China's AI labelling rules: two labels, and four parties who must apply them

01The clock

Unusually, the rule and the engineering specification arrived together and commenced together, with roughly six months of transition. That is why Chinese implementations are further along than most Western ones: the technical answer was published at the same time as the duty.

1. 28 February 2025 GB 45438-2025 is issued

   The mandatory national standard — Cybersecurity technology — Labeling method for content generated by artificial intelligence — issued by SAMR and SAC. Note "GB", not "GB/T": mandatory, not recommended.

2. 14 March 2025 The Measures are published

   Issued jointly by the Cyberspace Administration of China with MIIT, the Ministry of Public Security and the NRTA. Fourteen articles.

3. 1 September 2025 · in force Both instruments commence

   The management duties and the technical method take effect on the same day.

4. 25 November 2025 First nationwide enforcement sweep

   CAC concentrates enforcement against mobile apps over labelling failures — on both the provider side and the platform side. What they cited is below.

02Are you covered?

This is the most-missed point in English coverage, and it is the first thing to get right. The Measures do not define their own class of regulated entity. Article 2 borrows the scope of three upstream instruments, and you are caught only if you already fall inside one of them.

03Two labels, not one

The regime splits every obligation along one axis: can a person perceive it? Getting this distinction wrong is the most common implementation failure, because the two labels have different legal triggers.

04The chain

This is the structural difference from every Western regime. The EU regulates the producer. China regulates the distribution chain — four parties, each with its own duty, and the file carries provenance from one to the next.

Article 10 also prohibits anyone — not just regulated providers — from maliciously deleting, tampering with, forging or concealing a label, or supplying tools or services for others to do so. It further prohibits harming someone's lawful interests through improper labelling, which catches false labelling too: tagging a genuine human recording as AI-generated in order to discredit it is within the prohibition.

05The platform's three questions

Article 6 gives a dissemination platform a decision procedure, and the wording of the notice it must display changes with the answer. The distinction between the three tiers is not cosmetic — it is the difference between telling the public something is, may be, or is suspected to be synthetic.

In all three cases the platform must then write dissemination elements into the file metadata — the generation attribute, its own platform name or code, and a content number. This is the step platforms skip. They ship the badge and omit the write-back, and it was cited as a violation in CAC's first enforcement sweep.

Note what the platform is exposed to here. Tier one is a verification duty — an affirmative check of files. Tier three is a detection duty triggered by traces. Neither the Measures nor the standard set an accuracy threshold, so a platform is answerable for outcomes against no defined benchmark. What it can do is show what it saw and what it decided, at the time it decided.

06The six-month log

Article 9 is the only retention duty in the Measures, and it is routinely reported far more broadly than it reads. It is not a general log-retention rule for AI content.

Four conditions, all narrow: it binds the generation provider only, not the platform; only in the unlabelled-supply case; only after the agreement is in place; and the metadata label still applies — Article 9 waives the visible label, not the embedded one.

What it actually creates is an evidentiary duty rather than a labelling one. Six months later, the provider has to be able to show who received unlabelled output and on what agreed terms. That is a duty on the record, not only on the act — and a record that can be edited in the intervening six months does not discharge it.

07Duty → receipt

This is where Planisphere enters, and not before. One event type per act in the chain. The field names are the fields the API accepts, and they follow the regime's own structure — including the propagation write-back and the Article 9 case.

Two properties matter more than the field list. Content never leaves your systems — commitments are hashes, so a record can bind to a file, an agreement or a recipient identifier without any of them being transmitted. And records are sealed on write: hash-chained into a per-tenant series, signed, and periodically anchored, so an edit to an earlier record breaks the chain in a way a third party can detect without trusting either of us. For a six-month retention duty, that difference is the whole point.

08The integration

One HTTPS call per act, from wherever the act happens. Nothing sits in your generation or publishing path, so nothing here can fail closed and take your pipeline down.

The Article 9 case is the same call with unlabelled_supply_agreed, committing the agreement hash and a hashed recipient identifier, with retention_until carrying the six-month horizon. The recipient is committed as a hash, so the log identifies who received the content without your putting an identity into our systems.

