China AI Labeling Rules: 5.6M Removals

Chinese platforms pulled 5.6 million AI-generated items in a single enforcement campaign, and the Cyberspace Administration of China ran it. Now the question that should worry anyone shipping a generative feature into mainland China: does every synthetic asset your product emits carry both marks the rules require (the visible label a human sees, and the metadata field a platform reads) and can you prove it to a reviewer under time pressure?

Key Takeaways:

• The Measures for Labeling Artificial Intelligence Generated Synthetic Contents took effect in September 2025, issued jointly by the CAC, MIIT, the Ministry of Public Security and the NRTA.
• Enforcement runs through platforms and app stores, which push verification duties upstream to the developers who ship the content.
• Metadata labels survive a server response but not a screenshot. Build provenance at generation time and keep an audit trail, because re-encoding and screen capture will strip naive marks.

The Labeling Baseline: Explicit and Implicit Marks

The Measures for Labeling Artificial Intelligence Generated Synthetic Contents (人工智能生成合成内容标识办法) were issued jointly by the Cyberspace Administration of China, the Ministry of Industry and Information Technology, the Ministry of Public Security and the National Radio and Television Administration. They have been in force since September 2025, and the clause-by-clause English introduction from Lee, Tsai & Partners remains the most usable summary for counsel who need the structure quickly.

The regime rests on two label types. An explicit label (显式标识) is what a human sees or hears: a line of text under a generated paragraph, a corner mark on an image, a spoken or audible cue at the start of synthetic audio, a caption on a video. An implicit label (隐式标识) lives in the file’s metadata and records attributes of the content and its producer, so a platform or downstream tool can inspect it without asking the user.

The distinction matters operationally because the two labels fail in different ways. An explicit mark is lost when a frame is cropped, re-shot or screenshotted. An implicit mark is lost when a file is re-encoded, or pasted into a chat window that renders only a preview card. Coverage runs across text, images, audio, video and virtual scenes; that last category covers industrial training simulators and the generated 3D environments marketing teams increasingly use.

The measures also bar providers from deleting, altering, forging or concealing labels, and they place checking duties on application distribution platforms. The technical detail of what goes in the metadata is left to supporting standards, so engineers should confirm the current national standard before fixing a schema rather than copying a competitor’s implementation.

Enforcement Math: 5.6 Million Removals

The 5.6 million figure reported by TechRepublic covers a single enforcement campaign against AI-related content, with no public breakdown by platform, content type, or whether items were removed for missing labels or for prohibited subject matter. Treat it as a signal of capacity, not a per-platform benchmark. A regulator able to process millions of items in one drive has tooling, and tooling means automated detection of synthetic media at upload.

That capacity changes who carries the risk. Removal is cheap for a platform and expensive for the account holder, so platform operators facing that exposure turn labeling into a condition of doing business. In practice the enforcement pressure reaches a foreign vendor as a documentation request during app store review, a takedown of a marketing account, or an enterprise customer adding a labeling warranty to a procurement contract.

The wider policy direction deserves a plain statement for executives who assume China trails the West on AI governance. As analysis in The Conversation notes, US tech leaders calling for new AI rules are asking for something China has already written into binding measures. The rules are narrower than the EU’s risk-based framework, but they are specific, dated and enforced.

Three Places the Rules Reach a Foreign Vendor

App distribution comes first. If your Android build ships through a domestic store, the store is an application distribution platform with a checking duty, and it can ask for evidence that your generative features produce labeled output. Teams that treat this as a legal formality discover it is an engineering deliverable, because the store will want to see the label in a running build.

Platform accounts come second. Marketing teams post AI-generated images and copy to WeChat official accounts and to domestic short-video platforms. WeChat is the default work channel for most China-based teams, which means a synthetic asset approved for a Western social channel gets forwarded into a Chinese group chat minutes later with no label attached. A campaign-level rule that covers only the official CMS misses this path entirely.

Enterprise deployments come third. AI meeting summaries, auto-translated documents and generated slide decks produced inside your own tooling and shared with a China-based customer or partner fall within the same content categories. The awkward case is the file that leaves your tenant: a transcript summary exported as a PDF, uploaded to a shared workspace, and forwarded onward. If the label lived only in the web UI and not in the exported file’s metadata, the downstream copy is unlabeled.

Labeling Beside PIPL and the Data Security Law

The labeling measures do not stand alone. They sit on top of the personal information and data security framework, and one consequence catches foreign teams: embedding a provenance label requires knowing which model, which version and which operator produced the content, which means recording metadata you may never have captured before. That capture requirement is why labeling projects slide into data-mapping projects.

