China: Regulations on the Management of Deep Synthesis Internet Information Services
[Unofficial translation by Digital Policy Alert]
Chapter I General Provisions
Article 1
In order to strengthen deep synthesis internet information services, carry forward Core Socialist Values, safeguard national security and social public interests, and protect the legitimate rights and interests of citizens, legal entities, and other organisations; these Regulations are developed in accordance with the “Cybersecurity Law of the People’s Republic of China”, the “Data Security Law of the People’s Republic of China”, the “Personal Information Protection Law of the People’s Republic of China”, the “Internet Information Service Management Rules”, as well as other laws and regulations.
Article 2
These Regulations apply to the use of deep synthesis technologies to provide internet information services (hereinafter “deep synthesis services”) within the territory of the People’s Republic of China. When other laws and regulations provide otherwise, such laws and regulations shall prevail.
Article 3
The Cyberspace Administration of China is responsible for the overall supervision, governance, and enforcement of deep synthesis services. The State Council departments for telecommunications and public security are responsible for supervising and managing deep synthesis services in accordance with their respective competencies.
Local information and public security departments are responsible for the overall supervision and governance of deep synthesis services within their administrative region. Local telecommunications and public security departments are responsible for supervising and managing deep synthesis services within their administrative region in accordance with their respective competencies.
Article 4
Deep synthesis service providers shall comply with laws and regulations, observe social morality and ethics, and adhere to appropriate political guidance, public opinion, and generalized values in order to promote the development and improvement of deep synthesis services
Article 5
Relevant business associations are encouraged to strengthen industry- and self-regulation; develop and improve industry standards, guidelines, and self-regulation systems; encourage and provide guidance and technical support to deep synthesis service providers to develop and improve service specifications in accordance with the law; and provide citizen participation in their processes.
Chapter II Regular Provisions
Article 6
Organizations and individuals shall not use deep synthesis services to produce, copy, publish, or disseminate information prohibited under laws and regulations and shall not use deep synthesis services to engage in activities prohibited by laws and regulations such as those that endanger national security and interests, damage national reputation, violate public security and interests, disrupt the economic and social order, or violate the legitimate rights and interests of others.
Deep synthesis service providers and users shall not use deep synthesis services to produce, copy, publish, or disseminate fake news information. Providers that copy information produced or published using deep synthesis services shall only publish news information from press units as provided by law.
Article 7
Deep synthesis service providers shall be responsible for implementing systems to ensure information security; developing and improving management systems for user verification and algorithmic assessment, technology ethics assessment, information assessment, data security, personal information protection; preventing telecommunications network fraud and providing security incident response; and implementing technical safeguard measures.
Article 8
Deep synthesis service providers shall develop and disclose management rules and platform terms and conditions, improve service agreements, post deep synthesis service users’ obligations, and comply with management obligations under the applicable laws and terms and conditions.
Article 9
Deep synthesis service providers shall verify users’ real identities against their mobile numbers, identity card numbers, unified social credit codes, or through the public national online identity verification service, and must not provide information dissemination services to deep synthesis service users that have not verified their information.
Article 10
Deep synthesis service providers and technical supporters shall strengthen content moderation and adopt manual or automated methods to review users’ input data and synthesis results.
Deep synthesis service providers shall establish and develop a database for unlawful and harmful content; improve data entry standards, rules and procedures; and register and store network logs.
If deep synthesis service providers find illegal or harmful content, they shall handle the incident in accordance with the law, store relevant records, promptly submit a report to the telecommunications department and other relevant departments; and adopt measures against the deep synthesis service users, such as issuing warnings, restricting functions, suspending services, closing accounts.
Article 11
Deep synthesis service providers shall develop and improve mechanisms for dispelling rumours. If they find that deep synthesis services are being used to produce, copy, publish, or disseminate false information, they shall promptly adopt actions to dispel rumours, store relevant records, and submit a report to the information department and other relevant departments.
Article 12
Deep synthesis service providers shall implement convenient and effective complaint channels for users and the public, publish information on the process and feedback time limit, accept and promptly handle complaints and reports and provide feedback on the results.
Article 13
Online application stores and other application distribution platforms shall implement safeguard management measures such as launch review, daily management, emergency handling, and review of deep synthesis security assessments and filing status. If the platforms identify violations of the laws and regulations, they shall promptly adopt measures such as halting distribution, issuing warnings, suspending services, or removing the app from the market.
Chapter III Data and Technology Management Specifications
Article 14
Deep synthesis service providers and technical supporters shall strengthen the training data management, implement necessary technical measures to safeguard the security of training data, and comply with personal information protection regulations if the training data contains personal information.
