September 2025 labeling control points
Four control points recur across compliant generation, distribution, and audit designs:
- Explicit labelsVisible or audible user notices so ordinary users can identify synthetic content.
- Implicit provenancePersistent metadata or watermarks that remain detectable after light editing.
- Redistribution dutyPlatforms and app distributors must label or block unlabeled synthetic content.
- Audit evidenceLabeling logs and technical records retained for supervision and traceability.
What the September 2025 Measures cover
The Measures for the Identification of Artificial Intelligence-Generated Synthetic Content, jointly issued by the Cyberspace Administration of China and other regulators, became effective on 1 September 2025. They sit within China’s broader generative AI and deep-synthesis management framework and focus on how synthetic content is marked and traced, not on model training alone.
In-scope content includes AI-generated or AI-significantly-modified text, images, audio, video, and virtual scenes offered through generative AI or deep-synthesis services in China. Obligations apply to entities that provide those services inside the PRC, including operators offering APIs, applications, or content-generation features to domestic users. Downstream online platforms and application distributors that host or disseminate synthetic content share responsibility when content reaches users without required marks.
For enterprise AI governance leaders, the practical scope is operational: any workflow that produces, materially transforms, or redistributes synthetic media for China users is a candidate for controls. Purely internal tools versus external-facing services were not exhaustively illustrated in the initial text, so inventory work should start broad and narrow with legal interpretation rather than assuming internal-only systems are exempt.
| Actor | Primary duty | Typical touchpoints |
|---|---|---|
| Service providers | Apply explicit and implicit labels at generation and material transformation | Model APIs, apps, editing tools, virtual scenes |
| Platforms and distributors | Label or refuse unlabeled synthetic content when they know or should know it is AI-generated | Hosting, app stores, feed redistribution |
| Enterprise operators | Runtime gates, lineage, logs, and supplier evidence across China-facing paths | Agents, orchestration, CMS publish, vendor APIs |
Explicit labels, implicit provenance, and re-labeling triggers
Service providers must add explicit labels so ordinary users can readily identify synthetic content. Explicit mechanisms include on-screen text banners, audible announcements, visible watermarks, and interface indicators shown at generation or playback time. The design goal is human recognition, not merely a buried terms notice.
Providers must also embed implicit labels: persistent metadata or technical watermarks that carry provenance and remain detectable after ordinary distribution or light editing. Implicit marks support platform detection, regulatory traceability, and machine verification when human-facing cues are stripped or overlooked. APIs that return synthetic media should expose human-readable and machine-readable label data through response headers or sidecar manifests so downstream systems can preserve or re-apply marks without reverse engineering the payload.
Where content undergoes further editing or transformation that materially changes its synthetic character, the party performing the transformation must update or re-apply appropriate labels. Translation, summarization, style transfer, AIGC editing, and agent-driven multi-step rewriting all fall into this class of risk. Secondary sources still differ slightly on the exact boundary of “significant modification,” and national standards for watermark algorithms and metadata schemas were still being refined around the effective date. Enterprises should treat re-labeling as required whenever synthetic origin is preserved or increased, and track implementing standards documents as they finalize.
Re-label when in doubt on external outputs
Until official Q&A narrows “significant modification,” treat translation, summarization, style transfer, AIGC editing, and multi-step agent rewriting as re-labeling events whenever content can reach China users.
Runtime and lifecycle controls enterprises need
Labeling is a path-control problem, not a one-time model configuration. Generation, agent tool use, content transformation, API egress, and platform publish gates all need coordinated policy.
A workable pattern is a centralized labeling and provenance service on the generation path so every model output and agent-produced artifact receives explicit and implicit marks before leaving the trust boundary. Agent and tool-calling pipelines must propagate provenance tags through intermediate steps; otherwise a correctly marked draft can become an unlabeled final answer after tool results are merged. Content management and orchestration layers should verify labels at post-edit and publish gates, not only at first generation.
Architecture choices that commonly matter in multi-region estates include segregating China-facing inference and content-delivery stacks when global systems cannot uniformly enforce PRC labeling rules, and ensuring third-party model and API gateways expose hooks to inject or verify labels without breaking latency or authenticity checks. Metadata schemas should align with emerging national or industry watermark and content-credential formats so platforms and regulators can verify marks. Immutable audit logs should record model version, prompt or tool-call context, label type applied, timestamp, and downstream distribution target, with retention set to the period stipulated by the Measures and aligned to broader PRC data-security and personal-information rules for access and cross-border transfer.
Control surface summary
- Centralized labeling and provenance on the generation path
- Provenance propagation through agent and tool-call steps
- Verification at post-edit and publish gates
- China-facing stack segregation when global enforcement is uneven
- API hooks for label inject and verify on third-party gateways
- Immutable logs: model version, context, label type, time, destination
Implementation sequence for in-scope systems
Start with a complete map of internal and customer-facing workflows that generate, edit, or redistribute text, image, audio, video, or virtual-scene content for China users. Extend existing AI risk and model inventories to flag systems under the September 2025 Measures and track remediation status by owner and residual risk.
- Inventory generation, edit, and redistribution workflows for China users; assign owners and residual risk.
- Instrument SDKs, orchestration layers, and content pipelines to apply and verify labels at generation, post-edit, and publish gates.
- Test watermark and metadata persistence across storage, CDN, transcoding, and social-platform redistribution paths; a label that dies in compression is not a control.
- For agents, require provenance fields on tool results and policy checks before any channel that can reach a China user.
- Update vendor contracts and technical onboarding to require label-generation capability, log access, and audit support.
- Produce runnable compliance evidence packs: sample labeled outputs, log extracts, and policy configurations.
Runtime policy enforcement, monitoring, and audit logging capabilities used for agent and tool governance can help ensure labeling and provenance rules execute consistently at inference and tool-approval time, provided they are configured against PRC-specific label requirements rather than generic content policies.
Governance and evaluation checklist
- China-facing generation, edit, and redistribution paths are inventoried and owned.
- Explicit labels are present at generation and playback for in-scope media types.
- Implicit metadata or watermarks persist through expected distribution and light editing.
- Agent and API pipelines propagate provenance; publish gates verify before egress.
- Logs retain model, context, label type, timestamp, and destination with defined retention.
- Suppliers can generate labels and provide audit access under contract.
- Evidence packs (samples, logs, policy configs) are ready for supervision review.
Practical uncertainties to manage, not ignore
Three uncertainties should shape program design without delaying baseline controls. First, detailed national standards for exact watermark algorithms, metadata schemas, and interoperability were still maturing around the effective date; build adapters rather than hard-coding a single proprietary mark format. Second, the precise scope of “significant modification” may be narrowed by official Q&A or later guidance; until then, re-label when in doubt on external-facing outputs. Third, enforcement posture toward purely internal enterprise tools remains less illustrated than for consumer-facing services; document rationale for any internal exception and keep the ability to enable full labeling quickly.
Enterprises that already operate runtime governance for agents (identity, least-privilege tool permissions, approval workflows, and audit logging) are better positioned to extend those same enforcement points to labeling and provenance policy. The Measures still require China-specific label semantics, persistence testing, platform redistribution handling, and supplier evidence. The durable outcome is not a one-off watermark project but an operable control set across generation, transformation, distribution, and audit.