China checklist covering classification, product and service assurance, duties, trade controls, and retained evidence.
For product, security, legal, procurement, and trade teams: identify the protected information and exact item, test each legal trigger, resolve mandatory requirements, and keep the evidence behind the decision.
Use this checklist to classify a China use and decide which product, service, network-security graded-protection, , assessment, electronic-certification, or import/export route needs action before launch, procurement, or shipment.
Start with the Cryptography Law categories. Core and ordinary cryptography protect state-secret information; protects information that is not a state secret. Citizens, legal persons, and other organizations may lawfully use commercial cryptography, but particular products, services, systems, operators, and shipments can trigger additional duties.
The Cryptography Law sets the main routes in Articles 24-28. The 2023 Administration Regulation adds operational detail, and the -specific provisions effective 1 August 2025 apply only to infrastructure already identified as critical information infrastructure under the applicable rules.
Sources (5)
Use for cryptography categories, commercial cryptography development and management, product/service controls, CII use, import/export context, penalties, and 1 January 2020 effective date.
Use for qualification and supervision of commercial-cryptography product-testing and application-security-assessment bodies, including report, data, sample, and information-reporting rules.
Articles 11-21 support standards, voluntary testing and certification, qualified bodies, mandatory catalogue-product testing and certification, and service certification; Articles 31-42 support trade and CII checks.
Articles 2 and 5-15 support the CII applicability boundary, governance, staffing, funding, product and technology checks, application plans, lifecycle assessments, annual assessment, and the operator's 31 January reporting deadline.
Articles 2-3 and 10-17 support the electronic-certification licensing, five-year term, renewal, change, annual assessment, and annual training checks effective from 1 July 2026.
Complete the steps in order because later evidence depends on the classification and route decision. A certificate is useful only when its product or service, model, version, scope, issuer, and status match the item under review.
The owner assignments, approval gate, and reassessment triggers below are Sorena's operational synthesis. The cited rules establish the legal duties; they do not prescribe this internal workflow.
Sources (3)
Use for cryptography categories, commercial cryptography development and management, product/service controls, CII use, import/export context, penalties, and 1 January 2020 effective date.
Use for qualification and supervision of commercial-cryptography product-testing and application-security-assessment bodies, including report, data, sample, and information-reporting rules.
Articles 6-15 support application-plan assessment, pre-operation and annual assessment, assessment evidence, six-year retention for self-assessments, filing within 30 days, and incident-driven reassessment.
The evidence file should identify the exact item and use reviewed. A supplier statement that an item is 'China compliant' does not identify which legal route, version, or scope it covers.
For an important network and information system subject to application security assessment, keep the application plan, system and equipment inventory, network topology, management rules, configuration and operation records, assessment inputs, report, filing evidence, remediation, and approval. Where the operator self-assesses, the official measures require original records and reports to be retained for at least six years.
Sources (2)
Use for cryptography categories, commercial cryptography development and management, product/service controls, CII use, import/export context, penalties, and 1 January 2020 effective date.
Articles 10-15 identify assessment content, operator support records, self-assessment retention, filing, and incident response requirements.
The Cryptography Law route does not replace the current Cybersecurity Law route. The Cybersecurity Law separately covers network-security graded protection, network product and service duties, , protection, and .
The amended Cybersecurity Law has applied since 1 January 2026. Use its current article numbering when recording a cross-reference, and keep privacy, data-export, and app-governance conclusions in their own source-backed analyses.
Sources (3)
Use for cryptography categories, commercial cryptography development and management, product/service controls, CII use, import/export context, penalties, and 1 January 2020 effective date.
Use for the current text, including Article 23 graded protection, Article 25 network critical equipment and network security-specific products, and Articles 33-40 CII duties.
Supports the amendment's 1 January 2026 effective date.
Sorena AI helps assign owners, controls, and review records for each China commercial cryptography decision.
Research Copilot connects the official citation, decision, owner, retained evidence, and change history.
Check the China Cryptography Law scope decision and unresolved launch questions with Sorena.
Record the legal route, product or system scope, testing-body qualification, report details, gaps, and reassessment triggers for China commercial cryptography assurance.
China cryptography effective dates, CII reports, annual assessments, licence renewals, change notices, and pre-operation checks.
Screen commercial cryptography imports under the 2020 list, exports under China's unified dual-use list, the consumer exclusion, system assessment, and CII review.
Answers on China's commercial-cryptography scope, product assurance, classified protection, CII assessment, procurement review, and trade controls.
China commercial cryptography requirements by role: standards, testing, certification, CII use and assessment, trade controls, and evidence.
Compare China's Cryptography Law and current Cybersecurity Law by scope, actor, product assurance, CII duties, evidence, and enforcement.
China commercial cryptography penalties by actor and violation, including fine bands, corrective orders, confiscation, licence action, and liability.
Procurement checks for commercial cryptography products and services used in China, including certificate scope, CII duties, and supplier changes.
When China commercial cryptography testing or certification is voluntary or mandatory, and what product, service, body, and scope evidence to keep.
Not every encrypted product imported into China needs a licence. Check the 2020 commercial-cryptography import list, the consumer-product exception, and any CII procurement review.
Using encryption does not create one universal China approval duty. Check classified protection, product, service, CII, procurement, and trade triggers.
See how China's cryptography rules connect with classified protection, product assurance, CII assessment, and cybersecurity review without merging the regimes.
Commercial cryptography protects information that is not a state secret. Learn how China defines the category and which separate facts trigger product, CII, or trade controls.
Commercial-cryptography assurance is often voluntary, but specified products and services require it. Covered CII also needs application assessment and qualified cryptography.