Provisions on the Administration of Deep Synthesis Internet Information Services
China · Regulation · National Internet Information Office, Ministry of Industry and Information Technology, Ministry of Public Security
High impact. A reviewer confirms each change before it is listed here.
Our summary
This regulation establishes management requirements for internet services using deep synthesis technology, such as deepfakes and synthetic media generation. It applies to all organizations and individuals providing such services within China and requires them to implement content moderation, user authentication, technical safeguards, and disclosure mechanisms to prevent misuse and protect public safety and individual rights.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
30 sections
Jump to a chapter
第一章 General provisions
5 sections
This chapter covers the foundational rules on deep synthesis internet information services, encompassing purpose, scope, regulatory authorities, service provider obligations, and industry self-discipline mechanisms.
第一条 Legislation purpose
The regulation aims to strengthen management of deep synthesis technology in internet information services, uphold socialist core values, protect national security and public interests, and safeguard the lawful rights of citizens, organizations and entities, based on cybersecurity, data protection, personal information protection and internet service management laws.
第二条 Scope of application
This regulation applies to the provision of internet information services using deep synthesis technology within China, except where other laws and administrative regulations provide different requirements.
第三条 Regulatory authorities
The national internet authority has overall coordinating responsibility for deep synthesis service governance and supervision; national telecommunications and public security authorities handle supervision within their respective jurisdictions; local internet, telecommunications and public security authorities hold parallel responsibilities within their administrative regions.
第四条 Service provider obligations
Service providers must comply with laws and regulations, respect public morality and ethics, maintain correct political, editorial and values orientation, and promote positive development of deep synthesis services.
第五条 Industry self-discipline
Industry organizations are encouraged to strengthen self-regulation by establishing and improving industry standards, codes of conduct and self-discipline mechanisms, and by guiding service providers and technology supporters to develop sound business practices, operate lawfully and accept public oversight.
第二章 General regulations
8 sections
This chapter establishes general obligations for deep synthesis service providers, including prohibited activities, information security responsibilities, management rules and user agreements.
第六条 Prohibited activities
No organization or individual may use deep synthesis services to produce, copy, publish or disseminate information or engage in activities prohibited by law, including those harming national security, damaging state image, undermining public interests or infringing rights; service providers and users are specifically prohibited from creating false news and must repost news from authorized sources rather than materials derived from deep synthesis technology.
第七条 Provider security responsibilities
Service providers must implement information security responsibility, establish and maintain systems for user registration, algorithm auditing, ethics review, content review, data security, personal information protection, fraud prevention and emergency response, and deploy secure technical safeguards.
第八条 Service rules and agreements
Service providers must formulate and publicly disclose management rules and platform covenants, complete service agreements, perform management responsibilities lawfully, and prominently notify technology supporters and users of their information security obligations.
第九条 User authentication for synthesis services
Deep synthesis service providers must verify the genuine identity information of users through mobile phone numbers, identity document numbers, unified social credit codes, or national network identity authentication public services, and must not offer information publishing services to users who have not completed identity verification.
第十条 Content management and moderation
Providers must manage deep synthesis content through technical or manual review of user inputs and synthesis outputs, maintain feature databases for identifying unlawful and harmful content with documented standards and procedures, and report violations to cybersecurity authorities. Providers must take warning, function restriction, service suspension, or account closure actions against users who generate such content.
第十一条 Misinformation correction mechanisms
Providers must establish mechanisms to identify and promptly counter false information created, copied, distributed or spread through synthesis services, maintain records of such corrections, and report them to cybersecurity and relevant authorities.
第十二条 User grievance and reporting channels
Providers must establish accessible user complaint and public reporting channels, disclose processing procedures and feedback timelines, and handle complaints promptly with timely feedback on outcomes.
第十三条 App store distribution requirements
Application distribution platforms must verify the security assessments and registration status of deep synthesis applications, implement review, management and emergency response responsibilities, and promptly remove, warn, suspend or delist applications that violate national regulations.
第三章 Data and technology management standards
5 sections
This chapter establishes requirements for managing training data and technology in deep synthesis services, covering data security, user consent for biometric edits, algorithm evaluation, security assessments for certain tools, content labeling, and disclosure of synthesis features.
