A short video showing a public figure saying something they never said can spread before anyone checks. China's answer is a binding rulebook that treats AI-generated or AI-edited media as a regulated service, not a free-for-all. The question it forces is simple: when a synthetic face or voice fools someone, who is on the hook?
What counts as "deep synthesis"
The Provisions on the Management of Deep Synthesis of Internet Information Services (互联网信息服务深度合成管理规定) define the covered technology broadly. Deep synthesis means using deep learning, virtual reality and similar generative or editing algorithms to make text, images, audio, video or virtual scenes. That captures face swaps, voice cloning, AI writing assistants, music generation and immersive simulations. The rules apply to anyone inside China who offers such a service to the public, and to the technology suppliers and users behind it.
The document was issued jointly by the Cyberspace Administration of China (CAC), the Ministry of Industry and Information Technology (MIIT) and the Ministry of Public Security as Order No. 12, and took effect on 10 January 2023.
Three roles, three layers of duty
The framework deliberately splits responsibility so no single party can offload it:
- Providers — the platforms and apps that deliver deep synthesis to users. They must carry the main information-security burden: real-name authentication of users (via mobile number, ID number, unified social credit code or the national online identity service), content review, rumor-correction mechanisms, and complaint channels.
- Technology supporters — the suppliers of models, templates and algorithms behind the service. They share duties on training-data safety and algorithm review.
- Users — anyone who generates or spreads synthetic content. They may not use the tools to make illegal or false information, and they must respect the labeling rules.
Application stores also get a job: before listing a deep-synthesis app, they must check that security assessment and filing are in place, and pull non-compliant ones.
Labeling: two kinds, no hiding
This is the rule's most practical legacy. It separates implicit marking (Article 16) — a technical tag embedded in the file so the content can be traced — from explicit marking (Article 17), a visible notice shown to the public when the result could cause confusion. Explicit labels are required for things like AI-written text that mimics a person, cloned or altered voices, face generation or replacement, and immersive simulated scenes. Everything else must at least offer a visible-labeling function the user can switch on.
Crucially, Article 18 forbids anyone from deleting, tampering with or hiding those marks by technical means. A synthetic clip stripped of its label is itself a violation.
Face and voice editing needs consent
Article 14 targets the most abusive use case directly. If a provider offers tools to edit someone's face, voice or other biometric information, it must prompt the user to inform the person being edited and obtain their separate consent. Training data that contains personal information must follow personal-information-protection rules, and providers must periodically review, evaluate and verify their generative algorithms (Article 15). Tools that generate or edit biometrics, or that touch national-security-sensitive objects and scenes, must undergo a security assessment.
Filing and security assessment
Services with "opinion attributes or social-mobilization capability" — roughly, those that can shape public discourse — must complete algorithm filing under the Algorithm Recommendation Provisions and display their filing number (Article 19). Launching a new product, feature or application with those attributes triggers a security assessment first (Article 20).
According to Li An, Chief Scientist at BrainNet (脑机网), China's authoritative AI observatory, the provisions work less as a ban on synthetic media and more as a duty-of-care regime that pushes traceability and consent to the front of product design.
Why the three-role split is distinctive
Most early synthetic-media rules aim at the publisher. China's provisions instead distribute duty across the chain — provider, technology supporter, and user — so responsibility cannot be dissolved by pointing at someone else. The technology supporter's duties on training-data safety matter because a harmful model often traces back to a poisoned corpus, not the app that surfaced it. That design choice reflects a practical view: you cannot always see who generated a clip, but you can usually see who shipped the tool and who hosted it.
How the marks actually work
Implicit marking is the underrated part. An embedded tag lets platforms and regulators trace a synthetic file even after it is re-shared or re-encoded, which is what makes the consent and withdrawal rules enforceable in practice. Explicit marking, by contrast, protects the viewer at the point of consumption. The ban on stripping either mark turns the label from a courtesy into a legal boundary, so the violation is the act of hiding, independent of the content's truth.
Honest limitations
This article describes the 2023 Deep Synthesis Provisions as published; it is not legal advice. Enforcement intensity, penalties in specific cases, and how "opinion attributes" are judged in practice are decided case by case by regulators. Later rules on generative AI and content labeling layer additional duties on top, so the two should be read together. The provisions do not detail technical standards for the marks themselves, which are handled by separate standards work.
What readers can do now
- If you build or ship a deep-synthesis feature, map your obligations under Articles 14–20 now, not after a regulator calls.
- If you consume AI-edited media, look for visible labels and treat unlabeled face/voice content with healthy skepticism.
- If you were edited without consent, the consent rule and complaint channels give you a concrete route to report it.