China - Internet Information Synthesis Regulation

Overview

The Provisions on the Administration of Deep Synthesis of Internet Information Services were jointly issued by the Cyberspace Administration of China, the Ministry of Industry and Information Technology and the Ministry of Public Security on November 25, 2022, and came into force on January 10, 2023. The regulation establishes a cross-sectoral governance framework for so-called deep synthesis (generative) technologies used to produce or edit text, images, audio, video and virtual scenes, placing primary compliance obligations on service providers and technical supporters while defining supervisory roles for national and local authorities. The policy objective emphasizes safeguarding national security and social public interests, protecting personal and property rights, promoting ethical use and preventing misuse (e.g., fraud, defamation, politically sensitive manipulation and dissemination of false information). The Provisions intersect with the Cybersecurity Law, Data Security Law and Personal Information Protection Law and are a foundational element of China’s algorithmic and AI governance architecture.

Definitions

The Provisions use explicit definitions to set the regulatory perimeter. Key definitions include "deep synthesis technology" — encompassing deep learning, virtual reality and other generative/synthetic algorithms that create or edit network information such as textual generation, text-to-speech, music generation, face generation and replacement, image enhancement, three-dimensional reconstruction and immersive virtual scenarios. "Deep synthesis service providers" refers to entities or individuals offering such services. "Technical supporters" are organizations or persons providing technical support (e.g., models, templates, APIs). "Training data" denotes datasets used to train models. These definitions are deliberately broad, covering tools, models, templates and services which create or materially alter content in ways that could mislead or harm observers.

Governance and Institutional Framework

The regulatory architecture assigns national coordination to the Cyberspace Administration of China while giving the Ministry of Industry and Information Technology and the Ministry of Public Security supervisory responsibilities according to their remits. Local counterparts mirror these responsibilities within their administrative regions. The Provisions require collaboration across agencies for inspection and enforcement and make explicit that telecom regulators, public-security organs and internet-administration bodies may exercise powers (including ordering suspension of updates, user registrations or other services where significant information-security risks are identified). The rule also encourages industry self-regulation and standard-setting by trade bodies. For the official text see the Cyberspace Administration of China commentary and expert materials and the promulgation notice on the MIIT website. These institutional assignments ensure both centralized policy coordination and locally actionable enforcement.

Key Focus Areas

The Provisions concentrate on several risk vectors. First, content and dissemination risks: providers must prevent and respond to unlawful or harmful uses—explicitly forbidding creation, reproduction or dissemination of information prohibited by law, including false news that could mislead the public. Second, identity and trust: providers must implement real-identity verification (via mobile number, ID number, social credit code or national network identity authentication) before allowing publishing privileges. Third, technical transparency and marking: generated or edited content must carry technical marks that identify synthesis origin; providers must not permit these marks to be removed or tampered with. Fourth, data governance: training datasets must be protected, and where they include personal or biometric data (face, voice), providers must comply with personal-information protections and obtain consent for editing others’ biometric features. Fifth, higher-risk functionality (face/voice editing, content implicating national image or security) is subject to mandatory security assessments. Sixth, content governance operations: providers must maintain feature libraries to identify illegal or undesirable content, carry out manual or automated reviews of inputs and outputs, retain logs, and establish complaint and rumor-refutation mechanisms. These focal points reflect a blend of content, privacy, safety and national-security priorities.

Implementation Framework

Operational requirements are framed as mandatory duties for providers and technical supporters. Providers must publish management rules, platform conventions and service agreements and prominently remind users and technical supporters of their security obligations. Identity verification must be used to gate publishable content; providers must not enable content publication for users without real-identity authentication. Providers must implement technical or manual review of user inputs and synthesis outputs, maintain and update a feature library of markers for illegal or harmful content, preserve logs and records, and set up a complaint/reporting channel with publicized processing timelines. Application distribution platforms (app stores) also share responsibilities to vet and remove non-compliant deep synthesis applications. For products with public-opinion attributes, filing and recordation obligations under the algorithm-recommendation rules apply. When regulators identify material information-security risks, they may order suspension of updates or registration and require rectification; providers must cooperate and take corrective steps.

Monitoring and Evaluation

The Provisions mandate recordkeeping and cooperation with regulatory inspections. Providers and technical supporters should be prepared to provide technical, operational and log data to the cyberspace, telecom and public-security authorities. Security assessments are mandated for new products or features with public-opinion attributes or social mobilization capability; similarly, models and templates that perform biometric editing or generate content touching on national security or public image are required to undergo safety evaluations (internally or by accredited third parties). The rules thus create both ex ante assessment duties and ex post inspection and supervisory pathways, enabling authorities to monitor compliance and evaluate systemic risks across the internet ecosystem.

Penalties, Liability, and Appeals

The Provisions do not set detailed monetary fines within the text but provide that violations will be punished in accordance with applicable laws and administrative regulations; serious consequences will receive heavier sanctions. Where conduct constitutes public-security offenses or crimes, public-security punishments or criminal liability will follow. Regulatory authorities can order measures such as suspension of services, account closures, removal of content, or other administrative actions. Providers who fail to cooperate with inspections or to implement required safeguards risk escalated administrative action, public-order penalties, or criminal referral. The regime therefore leverages the broader Chinese legal system (Cybersecurity Law, Data Security Law, PIPL, and administrative rules) for enforcement and sanctioning.

Relationship to Other Instruments

The Provisions are expressly linked to and implemented under the Cybersecurity Law, Data Security Law and Personal Information Protection Law. They dovetail with the Administrative Provisions on Algorithmic Recommendation for Internet Information Services and later measures governing generative-AI services (e.g., the interim Measures for the Administration of Generative Artificial Intelligence Services published in 2023). Where deep synthesis intersects with regulated sectors (news, publishing, culture, broadcasting), providers must also meet sector-specific regulatory requirements. The instrument therefore functions as a sector-specific expression of broader cybersecurity, data and privacy legal obligations and is part of a connected suite of algorithm and content regulation instruments.

International Alignment

China’s approach emphasizes national security, public-order and ideological conformity alongside privacy and data security. While the Provisions share commonalities with international best practices on labeling, risk assessment and data protection, they place greater emphasis on preventing content that affects national image or public opinion and on strict identity verification prior to publishing. International stakeholders assessing China’s policy landscape should read the Provisions alongside other domestic measures (e.g., algorithmic recommendation requirements) to understand how generative-AI services must be adapted for the Chinese market. For official commentary see the Cyberspace Administration analysis: CAC expert explanations.

Implementation Timeline

Sources and References