TLDR; Below is the English-translated version of China’s Provisions on the Administration of Deep Synthesis of Internet Information Services (互联网信息服务深度合成管理规定, Cyberspace Administration of China, Ministry of Industry and Information Technology, and Ministry of Public Security Order No. 12), published November 25, 2022 and in effect since January 10, 2023.
If your product generates or edits text, images, audio, video, or virtual scenes for users in mainland China — AI chatbots, synthetic voices, face-swapping, AI writing assistants, or immersive avatars — these Provisions govern how you may offer it. They require real-identity verification of users, separate consent before any feature edits a person’s face or voice, conspicuous labeling of synthetic content, security assessments, and filing. Built on the Cybersecurity Law and the Personal Information Protection Law (PIPL), they share a filing regime with the Algorithm Recommendation Provisions and sit next to the Generative AI Measures as the rules every international business should confirm with counsel before deploying generative or synthetic-media features in China.
Provisions on the Administration of Deep Synthesis of Internet Information Services (Promulgated November 25, 2022 by Order No. 12 of the Cyberspace Administration of China, the Ministry of Industry and Information Technology, and the Ministry of Public Security; effective January 10, 2023)
Chapter I — General Provisions
Article 1. These Provisions are formulated in accordance with the “Cybersecurity Law of the People’s Republic of China,” the “Data Security Law of the People’s Republic of China,” the “Personal Information Protection Law of the People’s Republic of China,” the “Measures for the Administration of Internet Information Services,” and other laws and administrative regulations, in order to strengthen the administration of deep synthesis in internet information services, carry forward the core socialist values, safeguard national security and the public interest of society, and protect the lawful rights and interests of citizens, legal persons, and other organizations.
Article 2. These Provisions apply to the application of deep synthesis technology to provide internet information services (hereinafter referred to as “deep synthesis services”) within the territory of the People’s Republic of China. Where laws or administrative regulations provide otherwise, those provisions shall prevail.
Article 3. The national cyberspace administration department is responsible for the overall coordination of the governance of deep synthesis services and the related supervision and administration work throughout the country. The telecommunications authority and the public security department of the State Council are responsible, in accordance with their respective duties, for the supervision and administration of deep synthesis services.
Local cyberspace administration departments are responsible for the overall coordination of the governance of deep synthesis services and the related supervision and administration work within their respective administrative regions. Local telecommunications authorities and public security departments are responsible, in accordance with their respective duties, for the supervision and administration of deep synthesis services within their respective administrative regions.
Article 4. The provision of deep synthesis services shall comply with laws and regulations, respect social morality and ethics, adhere to the correct political direction, guidance of public opinion, and value orientation, and promote deep synthesis services toward what is positive and good.
Article 5. Relevant industry organizations are encouraged to strengthen industry self-discipline, establish and improve industry standards, industry codes of conduct, and self-regulatory management systems, and to urge and guide deep synthesis service providers and technical supporters to formulate and improve business norms, carry out their business in accordance with the law, and accept social oversight.
Chapter II — General Rules
Article 6. No organization or individual may use deep synthesis services to produce, reproduce, publish, or disseminate information prohibited by laws or administrative regulations, or use deep synthesis services to engage in activities prohibited by laws or administrative regulations, such as endangering national security and interests, damaging the national image, infringing upon the public interest of society, disrupting economic and social order, or infringing upon the lawful rights and interests of others.
Deep synthesis service providers and users may not use deep synthesis services to produce, reproduce, publish, or disseminate false news information. Where news information that was produced and published based on deep synthesis services is reproduced, the news information published by an internet news information source unit shall be reproduced in accordance with the law.
Article 7. Deep synthesis service providers shall implement their primary responsibility for information security, establish and improve management systems for user registration, review of algorithm mechanisms and principles, science and technology ethics review, review of information publication, data security, personal information protection, countering telecommunications network fraud, and emergency response, and shall have secure and controllable technical safeguard measures.
Article 8. Deep synthesis service providers shall formulate and make public their management rules and platform conventions, improve their service agreements, perform their management responsibilities in accordance with the law and with those agreements, and, in a conspicuous manner, remind deep synthesis service technical supporters and users to undertake their information security obligations.
