and Application of Artificial Intelligence in the Banking and Insurance Industry (关于银行业保险业人工智能安全开发应用的指导意见)
Authority: National Financial Regulatory Administration (NFRA / 国家金融监督管理总局), People's Republic of China
Date: Issued around June 18, 2026; official interpretation published June 22, 2026
Citation: Jin Fa [2026] No. 8 (金发〔2026〕8号)
Primary Source: https://www.nfra.gov.cn/cn/view/pages/governmentDetail.html?docId=1261784
Corroboration: NFRA official Q&A interpretation (republished by the Ningxia financial committee office, June 22, 2026), http://jrjgj.nx.gov.cn/zcfg/zcjd/wzjd/202606/t20260622_5270140.html ; Ministry of Commerce policy database entry, https://policy.mofcom.gov.cn/claw/policyInfo.shtml?id=9222 ; full-text republication confirming the Article 24 personal-data prohibition; CCTV and Sina Finance reporting, June 18, 2026.

Frequently Asked Questions

Is this a binding rule or just guidance?

It is a set of regulatory guiding opinions issued by China's National Financial Regulatory Administration as Jin Fa [2026] No. 8. Guiding opinions are operative supervisory documents that bind the banks and insurers the NFRA regulates and that the regulator inspects and enforces. It is not a consultation draft.

Can a Chinese bank use customer data to train a generative AI model?

Not if that data includes the named identifiers. The document prohibits using personal information and privacy data such as names, ID numbers, phone numbers, and bank-card numbers to train or optimize generative AI models. Institutions must desensitize training and optimization data and prove the exclusion.

What counts as a high-risk AI application under the framework?

The document requires graded risk classification based on factors such as the importance of the business scenario, application scale, impact on customers, degree of model dependence, and model complexity. High-risk applications trigger human oversight and intervention, emergency-shutdown and retirement conditions, backup processes, and mandatory reporting to the regulator when generative AI is used in public-facing or high-risk scenarios.

Does it apply to foreign banks and insurers in China?

It applies to banking and insurance financial institutions operating in China, so the China operations of foreign banks and insurers fall in scope. The duties also extend to AI vendors and computing suppliers through the outsourcing and supply-chain provisions.

When does it take effect?

It is already in effect as a supervisory framework, announced around June 18, 2026, with an official interpretation published on June 22, 2026. The regulator has said it will develop a supporting industry technical framework, classification standards, and ongoing supervision.