APAC AI Watch Series | Greater China

China Strengthens Labeling Requirements on AI-Generated Content

China’s AI sector has entered a transformative phase since 2024, driven by breakthroughs in generative AI and multimodal large language models (LLMs). A representative example at the forefront is Deepsea, a pioneering start-up based in Hangzhou, which has significantly redefined global perceptions of China’s AI capabilities. At the same time, the capital expenditure from tech giants on AI investments continue to surge. 

AI is becoming an increasingly significant battleground in international competition. Against this backdrop, China is accelerating its AI legislation and trying to strike a balance between promoting innovation and the need to safeguard the necessary negative impacts of AI technology.

Regulatory Frameworks on AI

Unlike the EU's approach of formulating a unified Artificial Intelligence Act, China has opted for a “small incision” approach to implement experimental regulation.

Generally, AI technology and services are regulated within the framework of existing laws and regulations, such as the Cybersecurity Law, Data Security Law, and Personal Information Protection Law, which address high-level issues relating to data, privacy, cyber security, etc. Existing regulations specifically governing AI mainly focus on generative AI.

To mitigate risks amid rapid innovation, China has introduced stringent rules since 2022, including:

• On 25 November 2022, China promulgated the Administrative Provisions on Deep Synthesis of Internet-based Information Services (Deep Synthesis Provisions). Deep synthesis service providers within China are required to strengthen the management of deep synthesis content and examine the data input by users and synthesis results. For the contents generated or edited by the deep synthesis services, providers must implement technical measures to add identifying marks and maintain logs for record-keeping.
• On 10 July 2023, China promulgated the Provisional Measures for the Administration of Generative Artificial Intelligence Services (Generative AI Measures), marking the country’s first regulations targeting generative AI. These measures require generative AI service providers to meet obligations related to algorithm training, content management, and regulatory mechanisms.

The core of the Generative AI Measures is to strength the responsibilities of generative AI service providers by implementing a classified and graded regulatory mechanism. This mechanism imposes different levels of compliance obligations on service providers based on the sectors they belong to and whether they have the attributes of public opinion or the ability to mobilize society (which is not clearly defined).

The Generative AI Measures also require service providers to rectify algorithms and take timely actions, such as stopping generation, transmission, and elimination to manage illegal content.  Providers are also required to mark pictures, videos and other generated content in accordance with the Deep Synthesis Provisions. 

Furthermore, the measures also emphasize the importance of using lawful data sources and ensuring non-infringement of personal information rights and intellectual property rights for data processing activities. Service providers are also required to improve the quality, as well as enhance the authenticity, accuracy, objectivity, and diversity of training data.

Latest developments on Labeling AI-Generated Content

On 7 March 2025, China published the Promulgation of the Measures for Labeling AI-Generated or Composed Content (Labeling Measures), which take effect on 1 September 2025. The measures aim to enhance the transparency and traceability of AI-generated content and are considered a refinement of the labeling requirements in the Deep Synthesis Provisions and the Generative AI Measures mentioned above.

The Labeling Measures standardize the requirements for generative and synthetic service providers, requiring the addition of both explicit and implicit labels (where applicable) to generated synthetic content, including text, images, audio, video, and virtual scenes:

• Explicit labels - these must be prominently displayed in user-perceptible formats, such as by way of text prompts, watermarks, or audio cues, at specified positions depending on the content type.
• Implicit labels - these are technical markers, such as metadata or digital watermarks, embedded in file headers to record source and authorship information.

The Labeling Measures also provide specific guidelines for adding tags to different types of content.

Under the Labeling Measures, where an APP service provider offers such services, the APP distribution platform must verify the labeling materials for its generated or composed content. Additionally, the service providers are required to specify the methods, styles and other specifications for labeling generated or composed content in the user service agreements, and remind users to carefully read and understand the relevant labeling management requirements.

Our recommendations

Clients offering AI services within China should closely monitor the evolving regulatory landscape. Its dynamic regulatory framework, which emphasizes categorized and graded supervision, multi-stakeholder accountability, and ongoing standardization efforts (e.g., plans to establish over 50 AI-related standards by 2026), demands proactive adaptation. As China continues to refine its AI governance paradigm, we will closely track legislative developments. 

