Asia-Pacific: China’s Supreme People’s Court Publishes AI-Fabricated Review Case; MOFCOM Responds to Distillation Allegations; South Korea Strengthens Breach Notification; Japan Examines AI Risks to Consumer Decision-Making

On 9 September 2026, China’s Supreme People’s Court published the 2026 Representative Unfair Competition Cases of the People’s Courts. Case Six concerns unfair competition involving the use of AI to fabricate reviews of competitors’ products at scale and drive traffic to the defendant’s own products.

Liability was established under the good-faith and business-ethics requirements of the general clause of the Anti-Unfair Competition Law. This publication presents a representative case based on a judgment that has already taken legal effect. The defendant software company used AI to generate descriptions and reviews of a competitor’s purchasing, sales and inventory management software, published them on its own website, and placed links to its own products before and after the articles. The People’s Court of Xinwu District, Wuxi, Jiangsu Province held that fabricating reviews at scale and using search results to drive traffic to the defendant’s own products improperly diverted the competitor’s business opportunities while generating junk information, polluting data and disrupting fair competition. It ordered the defendant to compensate the claimant for economic losses. The first-instance judgment has taken legal effect; the case number is (2024) Su 0214 Min Chu No. 9489.

Enterprises using AI to produce competitor comparisons, product reviews and marketing articles at scale should place fact-checking before automated publication. Drawing on the generation, publication and traffic-diversion process in this case, verifiable materials such as product documentation and test records should underpin content generation. Publication should be blocked where performance claims, accounts of user experience or comparative conclusions lack supporting sources. Content containing competitor names and links to the enterprise’s own products should then be reviewed by a designated responsible person. At the technical level, permissions for content generation and website publication can be configured separately. Supporting materials, generated versions, human edits, approval records and link destinations can be retained to trace how disputed content was produced. When procuring outsourced content, enterprises should also agree on the delivery of factual evidence and procedures for takedown and correction, rather than relying solely on publication volume, search rankings or clicks as acceptance criteria. These are control recommendations derived from the judgment; the case establishes no uniform human-review procedure or log-retention period.

The application of the general clause already has a legal foundation. The Interpretation of the Supreme People’s Court on Several Issues Concerning the Application of the Anti-Unfair Competition Law of the People’s Republic of China, effective from 20 March 2022, clarified the conditions for applying the general clause beyond specific provisions. This case illustrates that existing approach in the context of AI-generated marketing at scale. In the United States, the Federal Trade Commission’s (FTC) Rule on the Use of Consumer Reviews and Testimonials took effect on 21 October 2024 and covers conduct including AI-generated fake consumer reviews. The two approaches address related risks through China’s general competition-law clause and a specific US marketing rule, respectively. Their scope and conditions for liability differ and should not be treated as equivalent. Enterprises operating across borders should distinguish content categories such as competitor descriptions, consumer experiences and independent endorsements. Future monitoring can examine how similar cases use factual substantiation, traffic-diversion methods and evidence of harm to distinguish genuine comparisons from improper diversion of business opportunities.

On 9 September 2026, China’s Ministry of Commerce (MOFCOM) published a response to media questions concerning US allegations of model distillation by Chinese AI companies, setting out its position on geographic restrictions in model service agreements and potential countermeasures.

The response is a statement of policy position and announces no new access ban, licensing regime or list of countermeasures. Model distillation in this context involves using the outputs of existing models to train other models. MOFCOM emphasised distillation’s neutral technical nature and widespread industry use, questioned broad geographic restrictions imposed by some US model companies in user agreements, and opposed support from security agencies for such commercial restrictions. The statement also proposed discussing differences through intergovernmental dialogue and said that China would take countermeasures if the United States used efforts to combat distillation as a pretext to contain or suppress Chinese AI companies. It did not specify the measures or their implementation dates.

When deploying models, enterprises should verify model access eligibility and authorisation to reuse outputs separately, particularly where teams access overseas models through third parties or use model outputs to create training data. Procurement reviews can require suppliers to identify authorised service regions, upstream model sources and resale authorisations, and separately confirm whether outputs may be used to train other models. Research and development workflows can record data sources, applicable contract versions and training purposes, avoiding the assumption that permission for ordinary business calls also authorises model training. The US advisory recommends stronger account verification, cross-platform correlation analysis and changes to responses where malicious distillation is suspected. Operations teams should therefore also prepare channels for challenging access restrictions or changes in output quality, alongside authorised alternative models. These are risk management recommendations based on public documents. MOFCOM’s statement creates none of these technical obligations and does not rule that any specific supplier terms are invalid.

On 27 July 2026, MOFCOM had already opposed US investigations and sanctions against Chinese companies on grounds of distillation. The latest response focuses more specifically on geographic restriction clauses and security agencies’ involvement in commercial activity, continuing its opposition to turning technological competition into restrictive measures. The advisory issued by the US National Security Agency (NSA) and two other agencies also recognises legitimate research uses of distillation, but characterises the alleged extraction of restricted proprietary capabilities as a security threat. The disagreement therefore concerns how specific access activities should be characterised and what policy support supplier restrictions should receive. It cannot be reduced to one side permitting distillation and the other prohibiting it. Subsequent monitoring should focus on whether implementing documents identify the entities covered, legal bases and effective dates, and whether suppliers actually change their contracts and access conditions.

