Direct answer: Not every use of AI triggers the same labelling duty. First decide whether you are a generation-service provider, a content-propagation platform, or an ordinary enterprise user. If your website, mini-program or API offers generation features to the public, you will usually need both visible labels and metadata labels. If you only use AI to produce marketing assets, declare AI-generated content when publishing on third-party platforms and never remove labels; on your own site, add a source note and keep generation records.
This report is for marketing/brand, website operations, customer service/sales, product/IT, legal and procurement teams working on China-facing websites, marketing and AI tools. Information is current to 2026-10-29. It is not legal advice and does not guarantee that any content will pass a platform or regulatory review; the Measures, GB 45438-2025, platform rules, contracts and counsel govern.
Decide your role, then the content type, then the evidence. Do not treat every “AI-assisted” task as “AI-generated”, and do not assume a platform label makes you compliant.
First, are you a “service provider”?
China's labelling Measures mainly target generation-service providers and content-propagation platforms; an ordinary corporate website publishing marketing content must check whether it offers generation features or runs a propagation platform.
Article 2 of the Measures for Labelling AI-Generated Synthetic Content points to “network information service providers” covered by the algorithm-recommendation, deep-synthesis and generative-AI rules. That does not automatically make every company that uses an AI tool for a brochure or WeChat post a “service provider”. But obligations increase sharply if your website, mini-program, app or API lets users generate text, images, audio, video or virtual scenes, or if you run a platform where users upload and publish content.
| Role | Typical situation | Main duties | Common mistake |
|---|---|---|---|
| Generation-service provider | Self-built, wrapped or API-relay service offering AI chat, image, voice, video or virtual scenes to the public | Visible labels, file-metadata labels, user-agreement disclosure, labels preserved on export; security assessment/filing where applicable; log retention | “We only call a third-party API, so it is not us” |
| Content-propagation platform | Website/app/community/mini-program that lets users upload and publish content | Verify metadata labels, add prominent notices, provide a user-declaration function, add propagation metadata | “The platform will detect it automatically” |
| Ordinary enterprise user | Publishing AI-generated or AI-assisted marketing assets on a website, social account, exhibition or third-party platform | Declare on third-party platforms, use platform labelling tools, never remove/alter labels; source notes and generation records on your own site | “Our website has no generation feature, so we can ignore this” |
| AI-assisted, not generated | Translation, polishing, layout or retouching without generating substantive new content | Usually not treated as generated/synthetic content; keep tool and human-review records and avoid false claims | “Any use of AI requires an AI label” |
The role matrix is an editorial framework, not a legal conclusion; applicability depends on the service, audience, platform rules and counsel. Official source: Measures for Labelling AI-Generated Synthetic Content.
Which content needs a visible label, and where?
Text, images, audio, video, virtual scenes and interactive interfaces may all need visible labels; text must include “AI/人工智能” and “generated/synthesised”, image/video text must be at least 5% of the shortest side, and video labels must last at least 2 seconds.
A visible label is a notice users can actually perceive, not a sentence buried in a privacy policy saying “this site may use AI”. GB 45438-2025 specifies label position, text height, duration and other requirements for each content type. Acceptance should check not only whether a label exists, but whether a user sees it while viewing the content.
| Content type | Visible-label requirements | What to check |
|---|---|---|
| Text | At the start, end or an appropriate middle position; text or corner mark; include “AI/人工智能” and “generated/synthesised” | Visible without expanding a note; legible font and colour |
| Image | At the edge or corner; text notice; text height at least 5% of the image's shortest side | Still visible in thumbnails, mobile view and exported files |
| Audio | At the start, end or middle; voice notice or “short-long-short-short” rhythm; normal speech speed around 120–160 Chinese characters/minute | Audible at the beginning; not drowned by background music |
| Video | At the starting frame and around the player; may also appear at the end/middle; text height at least 5% of the shortest side; at least 2 seconds at normal speed | Visible on first screen; survives full-screen and embed |
| Virtual scene | At the starting frame's edge or corner; may continue during the scene; text height at least 5% of the shortest side | Visible on entering the scene |
| Interactive interface | Continuously near the content, or at the top/bottom/background of the interface | Visible throughout generation/chat, not just a one-time pop-up |
This is an editorial summary of GB 45438-2025's visible-label methods. The full position, font, colour and examples are in the standard text; do not judge compliance from a single screenshot.
What goes into the metadata label?
The metadata label should contain the generated/synthetic attribute, provider name or code and content ID; a propagation platform also adds its own name/code and propagation ID, with only one metadata label per file.
