China's Cross-Border Health Data and AI Governance: From Strict Control to "Managed Openness"

China's Cross-Border Health Data and AI Governance: From Strict Control to "Managed Openness"

Introduction: The Atlantic Council recently released an in-depth report, "Balancing Openness and Control: China's Cross-Border Health Data and AI Governance," which systematically analyzes how China is building an institutional framework in this field that balances national security, industrial competition, and scientific research collaboration. The report argues that China is treating health data, genomic data, and AI training datasets as strategic economic resources and is building a "managed openness" model for cross-border data flows around this core. This model will have far-reaching implications for multinational pharmaceutical companies, medical technology firms, and the global governance landscape of the digital economy. Against the backdrop of increasingly intense international AI competition, understanding China's choices and pathways has become an unavoidable issue for global business decision-makers.

Event Background: The Strategization of Health Data and the Layering of Multiple Regulations

China's health data governance is not a single legal provision but a complex superimposition of multiple regulatory departments and institutional frameworks. The report points out that the Cyberspace Administration of China (CAC), the National Health Commission, the Ministry of Science and Technology, as well as local and industry bodies at various levels, all play roles in this system. The Regulations on the Management of Human Genetic Resources, effective in 2019, was once the main control tool for the outbound transfer of genetic data. However, with the implementation of the Data Security Law and the Personal Information Protection Law, health data has also simultaneously entered the regulatory scope of both "important data" and "sensitive personal information."

However, the draft implementation rules for the Regulations on the Management of Human Genetic Resources and the Ethical Guidelines for Human Genomic Data Research, released in 2026, reveal a new approach: China intends to distinguish between low-risk clinical collaboration and high-risk strategic data. For specific projects such as oncology drug development and multi-center clinical trials, regulators are attempting to introduce ethics committee review and more industry guidance to replace some front-end security approvals. Meanwhile, more sensitive resources involving genomes and multimodal biometric data will remain under strict state control.

The report emphasizes that this "refined tiering" does not mean opening the floodgates, but rather further institutionalizing control over "which data can cross borders, with whom it can be shared, and how it can be shared." For multinational companies, the complexity of compliance has not decreased; on the contrary, it has increased due to the superimposition of multiple regulations.

Digital Economy Analysis: The Tension Between Data Sovereignty and the AI Race

In the context of the digital economy, the value of health data has long transcended the scope of personal privacy, becoming core fuel for AI model training, precision medicine, and new drug development. China has a super-large population structure and rapidly upgrading medical digitalization infrastructure, which gives its health data pool unique strategic significance. The report points out that the deployment of AI in clinical, administrative, and pharmaceutical fields is highly dependent on large-scale, high-quality, and interoperable datasets.This creates a structural contradiction: on one hand, China needs to unlock the innovation potential of AI and biotechnology through internal data integration; on the other, it must strengthen controls over external access to prevent strategic data flows to other countries. The report summarizes this state as "tight externally, loose internally": domestically, regulators encourage medical data to circulate within controlled environments and promote the construction of data centers and industry data platforms; at the outbound stage, they set up checkpoints such as security assessments, localized storage, and regulatory review.

From the perspective of the global digital economy, this strategy essentially embeds data governance into industrial policy. Data is no longer just a commercial asset, but a foundational element of national competitiveness. For multinational enterprises that rely on global data flows for scientific research collaboration, this means they must reposition themselves within a data ecosystem whose boundaries are drawn by nation-states.

Business Model Observations: Compliance Restructuring and Localization Opportunities for Multinational Enterprises

The report clearly points out that foreign multinational companies conducting health-data-related business in China are facing increasingly high compliance thresholds. In the past, multinational pharmaceutical companies were accustomed to aggregating global clinical trial data at headquarters for analysis; now, Chinese patient data must remain within the country and may only flow abroad to a limited extent after meeting the security assessment requirements for outbound data transfers. This forces companies to redesign their data architectures: building local data nodes, deploying localized ethics review processes, and establishing partnerships with Chinese institutions that have strong regulatory communication capabilities.