Article 9. Deep synthesis service providers shall, based on means such as mobile phone numbers, identity document numbers, unified social credit codes, or the national network identity authentication public service, authenticate the real-identity information of deep synthesis service users in accordance with the law, and may not provide information publication services to deep synthesis service users who have not undergone real-identity information authentication.
Article 10. Deep synthesis service providers shall strengthen the management of deep synthesis content and adopt technical or manual means to review the input data and synthesis results of deep synthesis service users.
Deep synthesis service providers shall establish and improve a feature database for identifying illegal and harmful information, improve the standards, rules, and procedures for entering information into the database, and record and retain the relevant network logs.
Where a deep synthesis service provider discovers illegal or harmful information, it shall take disposal measures in accordance with the law, preserve the relevant records, and promptly report to the cyberspace administration department and the relevant competent departments; and shall, in accordance with the law and with the agreements, take disposal measures against the relevant deep synthesis service users, such as issuing warnings, restricting functions, suspending services, or closing accounts.
Article 11. Deep synthesis service providers shall establish and improve a rumor-refutation mechanism; where they discover that deep synthesis services are being used to produce, reproduce, publish, or disseminate false information, they shall promptly take rumor-refutation measures, preserve the relevant records, and report to the cyberspace administration department and the relevant competent departments.
Article 12. Deep synthesis service providers shall set up convenient entry points for user appeals and for public complaints and reports, make public the handling process and the time limits for feedback, and promptly accept, handle, and give feedback on the results of handling.
Article 13. Application distribution platforms, such as internet application stores, shall implement their security management responsibilities for listing review, routine management, and emergency response, and shall verify the security assessment, filing, and other such status of deep synthesis applications; where there is a violation of relevant state provisions, they shall promptly take disposal measures such as refusing to list, issuing warnings, suspending services, or removing the application from the shelves.
Chapter III — Data and Technology Management Norms
Article 14. Deep synthesis service providers and technical supporters shall strengthen the management of training data and take necessary measures to ensure the security of training data; where the training data contains personal information, they shall comply with the relevant provisions on the protection of personal information.
Where deep synthesis service providers and technical supporters provide functions for editing biometric information such as faces or voices, they shall remind deep synthesis service users to notify, in accordance with the law, the individuals whose information is edited, and to obtain their separate consent.
Article 15. Deep synthesis service providers and technical supporters shall strengthen technology management and periodically review, assess, and verify the mechanisms and principles of generative-synthesis algorithms.
Where deep synthesis service providers and technical supporters provide tools such as models or templates that have the following functions, they shall, in accordance with the law, carry out a security assessment on their own or entrust a professional institution to do so:
(1) Generating or editing biometric information such as faces or voices;
(2) Generating or editing non-biometric information such as special objects or scenes that may involve national security, the national image, national interests, or the public interest of society.
Article 16. For information content generated or edited using its services, a deep synthesis service provider shall adopt technical measures to add a label that does not affect users’ use, and shall preserve log information in accordance with laws, administrative regulations, and relevant state provisions.
Article 17. Where a deep synthesis service provider provides the following deep synthesis services that may cause the public to be confused or to misidentify content, it shall, at a reasonable position or area of the generated or edited information content, apply a conspicuous label to alert the public to the deep synthesis situation:
(1) Services for generating or editing text that simulates a natural person, such as intelligent dialogue or intelligent writing;
(2) Services for generating voice, such as synthesized voices or voice imitation, or for editing that significantly alters personal identity characteristics;
(3) Services for generating images or videos of persons, such as face generation, face replacement, face manipulation, or posture manipulation, or for editing that significantly alters personal identity characteristics;
(4) Services for generating or editing immersive, realistic scenes;
(5) Other services that have the function of generating or significantly altering information content.
Where a deep synthesis service provider provides deep synthesis services other than those specified in the preceding paragraph, it shall provide a conspicuous-labeling function and remind deep synthesis service users that they may apply a conspicuous label.
Article 18. No organization or individual may use technical means to delete, tamper with, or conceal the deep synthesis labels provided for in Articles 16 and 17 of these Provisions.
