China Generative AI Measures and AI Labelling Rules Guide: What Providers Must Do

Any organisation offering a generative AI service to the public in mainland China operates under a layered set of binding rules that cover training data, content safety, algorithm filing and, since 1 September 2025, mandatory labelling of every piece of AI-generated content. The rules are spread across several Cyberspace Administration of China (CAC) instruments and national standards, so teams often miss one layer while focusing on another. This guide explains who is covered, what the Interim Measures for Generative AI Services, the Measures for Labelling AI-Generated Synthetic Content and the mandatory standard GB 45438-2025 require, how filing and enforcement work, and what it all means for AI agents and the credentials they use. It is for security, product and compliance leads, and executives planning AI launches in China. Article references come from English translations (China Law Translate, CSET at Georgetown and a law firm translation of the standard); only the Chinese texts are authoritative.

Key takeaways

• The core rules are in force and actively used. The Interim Measures have applied since 15 August 2023, and the CAC keeps publishing batches of filed services, for example 124 new generative AI services for July to August 2026.
• Labelling is two-layered. Providers must add visible (explicit) labels and machine-readable (implicit) metadata labels, and distribution platforms must detect, keep and add to them.
• GB 45438-2025 is mandatory, not guidance. It fixes label wording, size and duration, and a metadata field format with Label, ContentProducer, ProduceID, ContentPropagator and PropagateID values.
• Services with public opinion attributes need filing and a security assessment. This draws in the Algorithmic Recommendation and Deep Synthesis Provisions and the recommended standard GB/T 45654-2025.
• Agents and NHIs carry the obligations in practice. Service accounts, API keys and signing keys that write labels, call filed models and keep six months of logs are part of the compliance boundary.

Scope: who and what is covered

The regime is a stack rather than one law. Each layer has its own scope, and a single product can fall under several at once.

• Public-facing services only: Article 2 of the Interim Measures excludes research, development and internal use by enterprises, universities and similar bodies that do not offer the service to the public in mainland China. An internal coding assistant is out of scope; the same model behind a consumer app is in scope.
• Sector carve-outs: where other state rules govern generative AI in news and publishing, film and television or artistic creation, those rules apply.
• Foreign providers: Article 20 lets the CAC notify other authorities to take technical and other necessary measures against services provided from outside mainland China that do not comply.

Personal information in prompts and training data is also governed by the Personal Information Protection Law. See the China PIPL Guide.

Key obligations

Interim Measures for Generative AI Services

Labelling Measures and GB 45438-2025

• Explicit labels (Art. 4): perceptible text, sound or graphic notices. Text gets a notice or symbol at the start, middle or end, or a label in the interface. Audio gets a spoken notice or rhythm. Images get a conspicuous label. Video and virtual scenes get a label on the opening screen, optionally later. Files offered for download or export must carry the explicit label inside the file.
• Standard values for explicit labels: GB 45438-2025 requires an "AI" or 人工智能 element plus a 生成 and/or 合成 (generated, synthesised) element. On images, video and virtual scenes the text height must be at least 5% of the shortest side; video labels stay on screen for at least 2 seconds; audio can use a spoken label at normal speed or the Morse rhythm for "AI" (short long, short short). Interactive interfaces show a continuous label.
• Implicit labels (Art. 5): metadata in the file header carrying the AI attribute, the provider's name or code and a content reference number. Digital watermarks are encouraged but not required.
• Distribution platforms (Art. 6): check metadata and label content as confirmed (metadata says AI), possible (user declares AI) or suspected (traces of generation), give users a declaration function, and add their own propagation details to the metadata.
• App stores (Art. 7): ask app providers whether they offer generative AI and review their labelling materials.
• Unlabelled output (Art. 9): a provider may supply content without explicit labels on a user's request only if the agreement sets out the user's labelling duties, and must keep the related logs for at least six months.
• Integrity (Art. 10): no one may maliciously delete, alter, fabricate or conceal labels, or provide tools or services to do so. Users publishing AI content must declare it.
• Filing link (Art. 12): labelling materials go into algorithm filing and security assessment submissions.