The metadata label is read by platforms and machines rather than users, but it cannot be skipped. Appendix E of GB 45438-2025 requires an “AIGC” extension field in file metadata whose value is a JSON string recording the content attribute, producer, production ID, propagator and propagation ID. When a generation provider first writes the label, the propagator should equal the producer and the propagation ID should equal the production ID; a platform later adds its own elements.
| Field | Meaning | Evidence |
|---|---|---|
| AIGC | Metadata extension field for the implicit label; the field name/keyword should contain “AIGC” | A metadata reader can find the field |
| Label | 1 = is AI-generated/synthetic; 2 = may be; 3 = suspected | Value matches the actual content |
| ContentProducer | Generation-service provider name or code | Matches the contracting/filing entity |
| ProduceID | Unique content ID assigned by the provider | Can be traced to a generation record |
| ContentPropagator | Content-propagation provider name or code | Still identifiable after platform processing |
| PropagateID | Unique propagation ID assigned by the platform | Platform can verify it |
| ReservedCode1/2 | Reserved fields for integrity/consistency protection | Not wiped by export or transcoding |
Field descriptions are an editorial summary of Appendix E; the actual JSON format, character set and insertion location are governed by GB 45438-2025. A file should contain only one metadata label; re-check after export, copy and transcoding.
What should websites, marketing and customer service do?
If your website does not offer generation, the priority is separating AI-generated, AI-assisted and real photography; once customer service or a mini-program lets users generate content, treat it as a service-provider workflow with dual labels and logs.
“AI content” covers very different risks. AI-generated product mock-ups, customer cases, certificates, test reports and ranking charts are most likely to mislead buyers; AI customer service, digital humans and mini-program generation features can bring you directly into the service-provider obligations. The table below is an internal triage tool, not a legal classification.
| Scenario | Main risk | Minimum action | Evidence |
|---|---|---|---|
| AI product/scene images on the website | Mistaken for a real product, factory or case | Add a corner note “AI-generated illustration”; never pass AI images off as real photos/sites | Generation record, prompt, human review |
| AI copy/industry articles | Factual errors, false claims, outdated information | Human fact/source/date verification; consider an “AI-assisted, human-reviewed” note | Source links, edit record, publication date |
| AI customer service/chat/Q&A | Public generation service may trigger provider duties | Prominent “AI-generated/synthetic” notice; metadata label; human fallback; security assessment where applicable | Interface screenshots, exported file, logs |
| AI digital-human/voice video | Impersonating a real person, public figure or customer; missing label | Visible + metadata labels; portrait/voice authorisation; no impersonation | Authorisation, final video, metadata |
| AI-generated cases/certificates/comparisons | High risk of misleading marketing | Do not use AI to create customer cases, certificates, test reports or rankings; label illustrations clearly | Real authorisation and source evidence; if absent, do not publish |
| Publishing on third-party platforms | Platform cannot verify metadata, or user does not declare | Declare, use the platform's labelling tool, never remove labels | Publishing record, platform notice screenshot |
| Mini-program/API/wrapper | Treated as a generation-service provider | Dual labels, user agreement, export preservation, logs; filing/security assessment where applicable | Agreement, assessment file, export test |
| English content for export markets | Treating China's rules as the whole compliance picture | Check the target market too; a China label does not replace EU/US requirements | Target-market rule list, local counsel |
Scenario guidance is an editorial judgement, not legal advice. High-risk cases (customer cases, certificates, test reports, financial/medical claims) should be paused rather than pushed live with an AI-generated asset.
What does the 2025–2026 enforcement timeline show?
The Measures and GB 45438-2025 took effect together on 2025-09-01; by 2026 platforms had been interviewed and a mini-program ordered offline, showing checks have moved from “do you have a policy” to “do the page, file and export actually carry labels”.
The Measures and the mandatory national standard GB 45438-2025 took effect on 1 September 2025. Official notices in 2026 show that supervision covers not only generation but also export, propagation and platform verification: platforms were interviewed, ordered to rectify, warned and had responsible persons disciplined; a mini-program was ordered offline for missing visible labels, metadata labels, export labels and a security assessment; websites providing chat/Q&A through an “API relay” were penalised for not completing a security assessment.
| Date | Official action | What it means |
|---|---|---|
| 2025-02-28 | GB 45438-2025 published | Visible/implicit labelling now has a mandatory method standard |
| 2025-03-14 | Labelling Measures published | Clarifies duties of service providers, platforms and users |
| 2025-09-01 | Measures and standard take effect | New features should be designed with dual labels, not patched after launch |
| 2026-04-28 | Authorities act against “Jianying”, “Maoxiang” apps and “Jimeng AI” website | Platform-side labelling failures can lead to interviews, rectification orders, warnings and responsible-person discipline |
| 2026-09-15 | Ten enforcement cases published, including a mini-program without labels and an API-relay service without a security assessment | Visible labels, metadata, export and assessment are checked together; calling a third-party model does not create immunity |
The timeline lists official public notices only; penalties and facts are governed by the originals: 2026-04-28 notice, 2026-09-15 cases. This does not mean every company is being inspected, nor does it predict a penalty.
