Designing a China AI Cross-Border Data Workshop

A cross-border data workshop should produce a map of actual processing activities. Document where data is collected, stored, accessed, logged and deleted, including remote support and third-party services. The map gives technical and legal teams a common object to review; it does not replace an assessment of applicable legal requirements.

What to evaluate

Purpose

Define the business activity and decision rather than discussing data in the abstract.

Data map

Identify fields, sensitivity, origin, storage, access, transfer and retention.

Actor map

Separate controller, processor, vendor, affiliate, user and accountable owner roles.

Options

Compare localisation, minimisation, anonymisation, controlled access and alternative architectures.

Worked evaluation exercise

The following is an illustrative assessment exercise, not a reported customer result.

For a document-assistant exercise, trace an uploaded file through extraction, prompts, model inference, diagnostic logs and backups. Record each organisation that can access the contents and the retention settings at every step. Start demonstrations with synthetic documents. Before using company information, have the responsible teams verify permissions, contractual terms and transfer arrangements for the intended deployment. Avoid treating the location of the main database as proof that no cross-border access occurs.

Questions for the operating team

• Which data needs to move and why?
• Can the objective be met with less or different data?
• Who confirms the legal and security interpretation?

Warning signs

• One diagram used for every use case.
• Technical encryption presented as legal approval.
• Unknown subprocessors.

Planning the visit

Use these questions to scope an industry-focused China AI program. Agree which records and operating workflows can be examined before confirming meetings; host participation and access require confirmation. Our research method explains how we structure the brief and follow-up.

References and scope

These references provide policy or risk-management context. They do not independently verify a host's performance or the illustrative exercise above.

• OECD AI Principles
• NIST AI Risk Management Framework