The metadata label format

Each file should carry only one metadata implicit label. The standard is format-neutral: it does not list file formats, so teams must decide where the field lives in each format they emit. For the wider provenance picture, including C2PA style manifests and watermarking, see the AI Model Provenance and Watermarking Guide.

Security assessment and the GB/T 45654-2025 baseline

Article 17 does not itself define the assessment content. GB/T 45654-2025, effective 1 November 2025, is a recommended standard used as the reference for those assessments. Key numbers from the CSET translation:

• Training data sources: random-sample a source before collection and again after; do not use it if more than 5% of sampled content is illegal or harmful.
• Keyword library: at least 10,000 keywords, updated at least weekly.
• Test question bank: at least 2,000 questions across modes and languages, updated at least monthly.
• Refusal testing: at least 500 should-refuse and 500 should-not-refuse questions; target at least 95% refusal on the first set and no more than 5% refusal on the second.
• Output quality: at least 90% of sampled outputs free of the 31 risk types in Appendix A (five groups).
• User controls: users can opt out of training on their inputs in no more than four clicks; annotators are trained and assessed, and annotation and review are done by different people.

Timeline and current status

China has discussed a comprehensive AI law for several years, but no such law has been adopted as at the date of this guide. Check the CAC site before relying on this table, because the "interim" measures may be replaced.

Enforcement and penalties

• Interim Measures, Art. 21: penalties follow the Cybersecurity Law, Data Security Law, Personal Information Protection Law and the Science and Technology Progress Law. Where those are silent, regulators can issue warnings, public criticism or correction orders, and suspend the service where a provider refuses to correct or the case is serious. Public security and criminal liability apply where relevant.
• Labelling Measures, Art. 13: enforcement by the internet information, telecoms, public security and radio and television regulators under existing law.
• Algorithm Provisions, Arts. 31 and 33: fines of RMB 10,000 to 100,000 for serious or uncorrected breaches and for filing violations such as false materials, plus revocation of the filing and suspension of information updates.
• Amended Cybersecurity Law: from 1 January 2026, fines for ordinary businesses reach up to RMB 500,000, up to RMB 1 million for some operators and responsible individuals, and up to RMB 10 million for critical information infrastructure operators where consequences are exceptionally severe, according to Reed Smith's summary.

What it means for AI agents and non-human identities

Every obligation here is executed by machines: generation pipelines, labellers, moderation workers, platforms and AI agents.

• Agents are generators: an agent that writes posts, images or emails through a public service in China produces AI-generated content. The label must be applied by the service, and an agent that strips or rewrites metadata on export is doing what Art. 10 prohibits. Design agents to pass labels through untouched.
• Labelling keys are high-value NHIs: if ReservedCode1 carries a digital signature, the signing key proves which provider produced the content. Hold it in an HSM or managed KMS, scope the service identity that can call it, and rotate it on a schedule. See the Secrets Management Guide.
• Filed model, filed endpoint: applications built on another provider's filed model typically call it through an API key. Track which keys reach which models, so that an inspector's Art. 19 question ("what model produced this?") has an answer, and so a developer cannot quietly switch to an unfiled model.
• Log access is privileged: six months of logs for unlabelled output (Art. 9) and records of user violations (Art. 14) contain prompts and personal information. Restrict the service accounts that can read or delete them and alert on bulk export.

See the Agentic AI Identity Guide and the AI Agent Authorisation Guide.