PCPD’s Ethical AI Guidance and AI Model Framework

Currently, Hong Kong does not have an overarching legislation governing AI. Instead, it relies on a combination of existing laws and sector-specific guidelines to address AI-related risks and challenges. 

In 2021, the Privacy Commissioner for Personal Data (PCPD) established itself as a key authority on AI governance by publishing the Guidance on the Ethical Development and Use of Artificial Intelligence (Ethical AI Guidance). This guidance extends beyond personal data protection, offering a broad framework to help organizations understand and comply with the Personal Data (Privacy) Ordinance (Cap.486) (PDPO) when developing or employing AI. This was essential to the development of Hong Kong, not only as a data hub, but also as a world-class smart city driving technological innovation. 

The Ethical AI Guidance advocates three data stewardship values: being respectful, beneficial and fair. It also outlines seven ethical principles: accountability, human oversight, transparency and interpretability, data privacy, fairness, beneficial AI, and reliability, robustness and security. It also provides practical guidance for organizations managing AI systems to uphold these values and principles.

To support the Global AI Governance Initiative released in mainland China, the PCPD further introduced the Artificial Intelligence: Model Personal Data Protection Framework (AI Model Framework) in June 2024. This framework reiterates and expands on the main principles set out in the Ethical AI Guidance, and offers best practice recommendations for organizations procuring, implementing and using AI systems that involve the use of personal data, to align with the Data Protection Principles (DPPs) of the PDPO. 

Under both the Ethical AI Guidance and the AI Model Framework, organizations are advised to adopt a risk-based approach, meaning they should adopt measures proportional to the risks that an AI system may pose in a given context. The PCPD has set out the following four key aspects for organizations to consider:

1. Developing internal AI governance strategies – this involves establishing an AI strategy that defines the purposes of AI solution procurement and how AI systems are implemented and used. It also includes governance considerations for procuring AI solutions, setting up an AI governance committee (or similar body) to steer and oversee the entire lifecycle of AI solutions, and providing adequate training to relevant personnel.
2. Conducting thorough risk assessments with continuous human oversight – organizations should systematically identify, analyze and evaluate risks through comprehensive risk assessments conducted by a cross-functional team during AI system procurement or updates. This includes addressing personal data privacy risks in a risk assessment; implementing, documenting and maintaining the risk management system throughout the AI system’s life cycle and reviewing risk assessments in line with the organization’s AI policies. An appropriate level of human oversight should be adopted, and assessments of risk-mitigation trade-offs should be adopted. Generally, the higher the risk profile (e.g., likelihood of an AI system to have a significant impact on individuals, such as one used for evaluating individuals' eligibility for social welfare), the greater the human oversight required. Human oversight should be continuous.
3. Customizing AI models and managing AI systems adequately – organizations must ensure compliance with the DPPs under the PDPO, minimize the personal data involved to reduce privacy risks and manage the quality of data used to customize and use an AI model. This includes documenting the handling of data for customization and use of AI, rigorously testing and validating AI models to ensure intended performance, and evaluating the reliability, robustness, fairness and system security of AI models before deployment (especially for customized models). Continuous monitoring and reviewing of AI systems to ensure system security and data security, observing industry-best security practices, conducting internal audits periodically, and establishing an AI Incident Response Plan to monitor and address incidents are also critical.
4. Communicating and engaging with stakeholders effectively and regularly – organizations should engage with stakeholders, including internal staff, AI suppliers, customers and regulators. They should communicate the required information to the data subjects in accordance with the DPPs (where personal data are involved), clearly and prominently disclosing the use of AI systems, their purpose, benefits, limitations and effects, as well as the result of risk assessments. Establishing a user feedback channel and making the decisions and output of AI explainable to stakeholders are also important steps.

Digital Policy Office’s Ethical AI Framework

Following the steps of the PCPD, the Digital Policy Office led by the Commissioner for Digital Policy, published the Ethical Artificial Intelligence Framework (Ethical AI Framework) in July 2024. This government branch is responsible for the policy and regulation of information and technology. The framework is designed to assist government departments and bureaus in planning, designing and implementing AI and big data analytics in IT projects and services. It consists of guiding principles, leading practices and an assessment template to assess the implications of AI applications. The framework echoes the PCPD’s 2021 Ethical AI Guidance in its guiding moral principles. 