第十四条 Training data and biometric disclosure management
Providers and technical supporters must protect training data security and comply with personal information protection laws. When offering editing functions for facial images, voice or other biometric information, they must prompt users to inform and obtain separate consent from the individuals whose data will be edited.
第十五条 Algorithm review and security assessment
Providers and technical supporters must regularly review, evaluate and verify synthesis algorithm mechanisms. Those offering tools that generate or edit biometric information or special objects, scenes and other non-biometric information relevant to national security, image, interests or public welfare must conduct or commission professional security assessments.
第十六条 Content labeling and log preservation
Providers must add technical identifiers to information generated or edited through their services without affecting user experience, and preserve system logs according to law and relevant national regulations.
第十七条 Disclosure of synthesis features
Providers offering text generation mimicking natural persons, voice synthesis or significant identity modification, facial image or video manipulation, immersive simulated scenes, or other features that could cause public confusion, must add prominent indicators disclosing the synthesis in appropriate locations. For other synthesis services, providers must offer and prompt users about the option to add such indicators.
第十八条 Protection of synthesis labels
Organizations and individuals are prohibited from using technical means to remove, alter, or conceal disclosure labels for deep synthesis content that are required under earlier provisions.
第四章 Supervision and legal responsibility
4 sections
This chapter covers oversight and enforcement mechanisms for deep synthesis services, including registration requirements, safety assessments, supervision procedures, and penalties for violations.
第十九条 Registration and disclosure requirements
Providers of deep synthesis services with public opinion or social mobilization capacity must register under the algorithm recommendation regulation, as must their technology supporters; registered providers and supporters must display their registration number and information link prominently on their service platforms.
第二十条 Safety assessment for new offerings
Providers launching new deep synthesis products, applications, or features with public opinion or social mobilization capacity must conduct security assessments in accordance with national requirements.
第二十一条 Supervision and risk mitigation
Cyberspace, telecommunications, and public security authorities supervise deep synthesis services, and providers and technology supporters must cooperate and provide technical and data support; authorities may require providers and supporters to suspend updates, registrations, or services when significant information security risks are found, and they must comply and remediate.
第二十二条 Penalties and sanctions
Violations are subject to penalties under applicable laws and administrative regulations, with enhanced penalties for serious consequences; violations of public security management incur administrative penalties from police, and criminal violations trigger criminal prosecution.
第五章 Supplementary provisions
3 sections
This chapter provides definitions, sectoral coordination rules, and the effective date of the regulation.
第二十三条 Definitions
Deep synthesis technology encompasses algorithms for generating or editing text, speech, audio, images, video, and virtual scenes, including text generation, speech synthesis, music generation, facial manipulation, image editing, and digital reconstruction; the regulation defines related actors as providers, technology supporters, and users of such services, plus training data and immersive virtual scenarios.
第二十四条 Sectoral coordination
Providers and technology supporters engaged in online publishing, cultural activities, or audiovisual services must also comply with regulations issued by news, culture, tourism, and broadcast authorities.
第二十五条 Effective date
The regulation took effect on January 10, 2023.
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 0 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 0 of 4
- Risk classification, not covered
- Prohibited practices, not covered
- Risk management system, not covered
- Impact assessment, not covered
Data and privacy 0 of 4
- Data governance and quality, not covered
- Data subject rights and consent, not covered
- Cross-border data transfer, not covered
- Copyright and training data, not covered
Transparency and records 0 of 4
- Transparency and disclosure to users, not covered
- Labelling of synthetic content, not covered
- Technical documentation, not covered
- Record keeping and logging, not covered
Technical safeguards 0 of 4
- Human oversight, not covered
- Accuracy, robustness and cybersecurity, not covered
- Bias and non-discrimination, not covered
- Testing and evaluation, not covered
Assurance and lifecycle 0 of 4
- Conformity assessment and certification, not covered
- Registration and notification, not covered
- Incident and breach reporting, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 0 of 6
- Supply chain and provider-deployer duties, not covered
- General purpose and foundation models, not covered
- Accountability and governance roles, not covered
- Training and AI literacy, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 0 are shown.
Change history
No changes recorded since we began monitoring this policy.