If deep synthesis service providers and technical supporters provide significant editing functions for biometric information, such as faces and voices, they should prompt deep synthesis users to notify the individual whose personal information will be edited and obtain their separate consent.
Article 15
Deep synthesis service providers and technical supporters shall implement periodic reviews, evaluations, and verifications of the algorithms used for content generated using deep synthesis.
Deep synthesis service providers and technical supporters shall perform security assessments, directly or through a professional institution, when they provide the following tools, models or templates:
(i) Generating or editing biometric information such as faces and voices;
(ii) Generating or editing non-biometric information such as such as objects and images that may involve national security, national image, national interests, or social and public interests
Article 16
Deep synthesis service providers shall adopt technical measures to add a mark to content generated or edited by their users without interfering with the use or save log information in accordance with the relevant laws and regulations
Article 17
Deep synthesis service providers shall add a noticeable mark at a reasonable position and area of the generated or edited content that may be misleading or confusing in order to alert the public of the use of deep synthesis services when they provide the following deep synthesis services:
(i) Services that simulate natural persons to generate or edit text, such as intelligent dialogue and writing
(ii) Services that generate synthetic voices or simulate voices, or significantly alter personal identity characteristics.
(iii) Services that generate images or videos of persons such as face generation, face swap, face manipulation, and gesture manipulation; and personal attribute editing.
(iv) Services that generate or edit immersive simulation scenes
Other services that generate or significantly alter content.
Deep synthesis service providers offering services other than those provided in the preceding paragraph shall provide a function of adding a noticeable mark and alert users that they may add such marks themselves.
Article 18
No organization or individual may use technical tools to delete, alter, or conceal the deep synthesis mark provided for in Article 16 and Article 17 of these Regulations.
Chapter IV Supervision, Management and Legal Liability
Article 19
Deep synthesis service providers with public opinion properties or social mobilization capacity shall perform filing, modification of filing, and cancellation of filing in accordance with the “Regulations for the Management of Algorithm Recommendation for Internet Information Services”.
Deep synthesis service providers and technical supporters shall perform filing, modification of filing, and cancellation of filing according to the preceding paragraph.
Deep synthesis service providers and technical supporters that have completed the filing process shall prominently display their filing number and the link to the public record of the filing on their websites and applications.
Article 20
Deep synthesis service providers that develop or launch new products, applications, or functions with public opinion properties or social mobilization capacity shall conduct security assessments in accordance with the law.
Article 21
Internet information departments, telecommunications departments, and public security departments shall conduct security assessments, oversight and inspections of deep synthesis services in accordance with the law. Deep synthesis service providers and technical supporters shall collaborate providing the necessary technical, data support and assistance.
If the internet information departments or other relevant departments find that deep synthesis services pose a significant information security risk they may order deep synthesis service providers and technical supporters to suspend information updates, user account registration, or other related services, and compel them to rectify any non-compliance. Deep synthesis service providers and technical supporters shall adopt the necessary measures to rectify and eliminate threats.
Article 22
Deep synthesis service providers and technical supporters that violate these Regulations are subject to the penalties imposed by relevant laws and regulations. If violations cause serious harm, higher penalties will be applied according to the law.
If the act violates public security, public security authorities shall apply penalties according to the law. If the act constitutes a crime, criminal liability is to be prosecuted according to the law.
Chapter V Supplementary Provisions
Article 23
For the purpose of these Regulations, the following definitions apply:
Deep synthesis technology means technologies that use generative and synthetic algorithms, such as deep learning and virtual reality, to create text, images, audio, video, virtual scenes, or other information, including but not limited to:
(i) Text content such as text generation, text style conversion, and question-and-answer generation
(ii) Voice content, such as text-to-speech, voice conversion, and voice attribute editing
(iii) Non-speech content, such as music generation and background sound editing
(iv) Biometric features in images or video content, such as face generation, face swapping, personal attribute editing, face manipulation, and gesture manipulation
(v) Non-biometric features in images or video content, such as image generation, image enhancement, and image restoration
(vi) Digital characters or virtual scenes such as 3D reconstruction and digital simulation
Deep synthesis service providers means an organization or individual that provides deep synthesis services.
Deep synthesis service technology supporter means an organization or individual providing technology support for deep synthesis services.
Deep synthesis service user means an organization or individual that uses deep synthesis service to produce, copy, publish or disseminate information.
Training data means the labelled or benchmarked dataset used to train the machine learning model.
Immersive simulation scene means a virtual scene with a high degree of realism generated or edited using deep synthesis technology that enables user exploration and interaction.
Article 24
Deep synthesis service providers and technical supporters engaging in online publishing services, online cultural services, and online audiovisual programming services shall also comply with the regulations of the departments of press and publication, culture and tourism, and radio and television.
Article 25
These Regulations shall come into force on 10 January 2023.