Understanding Administrative Provisions on Deep Synthesis Internet Information Services: A Comprehensive Guide

· About Administrative Provisions on Deep Synthesis Internet Information Services

Key Takeaways

  • The Administrative Provisions on Deep Synthesis Internet Information Services apply in China to providers and technical supporters of deep synthesis internet information services, and they took effect on 10 January 2023 after being jointly issued on 25 November 2022 by the CAC, MIIT, and Ministry of Public Security.[1][2]
  • Providers that offer deep synthesis functions to the public must verify users’ real identity information, and services involving publication of synthetic content must implement content review and management measures.[1][2]
  • Where deep synthesis content may cause confusion, providers must add prominent labels and may need to apply technical measures to prevent misuse or misleading attribution.[1][2]
  • Providers must obtain lawful basis and consent before using individuals’ personal information or biometric data, including facial features and voice-related information, for deep synthesis processing.[1]
  • Services with significant public-opinion or security sensitivity may face security assessment and filing obligations, and violations can trigger orders to correct, warnings, suspension, deletion, and fines under China’s cybersecurity enforcement framework.[1][2]

What It Is

The regulation is a ministerial rule governing deep synthesis services in China, covering technologies that generate, edit, or synthesize text, audio, image, video, or virtual scenes through algorithms, and it sits within China’s broader online information and AI governance regime.[1] It is enforced by the Cyberspace Administration of China (CAC) together with the Ministry of Industry and Information Technology and the Ministry of Public Security.[1][2]

It was adopted on 25 November 2022 and entered into force on 10 January 2023.[1][2] Publicly available 2025–2026 sources identify the rules as still in force and do not indicate any repeal, replacement, or delaying amendment as of 6 September 2026.[1][2][3]

A key later development is China’s separate Measures for the Identification of Synthetic Content Generated by Artificial Intelligence, which were issued in 2025 and took effect on 1 September 2025; those measures complement, rather than replace, the deep synthesis provisions by tightening labeling and identification rules for synthetic content.[3]

Who Must Comply

The rules apply to deep synthesis service providers and also reach technical support providers that supply model, generation, synthesis, or other enabling capabilities for such services.[1][2] In practice, this includes platforms and vendors that offer synthetic media, digital avatars, voice cloning, image generation, or other systems used to create or alter online information content.[1][2]

The regime has extraterritorial practical reach to the extent an offshore provider serves users in mainland China or makes deep synthesis services available in China through online delivery, because the obligations track service provision to Chinese users and Chinese online information services.[1][2] Publicly available analyses also describe the instrument as applying to internet-based information services rather than only to entities incorporated in China.[1][2]

The rules are not a general ban on synthetic media, but they do not apply as a narrow consumer-only code either; they are directed at providers, support providers, and service operators whose systems can materially affect content dissemination, public opinion, or security.[1][2] Exemptions are limited, and no broad sector-wide exemption is stated in the official summary sources reviewed; instead, special handling generally depends on the service type and risk profile.[1][2]

Core Requirements

  1. Real-name verification: Providers must verify users’ identity information before allowing them to publish or use deep synthesis services, typically through mobile numbers, identity cards, or equivalent real-name methods.[1][2]
  1. Content management and moderation: Providers must establish mechanisms to review, detect, and handle illegal or harmful content generated or distributed through deep synthesis, using both technical and manual controls.[1][2]
  1. Clear labeling: Synthetic content that may confuse users must be labeled prominently so ordinary users can tell that the content was generated or materially altered by deep synthesis technology.[1][3]
  1. Personal information safeguards: Providers must obtain lawful basis and, where required, separate consent before processing biometric or other personal information for deep synthesis use cases, especially facial features, voice prints, and similar identifiers.[1][2]
  1. Security assessment and filing: Services that could affect social mobilization, public opinion, or national security may need internal security assessments and regulatory filing procedures before launch or continued operation.[1][2]
  1. Incident handling and recordkeeping: Providers must maintain records, adopt risk controls, and remove or block prohibited content when discovered, while preserving accountability for upstream technical support where relevant.[1][2]

