China's Deep Synthesis Provisions take effect, regulating deepfake services

China's Administrative Provisions on Deep Synthesis of Internet Information Services entered into effect on January 10, 2023, becoming one of the world's first binding rules targeting AI-generated deepfake content. The rules were jointly issued by the Cyberspace Administration of China, the Ministry of Industry and Information Technology, and the Ministry of Public Security on November 25, 2022.

What it is

The provisions govern deep synthesis technology, defined as technologies that use generative sequencing algorithms, such as deep learning and virtual reality, to create text, images, audio, video, virtual scenes, or other information. The instrument applies to deep synthesis service providers and technical supporters operating inside China. It was drafted on the basis of the Cybersecurity Law of the PRC, the Data Security Law, and the Personal Information Protection Law, among other laws.

What it requires

Providers offering functions that edit face, voice, or other biometric information must prompt users to inform and obtain the specific consent of the individual whose information is being edited. Providers and technical supporters must regularly review, assess, and verify the mechanism and logic of their generative or synthetic algorithms, and must perform a security assessment, or have one performed by a professional institution, for tools that generate or edit biometric information or content touching national security or public interests. Providers must verify the real identity information of users through means such as mobile telephone numbers, identification card numbers, or unified social credit codes before allowing publication. Outputs that could cause confusion or mislead the public must carry a conspicuous label alerting the public to deep synthesis generation, and removal of such labels is prohibited. Providers with public opinion properties or social mobilization capacity must complete filing, modification, or cancellation procedures with regulators.

What security leaders should do

Security teams operating or supporting deep synthesis services in China should map which products trigger mandatory security assessments, since biometric-editing and public-opinion-sensitive functions require formal review before launch. Consent capture and real-identity verification workflows should be built into product design rather than retrofitted, and logging of inputs, outputs, and review decisions should be retained to satisfy inspection requests from the Cyberspace Administration of China, MIIT, and MPS. Labeling pipelines that mark synthetic content and resist tampering should be treated as a core control, not an afterthought, given the explicit prohibition on removing or concealing such marks.