On 10 September 2026, South Korea’s Personal Information Protection Commission (PIPC) announced implementation arrangements for the amended Personal Information Protection Act (PIPA) and accompanying rules, confirming that provisions on breach notification, management accountability and penalties would take effect on 11 September 2026.

The new rules bring notification forward to the stage at which objective evidence supports a reasonable assessment that a breach is highly likely, requiring affected individuals to be notified within 72 hours of awareness of the relevant facts. The mere discovery of a vulnerability does not automatically trigger notification. Forgery, alteration or destruction of personal information is also brought within notification and reporting requirements, and notices must now include guidance on remedies such as compensation claims and mediation. Business heads bear ultimate management and oversight responsibility. Organisations meeting the applicable thresholds must obtain a board resolution and report to the PIPC when appointing or removing a Chief Privacy Officer (CPO), whose responsibilities include personnel management, securing budget resources and reporting to the board. Certain repeated or serious violations may attract administrative penalty surcharges of up to 10% of total turnover, while qualifying preventive investment may support reductions or exemptions.

For AI customer service, enterprise knowledge bases or automated agents subject to PIPA, enterprises should integrate security alerts, CPO assessment and notification approval into a single response workflow. For example, where unusual bulk access to conversation logs containing personal information is detected, or a knowledge base is suspected of leaking data, teams can record the time of first awareness, accessing accounts, affected data and grounds for the assessment in parallel. They should assess notification triggers promptly, rather than making a complete forensic report a prerequisite for starting that assessment. Contracts with model providers, cloud providers and system integrators should address early reporting of anomalies, delivery of evidence and cooperation in investigations, supporting decisions within statutory deadlines. Management should also identify who is responsible for suspending data connections, restricting account permissions and approving external notifications. CPO risk reports, staffing and budget approvals, and remediation records should be retained so that oversight responsibilities can be verified against actual decisions. These measures are recommendations for implementing general personal information protection obligations in AI use cases.

These arrangements follow the legislative amendments promulgated on 10 March 2026. Mandatory Personal Information & Information Security Management System (ISMS-P) certification for key organisations is separately scheduled to take effect on 1 July 2027. According to the announcement, its scope will be specified in subsequent implementing rules. The European Union’s General Data Protection Regulation (GDPR), already in force, distinguishes notification to the supervisory authority from communication to affected individuals. The former is subject to a 72-hour deadline after awareness where the risk threshold is met; the latter generally requires a likelihood of high risk and must occur without undue delay. South Korea’s new 72-hour requirement concerns notification to individuals at the stage when a breach is highly likely. The recipients and triggers therefore differ between the two regimes. Enterprises operating across jurisdictions should configure recipients, assessment thresholds and the start of the notification clock separately, while continuing to check whether South Korea’s detailed certification rules apply to their operations.

On 10 September 2026, the Consumer Commission of Japan’s Cabinet Office published materials from the ninth meeting of its Expert Panel on the Use of Artificial Intelligence Technology and Consumer Issues, held on 9 September. The materials address the effects of conversational AI and AI agents on autonomous consumer decision-making.

The published materials comprise a draft summary of deliberations and an expert presentation; they introduce no new mandatory compliance obligations. The secretariat’s draft examines the cumulative effects of multi-turn conversations and risks from agent decision-making: AI can infer emotions and preferences from conversations and influence choices through sycophancy and anthropomorphism, while agent execution can translate conversational errors into adverse real-world outcomes. Professor Koji Yatani of the University of Tokyo recommended evaluating viewpoint diversity across multi-turn interactions and assessing models, guardrails and interfaces as an integrated system. These recommendations are not yet formal Commission rules.

Teams deploying AI shopping assistants, companion services and purchasing agents can use these materials to refine product testing and transaction authorisation. Tests should assess the model, recommendation ranking, guardrails and interface together, simulating complete conversations in which users decline a purchase, have insufficient budgets or repeatedly hesitate, and checking whether the system applies persistent pressure, narrows alternatives or acts beyond its authority. Before conversational profiles enter promotional systems, their intended use should be reviewed. Purchasing, contracting and payment functions should each have defined authorisation scopes, spending limits and confirmation steps. To support complaint investigations, enterprises should retain records that allow decision-making and execution to be reconstructed, linking model and prompt versions, key recommendations, user authorisations and tool calls within defined scope and retention limits, and agreeing on investigation responsibilities with model and execution service providers. These are deployment measures derived from the risks and system-evaluation recommendations in the materials, not new statutory obligations arising from the deliberations.

The first meeting, held on 13 February 2026, had already identified interference with autonomous consumer decision-making as an area for examination and proposed assessing the capacity of existing laws and new governance measures to address it. The latest materials consolidate the first eight discussions. Subsequent monitoring can track how the identified risks and design recommendations are incorporated into the formal report. In the European Union, Article 5 of the Artificial Intelligence Act (AI Act) already prohibits certain forms of manipulation, deception and exploitation of vulnerabilities, with the relevant provisions applicable since 2 February 2025. The prohibitions on manipulation or deception involve conditions including impairment of informed decision-making, material distortion of behaviour, and actual or reasonably likely significant harm. Enterprises operating across jurisdictions can reuse conversational risk tests, but should separately document the progress of Japan’s deliberations and their conclusions on the applicability of the EU prohibitions.