Cryptography
China cryptography law: classify products and services, then check assurance, system assessment, electronic certification and trade duties.
Classify cryptography under China law, then check product and service assurance, system assessment, critical-infrastructure, electronic-certification, and trade requirements.
The Cryptography Law has applied since 1 January 2020. It separates , which protect state secrets, from , which protects information that is not a state secret. The revised Commercial Cryptography Administration Regulation has applied since 1 July 2023. rules have applied since 1 August 2025, and the current electronic-certification licensing rules since 1 July 2026. Encryption alone does not trigger one approval: the product catalogue, service design, system classification, operator status, transaction, and intended use determine which route applies.
Identify what information is protected and whether the item is a technology, product, service, procurement, or critical-infrastructure deployment.
Check the mandatory network-product route, related service certification, graded-protection requirements for the network's confirmed protection level, application security assessment for systems that national rules require to use , critical-infrastructure product and technology rules, procurement review, electronic-certification licensing, and import/export lists separately.
Retain the facts and source behind the conclusion. Reopen it when the product, supplier, use case, infrastructure status, or shipment changes.
Record what the technology, product, or service protects and how it is supplied. protect state secrets; protects non-state-secret information.
Testing and certification are generally voluntary. Mandatory assurance applies to products included in the catalogue of , services using those products, and qualifying critical-infrastructure uses. Network operators must also check the cryptography requirements tied to the network-security graded-protection system. System assessment, trade licensing, procurement review, and licensing for have separate triggers.
Keep the exact product or service, model and version, cryptographic function, intended use, operator, supplier evidence, applicable catalogue or control-list entry, test or certificate scope, decision, and reassessment triggers.
The visual timeline separates adoption, publication, and effective dates. The law took effect on 1 January 2020; the revised Administration Regulation was published on 27 April 2023 and took effect on 1 July 2023.
New to the regime? Start with the legal categories and route map. If the item is already classified, jump to the applicable product, infrastructure, shipment, evidence, deadline, or enforcement guide.
Understand what the law calls cryptography, how differs from state-secret categories, and which facts determine the next route.
Test the distinct triggers for mandatory product or service assurance, , and controlled imports or exports.
Turn the selected route into supplier due diligence and a reviewable testing or certification record.
Separate historical effective dates from operational change triggers, and understand the penalties attached to particular breaches.
Keep cryptography decisions distinct from broader cybersecurity duties, or go directly to a concise answer for a specific scenario.
Next steps
Sorena AI turns China Cryptography Law official requirements into scoped decisions, evidence records, owner assignments, and change-trigger reviews.
Map classification, product/service route, testing, certification, import/export screening, and release records to official citations, owners, and review checkpoints.
Keep official citations, decisions, approvals, and evidence with the relevant product and compliance records.
Check unresolved product, service, critical-infrastructure, testing-body, import, or export triggers before release or procurement.