Deadlines and Penalties

| milestone | date | what applies | |---|---:|---| | Promulgation | 25 November 2022 | CAC, MIIT, and MPS issued the rules.[1] | | Entry into force | 10 January 2023 | Compliance obligations became operational.[1][2] | | Synthetic-content identification measures | 1 September 2025 | Separate labeling and identification requirements for AI-generated content took effect.[3] |

Maximum penalties are not always specified in the provision summary sources, but violations can lead to corrective orders, warnings, public criticism, service suspension, content removal, and administrative fines under China’s cybersecurity and online content enforcement practice.[1][2] In serious cases, regulators may also impose revocation of permits or business suspension where related licensing or cybersecurity laws are implicated.[1][2]

How to Comply

  1. Map the service scope: Inventory every feature that generates, edits, clones, or transforms content, and classify each use case by risk, user impact, and whether it is public-facing or internal-only.[1][2]
  1. Build a labeling architecture: Implement visible labels in the user interface and embedded metadata or watermarking where feasible, and align this with the 2025 synthetic-content identification measures.[3]
  1. Strengthen identity controls: Use real-name onboarding, step-up verification, abuse monitoring, and account traceability for publishing or high-risk generation features.[1][2]
  1. Operationalize moderation: Combine automated filters, human review, complaint handling, and escalation workflows for prohibited content and misuse reports.[1][2]
  1. Tighten privacy governance: Require documented legal basis, consent capture, retention limits, and biometric-data segregation for faces, voices, and other identifiers used in synthesis.[1][2]
  1. Run security assessments: For public-opinion-sensitive or security-sensitive services, perform launch reviews, maintain filings where required, and document mitigation measures and incident response steps.[1][2]
  1. Use recognized controls frameworks: Map technical and governance controls to ISO 27001 for information security management, NIST CSF 2.0 for risk identification and response, and ISO 42001 for AI management-system governance where synthetic-media systems are material to the business.

Related Regulations

  • PIPL (Personal Information Protection Law): This is the main privacy law underpinning consent, biometric-data processing, and minimization requirements that deepen the privacy obligations in deep synthesis workflows.
  • Cybersecurity Law: This overlaps on network security, logging, content control, and operational security duties, especially where service suspension or cybersecurity sanctions are at issue.
  • Data Security Law: This can conflict only in practice, not textually, by adding data-classification and important-data governance duties to deep synthesis systems that process sensitive datasets.
  • Measures for the Identification of Synthetic Content Generated by Artificial Intelligence: These 2025 measures add a more specific labeling and identification layer for AI-generated content and should be read together with the deep synthesis rules.[3]
  • Algorithmic recommendation and generative AI rules: China’s broader platform and AI governance instruments may overlap on content safety, filing, and provider responsibilities where deep synthesis is integrated into generative AI services.

FAQ

Does this apply to companies outside China?

Yes, if an offshore company provides deep synthesis services to users in China or operates a service that is accessible in mainland China, the practical compliance expectation is that the rules apply.[1][2] The regime is written around internet-based information services, not only domestic incorporation.

Do deep synthesis providers have to label AI-generated content?

Yes. Synthetic content that could confuse users must be clearly labeled, and the 2025 identification measures add a more specific content-identification layer for AI-generated material.[1][3] The label obligation is not optional and is central to the regime.

Can a company use a person’s voice or face without consent?

No, not lawfully for deep synthesis purposes in the ordinary case. The rules require lawful basis and, where applicable, separate consent before processing personal information such as biometric identifiers for synthesis.[1][2]

Is there a filing or security review requirement?

Potentially yes. Services that could influence public opinion or national security may need internal security assessments and filings before operation or continued provision.[1][2] The requirement is risk-based, so not every low-risk tool will trigger the same process.

What happened in 2025 and 2026?

A separate set of AI-content identification measures took effect on 1 September 2025, increasing the labeling burden for synthetic content.[3] Publicly available sources through 6 September 2026 do not show a delay, repeal, or substantive amendment to the 2022 deep synthesis provisions themselves.[1][2][3]

Sources

Put it into practice

More compliance guides