Framework mapping

Compliance steps

1. Classify each AI feature. Decide whether it is offered to the public in mainland China, whether it is generative, deep synthesis or recommendation, and whether it has public opinion attributes or social mobilisation capacity.
2. Choose build or buy for the model. Building on an already filed foundation model shortens the path; your own model brings the full GB/T 45654-2025 assessment. Small teams usually integrate a filed model.
3. Prepare the filing dossier. Algorithm filings under Art. 24 of the Algorithm Provisions need the provider name, service form, field of application, algorithm type and a self-assessment report, within 10 working days of starting the service, with changes filed within 10 working days and deregistration within 20. Include labelling materials (Labelling Measures Art. 12). Display the filing number once issued.
4. Implement explicit labels per modality. Build to the GB 45438-2025 values (5% text height, 2 second video label, Morse rhythm option) and test exported files, not just the web view.
5. Implement implicit labels. Write the AIGC field with ProduceID values you can trace back to logs. Decide whether to sign ReservedCode1 and manage the key as a production secret.
6. Pilot and test. Run a pilot ring on internal users, then sample outputs weekly: labels present, metadata parses, platform re-upload keeps the field. Keep a rollback path that disables the feature rather than shipping unlabelled content.
7. Stand up content safety operations. Keyword library, test bank and refusal sets to the GB/T 45654-2025 sizes, plus the Art. 14 stop, remove, correct and report workflow and an Art. 15 complaint channel with published timelines.
8. Write the user agreement. Cover rights and duties (Art. 9), labelling methods (Labelling Measures Art. 8) and user labelling duties where unlabelled output is offered (Art. 9).

Detection and measurement

• Label coverage: percentage of sampled outputs with a valid explicit and implicit label, per modality (target 100%).
• Metadata survival rate: share of files where the AIGC field survives export, compression and re-upload.
• Refusal accuracy: should-refuse refusal rate (at least 95%) and over-refusal rate (no more than 5%) per release.
• Output qualified rate: sampled outputs free of the 31 risk types (at least 90%).
• Filing currency: days between a material model change and the filing update (10 working days or less).

Common failure patterns

• Web view labelled, download not: the explicit label is drawn in the interface but the exported file is clean, which breaches the download rule in Art. 4.
• Metadata stripped by the pipeline: image optimisation, transcoding or CDN processing drops the AIGC field. Test the whole path, not the generator alone.
• Treating labels as anti-fraud: labels only work when the generator is compliant. Fraudsters using offshore or self-hosted tools produce unlabelled deepfakes, as the Arup deepfake fraud showed: payment and identity verification still need out-of-band checks. See the Deepfake and AI Impersonation Guide.
• Silent model swaps: engineers change the upstream model or add a new API key without telling compliance, so the filing no longer matches production.
• Logs kept too briefly or too widely: unlabelled-output logs deleted before six months, or readable by every engineer.

Practitioner checklist

• Register every AI feature reachable by the public in mainland China and classify it against each instrument.
• Confirm whether each service has public opinion attributes and therefore needs filing and a security assessment.
• Keep a filing register: filing number, filed model, owner, last change date.
• Implement explicit labels to GB 45438-2025 values for every modality, including exports.
• Write the AIGC metadata field on every file and test that it survives the delivery pipeline.
• Protect any signing key used for label integrity as a production secret with a scoped service identity.
• Keep logs for unlabelled output for at least six months with restricted access.
• Run GB/T 45654-2025 sized keyword, test and refusal sets before each release.
• Inventory API keys to upstream models and block calls to unfiled models.
• Review CAC notices and national standards quarterly and record changes.

Standards and references

• China Law Translate: Interim Measures for the Management of Generative Artificial Intelligence Services (translation)
• China Law Translate: Measures for Labeling AI-Generated Synthetic Content (translation)
• Sidley Austin: GB 45438-2025 Labelling Method for Content Generated by AI (translation)
• CSET Georgetown: GB/T 45654-2025 Basic Safety Requirements for Generative AI Services (translation)
• China Law Translate: Provisions on the Administration of Deep Synthesis Internet Information Services (translation)
• China Law Translate: Provisions on the Management of Algorithmic Recommendations (translation)
• Reed Smith: China approves major amendments to the Cybersecurity Law
• OWASP: Top 10 for LLM Applications 2025

This guide summarises China's generative AI and AI content labelling rules as at 24 October 2026, based on English translations, and is not legal advice. Related NHI Mgmt Group resources: Global AI Regulation Map · EU AI Act Compliance Guide · Japan AI Promotion Act Guide · South Korea AI Basic Act Guide · AI Governance Guide