The full API reference covers authentication, idempotency, batching and rate limits; pricing is per record with a monthly free allowance.

09How it is actually enforced

Article 13 sets no penalty. The Measures are a normative document and cannot create one; they refer enforcement out to the competent departments under existing law, with sanctions borrowed from the upstream instruments and the Cybersecurity Law. In practice, published enforcement has been administrative rather than financial — regulatory interviews, orders to rectify within a deadline, formal warnings, delisting, and account-level sanctions.

What has actually happened is more instructive than the theory:

• 25 November 2025 — a nationwide sweep of mobile apps. On the provider side, CAC cited missing explicit labels, labels not carried through on export, and missing metadata. On the platform side: failure to verify metadata, failure to display the notice, failure to write dissemination metadata, and no declaration function for users. The number of apps was not disclosed.
• 12 February 2026 — a campaign reporting 13,421 accounts sanctioned and more than 543,000 items removed. Categories included unlabelled AI content, face-swap impersonation of public figures, and — squarely under Article 10 — selling de-labelling tutorials, software and services.
• 28 April 2026 — CAC publicly named three services for failing to implement labelling effectively, citing the Cybersecurity Law, the Interim Measures for Generative AI Services and these Measures together, and directed local offices to apply interviews, rectification orders and warnings.

The pattern to plan against: enforcement is specific and it names the failure. Two of the three most-cited failures — export stripping and the missing write-back — are questions about what your systems did to a particular file on a particular day.

11Questions

Does our C2PA implementation satisfy GB 45438-2025?

No. The standard specifies a flat JSON object under an AIGC key in the file's native metadata, with named fields for the producer and the propagator. C2PA is a cryptographically signed manifest with assertions and a hard binding to the asset. They can coexist in the same file — and in a multi-jurisdiction pipeline they generally must — but neither satisfies the other.

We only sell an API to businesses. Are we out?

Unresolved. The Measures contain no B2B or API exemption, and scope is inherited from the upstream instruments — one of which carves out services not provided to the domestic public. An API confined to a closed enterprise pipeline is arguably outside; one whose output reaches public-facing Chinese content is not. This is a question for counsel, not a page.

Our metadata keeps getting stripped by re-encoding. Is that a violation?

Article 10's prohibition is on malicious removal, so incidental loss in a transcode is not on its face a breach of it. But it can still put you in breach of your own Article 5 or Article 6 duty, and preserving the block through edit, transcode, export and delivery is an engineering programme rather than a configuration change. Recording what you wrote, when, is the part that survives the re-encode.

How does this compare with the EU?

China prescribes the method and regulates the whole distribution chain; the EU states an outcome and binds providers and deployers only. Nothing in Article 50 obliges a platform or an app store to inspect files and re-mark them. The EU page covers that regime.

What happens to our content and metadata?

Content is never transmitted — only hash commitments. Declared metadata values are retained only when the pack marks the key as retainable and your organisation has enabled retention; otherwise only key names and a canonical hash are kept. Person-identifying keys are never retainable, which is why a recipient identifier is committed as a hash.

12Sources

Every article number, date and duty on this page traces to one of these. Where the Chinese text is summarised in English, the summary is ours and the citation points at the original.

• Primary CAC — the Measures, full text and issuing notice All fourteen articles: the derivative scope in Art. 2, the two labels in Arts. 4 and 5, the platform ladder in Art. 6, the six-month log in Art. 9, the prohibitions in Art. 10, and the referral of enforcement in Art. 13.
• Primary CAC — official questions and answers on the Measures The legal basis, the relationship to the national standard, the transition period, and the sectoral carve-outs.
• Primary GB 45438-2025 — the mandatory national standard Issued 28 February 2025, in force 1 September 2025. The labelling method, and the metadata schema at Annex E.
• Primary CAC — the November 2025 enforcement sweep The itemised provider-side and platform-side failures, including export stripping and the missing dissemination write-back.
• China Law Translate — English translation of the Measures The standard English rendering of the article text quoted in substance above.
• TC260 — implementation practice guides for the metadata label Per-format embedding for text, image, audio and video files, plus a guide on protecting the integrity of the label itself.