To secure both national interests and AI development, China should adopt a tiered regulatory regime for cross‑border generative AI training data; drawing on EU rights‑focused and U.S. market/security approaches, the paper recommends differentiated data preconditions, an independent regulator with multilevel coordination, and international articulation of China's data governance.

Main Finding

Cross-border flows of generative AI training data create large-scale, transboundary security, economic, and privacy risks driven by data scale, spillovers, and fragmented governance; a workable response for China is a tiered, classified regulatory architecture (differentiated data preconditions, an independent regulator with multilevel coordination, and proactive international engagement) that balances national security and AI development while reducing regulatory uncertainty and contributing to global rule-making.

Key Points

• Risk drivers
  • Scale: training modern generative models requires massive, heterogeneous datasets from multiple jurisdictions, increasing volume and velocity of cross-border transfers.
  • Spillover effects: noncompliance or embedded biases can propagate internationally via models, affecting economic, political, and military domains.
  • Regulatory difficulty: jurisdictional fragmentation, divergent norms (sovereignty vs. free data flow), and the dynamic data needs of ML complicate oversight.
• Structural legal sources of risk
  • Global inequalities in access to training data create competitive asymmetries and constrain policy choices for many states.
  • Divergent national rules (localization, approval procedures, liability allocation) produce overlapping obligations, regulatory-selection paradoxes, and compliance uncertainty.
  • Data mobility undermines effective sovereign control; localization can produce silos and unintended vulnerabilities.
• Practical governance challenges
  • Equity: unregulated flows risk “data colonialism,” concentrating value in a few multinationals and reducing developing countries to raw-data suppliers.
  • National security: multimodal datasets may contain strategic information (infrastructure, geolocation, health/genetics) that, if transferred, increase exposure.
  • Privacy and re-identification: generative models intensify re-identification risks and complicate rights such as the right to be forgotten.
• Comparative models
  • European Union: rights-oriented, stringent risk control (risk classification in AI Act, GDPR adequacy, SCCs/BCRs), high compliance costs but strong privacy and strategic-data protections.
  • United States: market-oriented pragmatism combining decentralized law with executive-national-security instruments (CLOUD Act, Executive Orders) that both facilitate allied transfers and block access for “countries of concern.”
• Proposed Chinese approach
  • Leverage existing legal matrix (National Security Law; Cybersecurity, Data Security, Personal Information Protection Laws; Measures and Interim AI rules).
  • Adopt classified/graded protection of training data and proportionate transfer conditions (free flow for low-risk data; restricted for sensitive categories).
  • Create an independent regulator supported by multilevel coordination and full-process auditability.
  • Pursue international interoperability while articulating a distinct Chinese governance position.

Data & Methods

• Methodology: qualitative comparative legal and policy analysis; normative institutional design.
• Sources analyzed: primary legal instruments and policies (EU AI Act and GDPR mechanisms; U.S. legislative/ executive measures including CLOUD Act and relevant Executive Orders; Chinese Cybersecurity Law, Data Security Law, Personal Information Protection Law, Measures for Cross-Border Data Transfers, Interim Measures for Generative AI), plus secondary literature on AI governance, security, and economic distributional effects.
• No empirical datasets or econometric analysis—argumentation builds from legal texts, regulatory practice, and techno-legal characteristics of generative AI.

Implications for AI Economics

• Market structure and competition
  • Access to cross-border training data is a competitive input; restrictive regimes raise incumbents’ advantage where they control large datasets and infrastructure, potentially entrenching digital monopolies.
  • A tiered Chinese system that enables low-risk flows while restricting sensitive data could help domestic firms access diverse training inputs and capture more AI value, but will raise compliance costs.
• Innovation and productivity
  • Broad, frictionless data access lowers marginal costs of model improvement and accelerates innovation; conversely, fragmentation/localization raises costs, slows iteration, and may reduce global diffusion of productivity gains.
  • Targeted regimes (classification/grading) can balance innovation incentives with protection of strategic assets if implemented with clarity and predictability.
• Trade, investment, and global value chains
  • Differing regimes (EU strictness, U.S. strategic filtering, China’s tiered control) increase transaction costs for cross-border data-dependent services and may fragment markets, altering FDI patterns in cloud and AI services.
  • Adequacy frameworks, SCCs/BCRs, and interoperability arrangements are economically important mechanisms that reduce frictions and enable trade in data-intensive services.
• Distributional effects and digital development
  • Unregulated flows risk value capture by advanced economies/tech firms; regulated, reciprocity-aware policies can protect domestic data value and foster local AI ecosystems.
  • However, tighter controls may impede smaller firms’ access to global datasets, raising entry costs and necessitating supporting public infrastructure (data commons, compute).
• Policy uncertainty and risk premia
  • Regulatory fragmentation and rapid rule changes raise compliance risk and regulatory uncertainty, increasing cost of capital for AI ventures and potentially slowing investment.
  • Transparent, rule-based tiering with clear criteria reduces informational and compliance frictions, lowering risk premia and supporting longer-term investment in domestic AI capabilities.

Overall, regulatory design around cross-border training-data flows will materially shape comparative advantages in AI, distribution of rents from data, innovation trajectories, and the international structure of AI markets. The paper’s proposed tiered, interoperable Chinese framework aims to preserve development potential while managing those economic risks, but will require careful calibration to avoid excessive compliance costs or unintended protectionism.