This adjustment has given rise to new business opportunities. Demand is rising for compliance consulting, data security audits, privacy-enhancing technologies (such as federated learning), and transparency reporting tools for regulators. At the same time, the report also observes that in priority areas such as oncology and biopharmaceuticals, China is proactively providing "controlled channels" for multinational cooperation through pilot free trade zones, negative lists, and pilot projects. This means that companies willing to make long-term investments in local compliance capabilities and deeply integrate with China's regulatory ecosystem may actually gain a first-mover advantage in the next round of opening-up.

In terms of business models, the market is shifting from a "globally unified data pipeline" to "regionalized data corridors." Companies need to develop multi-tiered cross-border data strategies based on data sensitivity, industry classification, and partners. The ability to efficiently manage this complexity will become a core competitive barrier for multinational health companies.

Market Competition Analysis: Local AI Beneficiaries and Multinational Challenges

China's strict control over cross-border health data flows has objectively created a structural advantage for local AI healthcare companies. Local companies find it easier to access the country's vast clinical and genomic datasets, enabling them to train models more suited to Chinese population characteristics while enjoying lower compliance costs. This could lead to a "two-track system" in the AI healthcare market: Chinese companies dominate the local market, while multinational companies participate mainly in specific research or commercialization projects through partnerships with local players.However, the report also cautions that China is not closing its doors to all cooperation. On the contrary, in order to absorb global innovation resources and accelerate drug development, China is selectively expanding openness beyond high-risk areas. The professional capabilities of multinational companies in fields such as oncology and rare diseases remain scarce resources, and data collaboration in these areas often receives support from relevant authorities. Therefore, the key to competition is no longer simply technology or capital, but the network of mutual trust and collaboration between companies and regulators, hospitals, and research institutions.

At the level of platform competition, customer stickiness for health AI platforms depends heavily on data accumulation and algorithm iteration. Local platforms with data resources are expected to gain stronger network effects in future commercialization. Multinational companies, if they fail to adjust in time, may be squeezed out of core markets.

Data and Regulatory Implications: From "Important Data" to Dynamic Risk Management

The report offers a clear assessment of China's future policy direction. In the short term, cross-border data regulation will become further industry-specific and scenario-based, with free trade zones and pilot projects providing more experimental grounds for compliant and lawful data flows. In the medium term, the regulatory focus will shift from "front-end approval" to "post-hoc auditing," and the weight of institutional ethics committees and industry self-regulatory mechanisms in governance structures will increase. In the long term, China is likely to develop a comprehensive system framed around "managed openness," which, while preserving sovereignty over critical data, will allow some data to flow across borders through secure channels.

This trend has profound implications for global data regulation. Major economies such as the EU and the United States will have to reckon with a more proactive and systematic Chinese data governance model. Against the backdrop of the increasing convergence of the Data Security Law and AI governance rules, multinational companies must simultaneously comply with multiple obligations, including cross-border data transfer, lawful sources of training data for AI models, content labeling, and explainability. This "stacking of rules" significantly raises compliance costs and also becomes a new growth driver for the data governance market.

Regulation itself is also becoming "data-driven": through means such as audit logs and regulatory technology, it enables more precise ex-post tracking and enforcement. This means that companies not only need to demonstrate compliance ex ante, but also need to maintain records of transparency over the long term to cope with dynamic regulation.

Global Trend Observation: Fragmentation of Data Governance and the Diffusion of "Managed Openness"

The Chinese model is not an isolated phenomenon. The report suggests observing it from a global trend perspective: data sovereignty demands are spreading across multiple economies. The United States has strengthened export reviews of biological data, the EU is advancing the construction of "data spaces," and emerging markets such as India are also requiring data localization. China's uniqueness lies in its deep integration of health data with AI strategy, and its reliance on a vast population base to form a closed loop of "data–AI–bioeconomy."If this model proves to be sustainable and effective, it is likely to lead other countries to follow suit in sensitive data domains, further accelerating the fragmentation of global digital economy governance. However, complete data decoupling is not realistic. China still needs global scientific research collaboration and the biomedical market, while multinational enterprises still hope to enter China's vast healthcare market. Therefore, "managed openness" may become a middle path that countries choose between security and economy.

For global business decision-makers, this means a new set of competitive rules: the digital economy of the future is not a single open platform, but rather is composed of multiple regulated "corridors." Enterprises need to establish nodes at the intersections of corridors, become familiar with the compliance language of each jurisdiction, and elevate data governance capabilities into strategic capabilities.