Although the Ethical AI Framework was originally developed for government bodies, its guiding principles, practices and assessment template are also applicable to private organizations for their general reference when carrying out AI and big data-related IT projects.

Update to the copyright regime

Given the copyright issues arising from the technological development of AI, especially generative AI, Hong Kong is seeking to update its copyright regime to keep pace with these advancements. After a two-month public consultation conducted by the Hong Kong government from July to September 2024, the Legislative Council (LegCo) issued a briefing paper in February 2025 summarizing the consultation responses. These responses addressed issues such as copyright protection and copyright infringement liability for AI-generated works. 

Under the Copyright Ordinance (Cap.528) (CO), copyright protection is already granted to works generated by generative AI. However, revisions to the CO are being proposed to introduce copyright infringement exceptions for computational data analysis and processing. These exceptions cover conventional text and data mining and the training of AI models, aiming to foster the growth of the AI industry. 

While the proposed revisions to the CO are now under discussion by the LegCo panel on Commerce, Industry, Innovation and Technology, the exact timeline of this legislative update remains unclear. 

Sectoral guidelines, i.e., banking & finance and healthcare

Different sector regulators have released sector-specific AI guidelines. The Hong Kong Monetary Authority (HKMA) and the Securities and Futures Commission (SFC) are leading the way. 

Notably, the HKMA released circulars on 19 August 2024 and 9 September 2024 to provide guidance to the banking industry on the use of AI, focusing on consumer protection and monitoring suspicious financial activities. For consumer protection, the HKMA referred to the set of guiding principles published on 5 November 2019, emphasizing four major areas: governance and accountability, fairness, transparency and disclosure, and data privacy and protection. The HKMA expressed that, whilst still at an early stage in the banking sector, generative AI may potentially have a wider application in customer-facing activities. Therefore, the HKMA has introduced additional principles to ensure appropriate safeguards for consumer protection.

In the context of anti-money laundering and counter-terrorist financing, the HKMA acknowledged that AI is invaluable in identifying and monitoring suspicious activities related to money laundering and terrorist financing, as it gradually replaces the traditional monitoring systems. AI enables organizations to monitor suspicious activities and allocate resources more efficiently. The HKMA has pledged to lend further support to develop AI in monitoring suspicious financial activities.

On 19 December 2024, in collaboration with Cyberport, the HKMA announced plans for the inaugural cohort of the Generative AI Sandbox. This initiative aims to provide a risk-controlled environment for the financial sector to develop innovative AI solutions and further advance the use of AI technology in the finance industry. Selected participants, including banks and technology partners, had use cases involving enhanced risk management, anti-fraud measures and customer experience. On 28 April 2025, the HKMA launched the second cohort of the Sandbox initiative with a key addition of the GenA.I. Sandbox Collaboratory, a platform that fosters engagements between participants.  

The SFC issued a circular on 12 November 2024 to licensed corporations providing guidance on offering services or functionality supported by generative AI language models. The circular outlines requirements relating to the usage of AI in financial products or services, grouped under four core principles: senior management responsibilities, AI model risk management, cybersecurity and data risk management, and third party provider risk management. Licensed corporations are expected to implement these requirements in a risk-based manner. The SFC encourages and supports the responsible use of AI and AI language models by licensed corporations to innovate, deliver products or services more effectively or enhance their operational efficiency. 

We also see the healthcare sector in Hong Kong tapping into AI technology. It has been reported that the Hong Kong Hospital Authority aims to incorporate AI into clinical management systems to identify and treat high-risk patients at an earlier stage and personalize treatment for more than 10 million patients. Following a risk-based classification principle, the Department of Health has issued a technical reference document TR-008 for Artificial Intelligence Medical Devices (AI-MDs). This document sets out the technical requirements for AI-MDs to be listed under the Medical Device Administrative Control System, signifying acceptance for wider usage of medical devices adopting AI and machine learning in Hong Kong.