A Watermark Is Not Enough: Inside the World's Most Prescriptive AI Labeling Regime
Western AI transparency law says "mark synthetic content in a machine-readable way" and leaves the engineering to you. China wrote down the format, mandated a national standard, and made the app stores check. It has been in force since September 2025.
What Was Actually Enacted
The instrument is the Measures for Labeling AI-Generated Synthetic Content, issued in March 2025 by the Cyberspace Administration of China together with three other agencies, effective September 1, 2025. It arrives alongside a mandatory national standard that specifies the technical detail the Measures leave abstract — where a visible mark goes, what fields the metadata carries, how audio is signaled.
It does not stand alone. It sits on top of two earlier regimes that already govern this space: the Deep Synthesis Provisions, which since 2023 have required marking of synthetically generated media, and the Interim Measures for Generative AI Services, which govern public-facing generative AI in China more broadly. The 2025 Measures are the layer that made labeling concrete and enforceable rather than aspirational.
The Two-Label Architecture
This is the structural idea worth understanding even if you never ship in China, because it is the direction provenance regulation is heading everywhere. One label is for humans. One label is for machines. Neither substitutes for the other.
- •Visible text or watermark on generated images and video
- •Spoken or tonal cue at the start of generated audio
- •Prominent notice around or within generated text
- •Marking on generated virtual scenes and environments
- •Must be perceivable without special tools
- •Provenance written into the file's metadata
- •Records that content is AI-generated or synthesized
- •Carries provider identification
- •Carries a content identifier for traceability
- •Survives normal handling; stripping it is prohibited
The engineering implication is the part US teams underestimate. A visible watermark is a rendering change. Persistent metadata provenance is a pipeline change — it has to be written at generation time, preserved through your storage and transcoding layers, and survive the resize, re-encode, and CDN transforms that silently strip metadata in most media stacks today. Teams that check "we added a watermark" and move on have completed the easy half.
Enforcement Runs Through Distribution
The design choice that makes this regime effective is that regulators did not rely on chasing generators. They put duties on the chokepoints.
Generation Service Providers
Must apply both labels at the point of creation, disclose the labeling behavior in user-facing terms, and retain logs. This is the obligation everyone expects.
Distribution Platforms
Must check uploaded content for labels and metadata, mark content as AI-generated or suspected AI-generated where warranted, and act where labeling is missing or falsified. A platform cannot passively host unlabeled synthetic media and claim it is the uploader's problem.
App Stores
Must verify, as part of distribution review, that apps offering AI generation implement the required labeling. This is the mechanism that reaches foreign developers who never read the Measures — the requirement shows up as a submission checklist item.
Users and Tool Makers
Users are prohibited from maliciously deleting, altering, forging, or hiding labels. Providing tools or services designed to strip provenance is separately prohibited — the anti-circumvention layer that keeps a labeling regime from being trivially defeated.
How This Reaches an American Company That Doesn't Operate in China
The Measures govern services offered to users in mainland China. If you have geofenced China, you are largely outside their direct scope. Three indirect paths still reach you.
- App distribution. If your mobile app with AI generation features is distributed in Chinese app stores, labeling verification is part of getting listed and staying listed.
- Enterprise customers. A Chinese platform or media company that buys your generation API inherits labeling duties, and pushes them to you contractually. You end up implementing metadata provenance because your customer's compliance team requires it.
- Content flowing in. Your outputs may be uploaded to Chinese platforms by users you do not control. Content lacking provenance gets flagged, restricted, or labeled "suspected AI-generated" — a distribution outcome, not a legal penalty, but one your users will blame on you.
Why This Matters Even If You Never Ship to China
Provenance requirements are converging. The EU AI Act requires machine-readable marking of synthetic content and disclosure for deepfakes. California's AI Transparency Act pushes provenance disclosure and detection tooling. Platform policies at the major social networks increasingly demand or reward signed provenance metadata. Industry provenance standards are being adopted by camera makers, editing tools, and model providers.
These regimes differ in scope and enforcement, but they converge on the same engineering requirement: your generation pipeline must attach durable, machine-readable provenance, and your media pipeline must not destroy it. A team that builds that once satisfies a growing list of jurisdictions. A team that ships a visible watermark to close one requirement will rebuild for the next one.
The Provenance Readiness Checklist
- ☐Provenance metadata is written at generation time, not bolted on later
- ☐Metadata survives your resize, transcode, and thumbnail pipeline
- ☐Your CDN and image optimizer do not strip metadata by default
- ☐Visible marking is applied to image, video, and audio outputs
- ☐Audio outputs carry a perceivable cue, not just a metadata field
- ☐Your terms disclose that outputs are labeled and that stripping labels is prohibited
- ☐You can produce, on request, a record of what your service generated and when
Frequently Asked Questions
Does this apply to AI-generated text, or only images and video?
Text is included. The Measures cover AI-generated or synthesized text, images, audio, video, and virtual scenes. Text is the awkward case operationally, because a plain string carries no metadata container — which is why the explicit-label side (a visible notice presented with the content) does more work for text than the implicit side does.
Our CDN strips EXIF on every image. Does that break compliance?
It breaks the implicit label, yes — and this is the single most common way a technically compliant generator produces non-compliant delivered output. Image optimizers and CDNs strip metadata by default as a size optimization. If provenance matters to you for any jurisdiction, that default has to be changed and then tested end to end on the actual delivered asset, not the file your generator wrote.
Are there penalties for a foreign company that ignores this?
Direct enforcement against a company with no China presence is not the realistic mechanism. The realistic consequences are distribution ones: app store rejection or removal, platform-level restriction or labeling of your outputs, and losing Chinese enterprise deals whose compliance review you cannot pass. Those land without any regulator ever contacting you.
Is a visible watermark alone enough anywhere?
It is not enough under China's Measures, which require both label types. It is also increasingly insufficient elsewhere, because visible watermarks are trivially cropped and the regulatory trend favors machine-readable provenance that survives editing. Treat visible marking as the user-facing courtesy and metadata provenance as the compliance artifact.
How does this interact with China's other AI rules?
It layers on top of them. The Deep Synthesis Provisions and the Interim Measures for Generative AI Services already imposed marking, security assessment, and content obligations on services operating in China. The 2025 Labeling Measures did not replace those — they specified the labeling piece in enough detail to be audited and enforced.
Build the Pipeline Once
The interesting thing about China's labeling regime is not the jurisdiction — it is that someone finally wrote down what "mark your synthetic content" means in enough detail to implement and to audit. Everyone else's rules are heading to the same place with less specificity.
If your product generates media, the durable move is to make provenance a property of your generation and delivery pipeline rather than a compliance feature you add per market. Then each new labeling law is a configuration question instead of a re-architecture.
This article is general information about a fast-moving regulatory area, not legal advice. Chinese implementing standards and platform requirements are updated frequently — confirm current technical specifications with qualified counsel before relying on them.