In line with the global buzz around ChatGPT, mainland China has been taking rapid leaps in AI regulation and governance in recent years.

Last month, the country’s internet regulator – the Cyberspace Administration of China (CAC) – released its first batch of 41 deep synthesis filings, as submitted by 26 Chinese tech companies following the launch in January of China’s Provisions on the Administration of Deep Synthesis of Internet-based Information Services (the Deep Synthesis Provisions).  

The Deep Synthesis Provisions, together with algorithm regulations which were introduced in March 2022, target AI-related service providers. Further, a set of draft measures regulating generative AI services management was released for public consultation in April this year, and the submission of a comprehensive draft of AI Law was proposed in the State Council’s 2023 national legislation plan.

Below, we will focus on the key requirements under the Deep Synthesis Provisions and their implications on service providers in the relevant market segments.

Beyond deepfakes: What is deep synthesis technology? 

The Deep Synthesis Provisions apply to the application of deep synthesis technologies that provide internet-based information services within China.

Technology that uses deep learning, virtual reality, and other synthetic algorithms to produce text, image, audio, video, and virtual scenes will be deemed “deep synthesis technology” – a term that includes but goes beyond “deepfakes”. Typical examples of deep synthesis technology and its outputs include:

• Text-to-audio conversion, and audio property editing, e.g., customer services audio bots
• Music generation and scene audio editing, e.g. music synthesis tools
• Face generation, face replacement, character attribute editing, face manipulation, and posture manipulation, e.g., deepfake photos and video
• Image generation, image enhancement, and image restoration, e.g., beauty camera applications
• 3D reconstruction and digital simulation, e.g. metaverse.

Who should care about it?

The Deep Synthesis Provisions mainly target those who provide deep synthesis services or technical support to deep synthesis services in China. These service providers are required to establish management systems for user registration and identify verification, algorithm mechanism review, ethics review, content review, data security, personal information protection, combating telecom and online fraud, and emergency response, as well as implement safe and controllable technical support measures.

In addition, both services providers, technical support providers and users of deep synthesis services in China are prohibited from using deep synthesis services to produce, copy, publish, or disseminate illegal information, nor engage in other illegal activities (although that is not too different to existing restrictions on internet usage).

Data protection obligations 

Deep synthesis services usually feed on a huge amount of data, including personal information, to train the algorithms behind them. Hence, enhancing data security and personal information protection are key for businesses involved in deep synthesis services.

Echoing the requirements under the Personal Information Protection Law (PIPL), the rules require organisations to provide necessary notification to and obtain a separate consent from individuals before providing editing functions for biometric information such as facial features and voice prints.

This should not be a surprising requirement since biometric information is a typical type of sensitive personal information, which mandates higher protection under the PIPL. That said, it is interesting to note that, although the PIPL allows for additional legal bases for processing of personal information other than consent, on a technical read of the Deep Synthesis Provisions, obtaining consent seems to be the only appropriate lawful processing ground. 

Indeed, there may be some exceptional scenarios where organisations would find it impractical to obtain consent from individuals during the provision of deep synthesis services (e.g., restoring an individual’s images and voice of old films). This is an obvious challenge for businesses that the regulators may yet address.

Algorithm review, security assessment and filing

The algorithm review obligation mirrors what has been enforced under the existing rules on algorithms. For example, mechanisms for generating synthesis algorithms should be put under regular review, and those whose deep synthesis services could “shape public opinion” or “mobilise society” must submit a filing to the Cyberspace Administration of China. 

As a new requirement, the rules mandate those who provide tools – such as models and templates that involve biometric information or may involve national security or national and public interests – to conduct security self-assessments. This inclusion in new tech rules of processes to allow regulatory intervention is not uncommon in the CAC’s current playbook.

Labelling for transparency 

When providing deep synthesis services that may generate or significantly alter information content (such as AI writing or deepfakes), service providers are required to add a prominent label to remind the public of the use of deep synthesis. 

This transparency requirement seeks to prevent hiding deepfake-related information among other internet content, a current phenomenon which has caused confusion among netizens or even amounted to crimes. 

However, product designers may also denounce this obligation to label the corners of their video and image outputs as causing resource restraints and ultimately stifling innovation.

Getting prepared

The Deep Synthesis Provisions came in response to increasing concerns from the regulators that advances in AI technology, although enhancing China’s digital competitiveness, could be used by bad actors to disseminate illegal information or defame people by impersonating their identity.

Businesses offering or supporting deep synthesis services such as new OpenAI tools (like ChatGPT which has been put under the spotlight in recent months) and the promising use cases of the metaverse, should assess how the new rules will affect their product design and development processes – and their overall business operations.

Given the emerging regulations around AI technology and algorithms in China, businesses in tech and other sectors should seek to develop a robust compliance programme in line with the regulatory requirements and industry guidance on the design and operation of new technology.

Busy, challenging but exciting times in the world’s second largest economy. We are here to help!