ChinaProvisions on the Administration of Deep Synthesis Internet Information Services, Article 10
Provisions on the Administration of Deep Synthesis Internet Information Services (互联网信息服务深度合成管理规定) issued by CAC, MIIT and MPS, 2022, Art. 10
In force since .
An AI governance rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Market targeting
- Audit expectation
- none
What it requires
- Strengthen your management of deep synthesis content: review your users' input data and synthesis output by technical or manual means, and record and retain the related network logs, if you provide a deep synthesis service.NIST AI RMFMEASURE 2.4
- Build and maintain a feature database for identifying illegal and undesirable information, with entry standards, rules, and procedures.NIST AI RMFMEASURE 2.4
- Upon discovering illegal or undesirable information, take disposal measures and preserve relevant records in accordance with law, and promptly report the discovery to the cyberspace administration department and the relevant competent authority. The text marks only this reporting step as prompt, counted from the moment of discovery, and states no separate promptness standard for the disposal and record-keeping steps that precede it.NIST AI RMFMANAGE 4.3
- Separately take measures against the responsible user, such as warning, restricting features, suspending the service, or closing the account, in accordance with law and your service agreement.NIST AI RMFMANAGE 4.1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MEASURE 2.4The functionality and behavior of the AI system and its components – as identified in the MAP function – are monitored when in production.
- MANAGE 4.1Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management.
- MANAGE 4.3Incidents and errors are communicated to relevant AI actors, including affected communities. Processes for tracking, responding to, and recovering from incidents and errors are followed and documented.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 10's second paragraph requires a deep synthesis provider to build a feature database for identifying illegal and undesirable information and states directly that the provider shall 'record and retain the related network logs' (记录并留存相关网络日志). Its third paragraph requires a provider that discovers illegal or undesirable information to take disposal measures, preserve relevant records (保存有关记录), and promptly report to the cyberspace administration department and the relevant competent authority. The first paragraph, requiring review of users' input data and synthesis output, states no record of its own. The article states no retention period for either record, and no numeric period appears anywhere else in this Provisions' text. The third paragraph's own words send a report to the cyberspace administration department and the relevant competent authority; they do not give either one a power to inspect or demand the preserved record itself. Article 21 of the same Provisions, outside this instrument's own citation, separately gives the cyberspace and other competent departments a standing supervision-and-inspection power that the provider must cooperate with, which is where that access route actually lives.
- Kind
- Explicit
- As of
- Provision
- Article 10, second and third paragraphs
- Trigger
- content_generation
- security_incident
What this law does
Article 10 of the Provisions on the Administration of Deep Synthesis Internet Information Services requires a deep synthesis service provider to strengthen its management of deep synthesis content, review users' input data and synthesis output by technical or manual means, build a database of features for identifying illegal and undesirable information, and record and retain the related network logs.
Where the provider discovers illegal or undesirable information, the article requires it to take disposal measures and preserve relevant records in accordance with law, and to promptly report the discovery to the cyberspace administration department and the relevant competent authority, while separately taking measures such as warning, restricting features, suspending service, or closing the account against the user responsible.
Only the reporting step in that sentence carries the word 'promptly' in the text; the disposal and record-preservation steps that precede it carry no separate promptness standard of their own.
When LexLint raises it
When your app profile says your app generates content with AI, deploys a chatbot or processes biometric data.
Back to the example · Lint your app
Page updated .