Pre-publication acceptance checklist
Before publishing, check role, content inventory, visible label, metadata label, export, platform declaration, contracts and records; if any item cannot be explained, do not launch.
The checklist can be shared by marketing, IT, legal and suppliers. The point is not to have a policy document, but to produce page, file, log and contract evidence. For an ordinary corporate website, at minimum include AI-generated images, cases, customer service and third-party publishing in the sample.
| Check | Pass standard | Evidence | If it fails |
|---|---|---|---|
| Role | Generation service / propagation platform / ordinary user identified and documented | Role list, legal note | Pause launch, re-assess |
| Content inventory | AI-generated, AI-assisted and real photography separated | Asset register, generation record | Do not publish what cannot be classified |
| Visible label | Position, wording, height and duration meet the standard | Page/video screenshots, mobile test | Fix and retest |
| Metadata label | Metadata contains the AIGC field and required elements | Metadata reader output | Re-export/re-write |
| Export/download | Label survives export, copy and transcoding | Exported-file sample | Fix the export path |
| Platform declaration | Declared when publishing on third-party platforms | Publishing record, platform notice | Declare or take down and republish |
| User agreement | Explains label method/style and user duties | Agreement version, page link | Add clauses |
| Supplier contract | Who adds labels, writes metadata and fixes issues is written down | Contract/addendum | Do not accept a verbal assurance |
| Logs | Object information and generation records available; at least 6 months where legally required | Log fields, retention policy | Add logging |
| Security assessment/filing | Completed where applicable, materials available | Assessment/filing file | Assess before launch |
| Human review | High-risk content reviewed and correctable | Review record, correction process | Add review |
| Sampling/recall | Regular sampling and takedown/recall process | Sampling sheet, drill record | Add process |
The checklist is an editorial suggestion, not legal advice. “At least 6 months” corresponds to Article 9 of the Measures, where a user requests content without a visible label; it is not a universal retention period for every company.
What should procurement and contracts cover?
Do not settle for “the supplier guarantees compliance”; specify who adds visible labels, who writes metadata, whether export preserves it, who gets logs, who owns rule changes, and how remediation or compensation works.
A common failure is buying an AI image/digital-human/chat tool where the supplier says “we handle compliance”, but exported files have no metadata, platform templates strip the label, logs sit in the supplier's cloud, and nobody owns a platform-rule change. Procurement should turn labelling into deliverable, testable items rather than a one-line assurance.
| Clause | What to specify | Evidence |
|---|---|---|
| Label responsibility | Who adds visible labels, who writes metadata, who declares on platforms | Responsibility matrix, interface description |
| Metadata | Fields, values, insertion point, preservation on export | Sample file, reader output |
| Export/download | Duties after copy, transcoding, screenshot or re-editing | Export sample, documentation |
| Logs/audit | Log fields, retention, who can access and how | Log sample, API/back office |
| Rule changes | Who updates when laws/platform rules change, and when | Update record, notification process |
| Breach/takedown | Remediation and compensation for missing/removed labels or a platform takedown | Breach clause, contingency plan |
Contract suggestions are editorial, not legal advice; terms depend on the business, platform and counsel.
How should the 90 days be sequenced?
Weeks 1–2 inventory and tier the content, weeks 3–4 fix pages/exports/metadata, weeks 5–8 add contracts/logs/training, weeks 9–12 sample and drill; pause high-risk content instead of waiting for a notice.
If there is no labelling register yet, use 90 days for a minimum loop: list every AI-generated/AI-assisted asset, tier it by website, customer service, mini-program/API and third-party platform; fix visible labels and the export path; then add contracts, logs, training and sampling. The effort ranges below are editorial assumptions, not a quote or commitment.
| Stage | Action | Output | Pause gate |
|---|---|---|---|
| Weeks 0–2 | Inventory content, tools, platform accounts and public generation features | AI content register, role decision | Role unclear: pause new features |
| Weeks 3–4 | Fix visible labels, metadata, export and page notices | Page/file samples, test record | Export loses the label: do not launch |
| Weeks 5–8 | Add contracts, logs, user agreement, training and human review | Contract clauses, logs, training record | Supplier unwilling: change solution |
| Weeks 9–12 | Sample, re-check platform declarations, drill takedown/recall | Sampling report, drill record | High-risk content found: take it down first |
The 90-day window is an editorial suggestion and excludes the actual time for legal review or a security assessment; a small website may need 1–3 person-weeks for inventory, while multi-product/platform services usually need more.
Who should read this, who should not, and what decision does it support?
