Server Location Doesn't Matter—Where Your Users Are Does
A lot of so-called AI going-global just means parking servers in Singapore, wrapping an offshore model API, and still serving users inside China. That move is worthless for compliance. This lesson clears the test first, then what real going-global actually requires.
These Measures apply to the provision of services that generate text, images, audio, video, or other content to the public within the territory of the People’s Republic of China by using generative artificial intelligence technology (hereinafter “generative artificial intelligence services”).
The anchor in the text is providing to the public within the territory—nowhere does the statute treat server location as the test. So “servers overseas, therefore not regulated” fails at step one.
Think you’ve dodged domestic filing
Call overseas services directly
Users, billing, and promotion all domestic
Scope turns on whom you serve
Where generative artificial intelligence services originating outside the People’s Republic of China are provided into the territory in a manner that does not comply with laws, administrative regulations, or these Measures, the national cyberspace administration authorities shall notify the relevant institutions to take technical and other necessary measures to handle the matter.
That article says offshore-origin services can still be disposed of. For a product, the risk is three things: access blocked, forced remediation, business plan interrupted. The first two are technical; the third hurts most—users and revenue are domestic, so one broken link stops the business.
Treating compliance as a cost to cut
Skip what you can, dodge what you can. You save a few weeks of process and gamble the product’s survival. And products like this don’t scale—the closer you get to real size, the closer you get to being disposed of.
Treating compliance as part of the roadmap
Serving users inside China? Follow domestic rules: filings, security assessment and algorithm filing when required, and the ICP stack from Lesson 8—all on the plan. Once that’s done, you can promote in the open.
Same move—put the business overseas—very different outcomes depending on why.
Strategic choice
- Expand on purpose into a larger or better-fit market
- Diversify markets; reduce single-market dependence
- Access local technology and resources
- Strengthen core competitiveness
- Backed by a long-term plan
Compliance reverse-run
- Passively evade regulation
- Bypass policy limits
- Hunt for a regulatory lowland
- Only to dodge domestic competitive pressure
- No long-term strategy
Going-global is strategy-driven at its core. Compliance is a means—it shouldn’t be the purpose of going global. Real going-global is when strategy and compliance both hold.
Real going-global is a fully independent new project—not bolting an overseas domain onto the existing product.
Set up a lawful entity in the target country or region and finish local review
Data compliance (e.g. GDPR), tax, labor, IP—map each item
Actually build product and service for local users; grow long-term relationships
Three classic fake moves
No lawful overseas entity—only a shell; ignore local legal compliance and sit on risks that can blow anytime; no real local-user operations—registration numbers look great, retention near zero.
It’s really commercial and cultural localization
Technical hookup is the easy step. Hard parts: pricing, payments, support, content habits, building local trust. Schedule it like starting over—budget and energy as a new project.
Three questions—answer them, then see the verdict.
- An overseas entity isn’t just a registration fee. Annual filings, audits, local agents, and tax advisors are fixed costs—a one-person company must afford them before starting.
- Don’t skimp on local counsel. One fine in data compliance or tax dwarfs the advisory fee.
- Validate demand lightly first: content, community, small paid tests. Confirm people there actually pay before talking about an entity.
Not going global? Walking the domestic path solidly is still a complete path.
- Domain and server filings done before go-live (Lesson 8).
- If you charge users, registered capital and business scope must meet ICP license thresholds (Lessons 8 and 9).
- For generative AI services with public-opinion attributes or social-mobilization capacity, conduct the required security assessment and complete algorithm filing—follow competent authorities’ concrete requirements.
The test is whom you serve, not where the servers sit. Users inside China means domestic rules reach you.
Offshore-origin services can still be disposed of. Access blocks, forced remediation, business interruption—all real costs.
Going-global must be strategy-driven. Compliance is a means; making it the purpose starts the motive wrong.
Real going-global is its own project: compliant entity, local counsel, real user operations. Budget it like starting over.
Sources: Interim Measures for the Management of Generative Artificial Intelligence Services (Cyberspace Administration of China and six other departments; published July 13, 2023; effective August 15, 2023), Articles 2, 17, 20, 21, and 23. GDPR means the EU General Data Protection Regulation (GDPR). Specific requirements for overseas entities, tax, and data compliance follow the current law of the target country or region and professional advice. Verified 2026-08-10.