Two cost implications follow. A China cross-border data transfer route is a filing exercise with its own review queue, and filings do not compress to fit a product sprint, so the route belongs in the launch plan rather than the legal cleanup afterwards. And a classification decision under the China Data Security Law cannot be made by an engineer alone, which makes external counsel in mainland China a line item rather than a contingency.

A Labeling Workflow That Survives Platform Review

Build the label where the content is generated, not where it is published. A pipeline that stamps labels at upload time will miss every export path, API response and internal share. The workable pattern is to capture provenance as structured data at generation, then emit both label types from that single record.

• Record at generation: model name and version, operator or tenant ID, UTC timestamp, a hash of the prompt, and a content ID that ties back to your audit log.
• Emit the implicit label: write the provenance record into the metadata container your file format supports, and confirm it survives your CDN and image-processing steps rather than assuming it does.
• Render the explicit label: a visible caption or mark that persists in the exported file and in screenshots a user takes of your UI.
• Keep a label registry: a queryable table that lets you answer “was this asset labeled, by which model, on what date” within a business day.
• Contract upstream: require model vendors to return provenance fields in API responses, and test that they populate them.

Then test what breaks. Screenshot the output, re-encode it at low bitrate, crop it, convert the format. Document which transformations strip the mark and decide which residual risk you accept. Teams often add a third-party watermarking service on top of metadata, and the trade-off is real: watermarking adds per-asset cost and processing latency, and aggressive watermarking can degrade image or audio quality enough that product teams push back. Metadata alone is cheaper and more precise, but it is also trivially removed by anyone who re-saves the file.

One limit belongs in your risk register: a correct label is not a defense against a content violation. Prohibited material gets removed whether or not it carries a proper mark. Labeling buys you the ability to stay on the platform, not immunity from moderation.

Budget Lines and Sequencing for 2026

Plan the work across four tracks rather than one. Legal review by mainland counsel covers the classification questions and the transfer route. Engineering covers provenance capture, metadata emission and export-path coverage. Verification covers the tooling that checks labels on incoming and outgoing assets. Platform liaison covers the relationships with the app stores and content platforms that will ask you questions.

The sequencing that wastes the least money starts with an inventory: list every place your product or marketing function emits synthetic content, and mark which of those reach users in mainland China. Most teams surface a handful of paths, including one or two that nobody owned. Then fix the highest-volume path first, because that is the path a reviewer will test.

The variable costs scale with volume: per-call watermarking services, storage for the label registry, and engineering time to cover each export path. The fixed items are counsel review and platform liaison, which are usually scoped as one-off engagements. Budget the fixed items first because they determine scope, then size the variable items from your monthly generation counts. A team that estimates storage and watermarking before it has an accurate count of generated assets will under-budget by a wide margin.

Skip the temptation to copy a domestic competitor’s implementation. Their metadata schema may reflect a national standard version you cannot verify, and a copied schema that fails a platform check costs more to unwind than a clean build. Confirm the current standard, document your interpretation, and keep that document with the release notes so the next reviewer inherits an answer instead of an archaeology project.

Compliance Checklist

• Confirm whether your app is distributed through domestic Android stores or the China App Store region, and add labeling evidence to the submission pack.
• Map every export path for synthetic text, images, audio, video and virtual scenes, including PDF exports and shared workspace copies.
• Capture provenance at generation: model, version, operator, timestamp, prompt hash, content ID.
• Implement both explicit and implicit labels from that single provenance record.
• Test label survival after screenshot, re-encode, crop and format conversion, and document accepted residual risk.
• Add labeling warranties to model vendor contracts and to enterprise customer terms.
• Complete the PIPL cross-border transfer filing and the Data Security Law classification review before launch, not after.
• Brief China-based marketing staff that assets created abroad still need labels before they reach WeChat.
• Keep an audit trail that answers a platform query within a business day.

The rules are short, the enforcement is real, and the engineering burden lands on whoever owns the generation path. Companies that treat labeling as a metadata feature shipped with the first generative release will find the platform conversations short. Companies that treat it as a legal annex will be rebuilding export pipelines during a review cycle, which is the most expensive moment to discover that a PDF export drops the label.

Sources and References

Sources cited while researching and writing this article:

• Introduction to the Measures for Labeling Artificial Intelligence Generated Synthetic Contents (Mainland China)
• US tech leaders are urgently calling for rules on AI – China already has them
• DigiChina