⁠‌​​​​‌‌​​‌​​‌​‌‌​​‌‌‌​​‌​‌​‌​​‌‌⁠Deep synthesis

As a deep synthesis provider, which duties must you actually implement?

What you may need to do

1. Turn each of the eight management systems into a written document with a named owner
2. Appoint an information security lead and define the reporting path
3. Build a red-line list of prohibited information and false news
4. Put the systems under version control and update them as features iterate

Provisions relied on

One-line conclusion

The duties of a deep synthesis service provider come as a package: first implement the primary responsibility for information security, build the eight management systems and put safe and controllable technical safeguards in place; and hold the bottom line by neither using deep synthesis services to spread information prohibited by laws and administrative regulations nor producing, copying, publishing or spreading false news information.

Basis

Article 7 requires: “A deep synthesis service provider shall implement the primary responsibility for information security, establish and improve management systems covering user registration, review of the algorithm mechanism, science and technology ethics review, information publication review, data security, personal information protection, countering telecom and online fraud, and emergency response, and have safe and controllable technical safeguards in place.”

Article 4 further requires: “Providing deep synthesis services shall comply with laws and regulations, respect public order and ethical standards, adhere to the correct political direction, public opinion orientation and value orientation, and promote the healthy and positive development of deep synthesis services.”

Article 6 draws the red line: no organization or individual may use deep synthesis services to produce, copy, publish or spread information prohibited by laws and administrative regulations, or engage in activities prohibited by laws and administrative regulations such as endangering national security and interests, damaging the national image, harming public interests, disrupting economic and social order, or infringing on others’ lawful rights and interests; deep synthesis service providers and users may not use deep synthesis services to produce, copy, publish or spread false news information, and reposting news information produced and published on the basis of deep synthesis services shall lawfully repost news information published by internet news information source units.

What you need to do

• Build the systems: user registration, review of the algorithm mechanism, science and technology ethics review, information publication review, data security, personal information protection, countering telecom and online fraud, and emergency response — all eight committed to documents with named owners, not left as verbal practice.
• Build the red-line list: write the categories of information prohibited by laws and administrative regulations, and false news information, into the content review rules, and apply them both on the model side and in the manual review role.
• Build the organization: name the information security lead, and define the internal escalation and external reporting paths when a problem is found.
• Build the evidence: systems, meeting minutes, review records and remediation records that can be archived and retrieved for regulatory inspections.

Common pitfalls

• Having only a service agreement and no internal management systems. Failing to produce anything during an inspection is treated as not implementing the duty.
• Equating the primary responsibility for information security with content filtering, and ignoring science and technology ethics review and countering telecom and online fraud.
• Grabbing news information from non-source units when reposting. The Provisions require lawfully reposting news information published by internet news information source units.
• Never versioning the systems: live streaming and digital humans are already launched, while the systems still cover only text generation.

Frequently asked follow-ups

Q: How detailed do the systems have to be? A: These Provisions only require them to be “established and improved” with safe and controllable technical safeguards, without prescribing length or format. A workable standard: every system maps to concrete processes, roles and retained records.

Q: What do you do when prohibited content is found? A: Article 10 requires taking handling measures in accordance with law, preserving the relevant records and promptly reporting to the cyberspace administration authorities and relevant competent departments; measures such as warnings, functional restrictions, service suspension and account closure may also be applied to users.

Frequently asked follow-ups

Must a very small team build all these systems?

Article 7 applies to every deep synthesis service provider with no exemption by size. The systems can be kept short, but none of the eight elements may be missing; the local cyberspace administration office sets the operative reading.

Can industry self-discipline documents replace internal systems?

No. Article 5 encourages industry organizations to strengthen self-discipline, which is external guidance; Article 7 requires the provider itself to establish management systems and have technical safeguards in place.

This entry belongs to the “China AI Compliance and Filing” cluster (42 entries in total): View all · Answers home

渝ICP备2026003920号-1 · 工信部备案查询

渝公网安备50011302222781号