It fits teams using AI on websites, marketing, customer service or mini-programs; it does not fit offline-only teams, teams with no AI content, or teams looking for a “guaranteed approval” shortcut.
Who should read: marketing/brand, website operations, customer service/sales, product/IT, legal/procurement; companies using AI images, copy, digital humans or AI customer service, or running a mini-program/API/content platform; exporters should keep China's labelling rules separate from target-market rules. Who should not: teams with no AI-generated content and no website/mini-program/platform account; teams looking for “label removal” tools or a guarantee of no penalty; teams that need formal legal advice but will not provide business facts and contracts. Decisions supported: whether labelling is needed, where to place it, what metadata to write, how website/marketing/customer service should divide the work, what to put in supplier contracts, and when to pause a launch.
FAQ
If our website uses AI-generated images, must every image carry an “AI-generated” label?
If the website only publishes marketing content and does not offer generation features, it may not automatically fall under the Measures' “service-provider” duties. But passing an AI image off as a real photo, factory or customer case still creates misleading-marketing and platform-rule risk. Add a corner note such as “AI-generated illustration” and keep generation records; do not use AI for high-risk product/certificate/case images.
Does AI polishing of copy also require a label?
“AI-assisted” and “AI-generated/synthetic” are not the same. Translation, polishing, layout or retouching that does not create substantive new content is usually not treated as generated content; if AI creates a new product description, case, image or video, manage it as generated content. When the boundary is unclear, keep tool records and human review, and ask counsel.
Where is a label “prominent” enough?
For text, put it at the start, end or an appropriate middle position, or around the text/interface; for images, video and virtual scenes, put it at an edge or corner, with text height at least 5% of the shortest side; video at least 2 seconds; audio audible at the start/end/middle. A sentence in a privacy policy or footer is usually not “prominent”.
Is a watermark enough for the implicit label?
No. The standard requires an AIGC extension field in file metadata with specified elements (attribute, producer, production ID, propagator, propagation ID, etc.); a digital watermark is only an optional form of “content implicit label” and cannot replace the metadata field. Re-check after export, copy and transcoding.
If the third-party platform already labels the content, do we still need to declare it?
Yes. Article 10 of the Measures requires users publishing generated content through a network content-propagation service to declare it and use the platform's labelling function. A platform label does not replace the user's declaration, nor does it justify removing or altering a label.
What evidence should we collect when a supplier says “we are compliant”?
At minimum: a label-responsibility matrix, visible-label samples, metadata fields and reader output, post-export/transcoding samples, log fields and retention, a platform-rule change process, and breach/takedown remediation clauses. A written “we guarantee compliance” is not enough; attach sample files and test records to acceptance.
What happens if we remove or crop an AI label?
The Measures prohibit maliciously deleting, altering, forging or concealing labels, and prohibit providing tools or services for others to do so. Platforms may take down content, restrict distribution or sanction accounts; companies may also face contract breach and platform claims. Do not use cropping, compression or transcoding to “remove” a label.
Bottom line
Decide your role first, then the content: generation services and propagation platforms need visible + metadata + export + log controls; ordinary enterprises using AI for marketing should at least declare on third-party platforms, add source notes on their own site, and never pass AI off as real photography or cases. When a high-risk case is unclear, pause and ask counsel.
Method and limits
This article is public regulation, mandatory-standard, official enforcement-notice and editorial research, not legal advice for any company, product, content or project. It uses no unpublished client assets, platform back-office data or regulator-internal opinions; the role matrix, scenario guidance, acceptance checklist and 90-day plan are editorial, and applicability must be confirmed under the regulation, GB 45438-2025, platform rules, contracts and counsel. Regulations, standards and platform rules change; the latest official text governs.
Sources
Information is current to 2026-10-29; each official/primary page governs its own scope and version.
- Measures for Labelling AI-Generated Synthetic Content (国信办通字〔2025〕2号): cac.gov.cn. Published 2025-03-14, effective 2025-09-01; primary basis for visible/implicit labels, platform verification, user declarations and liability.
- Q&A on the Labelling Measures: cac.gov.cn. Explains the relationship between the Measures and the mandatory national standard and the specific duties of service providers.
- GB 45438-2025, Cybersecurity technology — Labelling method for content generated by artificial intelligence: openstd.samr.gov.cn. Published 2025-02-28, effective 2025-09-01; method standard for label position/height/duration and metadata fields.
- Authorities act against “Jianying” app and other websites with labelling violations: cac.gov.cn. 2026-04-28 notice; enforcement case for platform-side labelling failures.
- Recent enforcement cases in cybersecurity, data security and personal-information protection: cac.gov.cn. 2026-09-15 notice; includes a mini-program without labels and an API-relay service without a security assessment.