Chapter IV — Supervision, Inspection, and Legal Liability
Article 19. Deep synthesis service providers that have public-opinion attributes or the capacity for social mobilization shall carry out filing and the procedures for modification and cancellation of filing in accordance with the “Provisions on the Administration of Algorithm Recommendation in Internet Information Services.”
Deep synthesis service technical supporters shall carry out filing and the procedures for modification and cancellation of filing with reference to the provisions of the preceding paragraph.
Deep synthesis service providers and technical supporters that have completed filing shall indicate their filing number in a conspicuous position on the websites, applications, and the like through which they provide services to the public, and shall provide a link to the public-disclosure information.
Article 20. Where a deep synthesis service provider develops and launches new products, new applications, or new functions that have public-opinion attributes or the capacity for social mobilization, it shall carry out a security assessment in accordance with relevant state provisions.
Article 21. The cyberspace administration department, the telecommunications authority, and the public security department shall, in accordance with their duties, conduct supervision and inspection of deep synthesis services. Deep synthesis service providers and technical supporters shall cooperate in accordance with the law and provide necessary support and assistance, including technology and data.
Where the cyberspace administration department and the relevant competent departments discover that a deep synthesis service presents a relatively large information security risk, they may, in accordance with their duties and the law, require the deep synthesis service provider and technical supporter to take measures such as suspending information updates, user account registration, or other related services. The deep synthesis service provider and technical supporter shall take measures as required, carry out rectification, and eliminate the hidden dangers.
Article 22. Where a deep synthesis service provider or technical supporter violates these Provisions, it shall be punished in accordance with the provisions of the relevant laws and administrative regulations; where serious consequences are caused, it shall be given a heavier punishment in accordance with the law.
Where the conduct constitutes a violation of public security administration, the public security organ shall impose a public security administration punishment in accordance with the law; where a crime is constituted, criminal liability shall be pursued in accordance with the law.
Chapter V — Supplementary Provisions
Article 23. The meanings of the following terms in these Provisions are as follows:
“Deep synthesis technology” refers to technology that uses generative-synthesis algorithms such as deep learning and virtual reality to produce network information such as text, images, audio, video, and virtual scenes, including but not limited to:
(1) Technology for generating or editing text content, such as article generation, text-style conversion, and question-and-answer dialogue;
(2) Technology for generating or editing voice content, such as text-to-speech, voice conversion, and voice-attribute editing;
(3) Technology for generating or editing non-voice content, such as music generation and scene-sound editing;
(4) Technology for generating or editing biometric features in image or video content, such as face generation, face replacement, personal-attribute editing, face manipulation, and posture manipulation;
(5) Technology for generating or editing non-biometric features in image or video content, such as image generation, image enhancement, and image restoration;
(6) Technology for generating or editing digital persons or virtual scenes, such as three-dimensional reconstruction and digital simulation.
“Deep synthesis service provider” refers to an organization or individual that provides deep synthesis services.
“Deep synthesis service technical supporter” refers to an organization or individual that provides technical support for deep synthesis services.
“Deep synthesis service user” refers to an organization or individual that uses deep synthesis services to produce, reproduce, publish, or disseminate information.
“Training data” refers to the annotated or benchmark data sets used to train machine-learning models.
“Immersive, realistic scene” refers to a highly realistic virtual scene, generated or edited using deep synthesis technology, that participants can experience or interact with.
Article 24. Where deep synthesis service providers and technical supporters engage in online publishing services, online cultural activities, or online audiovisual program services, they shall at the same time comply with the provisions of the competent departments for press and publication, culture and tourism, and radio and television.
Article 25. These Provisions shall take effect on January 10, 2023.
Closing
The original document was published in Chinese by the Cyberspace Administration of China (together with the Ministry of Industry and Information Technology and the Ministry of Public Security); we translated it into English, which is what you read above. This translation is provided for quick comprehension only and should be used at your own discretion and risk — always confirm the current requirements with qualified legal counsel.
If you need further help from our team, contact us today, and our experts will help you keep your presence in China compliant from the ground up.
