When China commercial cryptography testing or certification is voluntary or mandatory, and what product, service, body, and scope evidence to keep.
Identify the legal trigger before relying on a certificate. General are voluntary; mandatory routes apply to specified network products and related services, and has additional rules.
Use this guide to distinguish voluntary commercial cryptography from mandatory product, service, and routes, then verify that the assurance evidence covers the actual item.
Cryptography Law Article 25 and Commercial Cryptography Administration Regulation Article 12 encourage voluntary . Testing and certification bodies must hold the relevant qualifications and act within their approved scope.
Article 26 creates the narrower mandatory route, together with Regulation Articles 20-21, for a commercial cryptography product legally included in the catalogue of and for a commercial cryptography service using products in that catalogue. Treat the Article 27 application assessment as a separate decision. Published commercial cryptography product certification catalogues support the national certification system, but a listing in one of them is not, by itself, the Article 26 mandatory catalogue test.
Representative commercial cryptography product types in official testing materials include smart cryptographic tokens and IC cards, IPSec and SSL VPN gateways, cryptographic cards and server cryptographic machines, signing and verification servers, time-stamp servers, dynamic-token systems, security chips, cloud server cryptographic machines, random-number generators, trusted cryptographic modules, and blockchain cryptographic modules. These examples show the range of products in the assurance system; they do not prove that a specific model falls within the mandatory network-product catalogue.
Sources (6)
Use for cryptography categories, commercial cryptography development and management, product/service controls, CII use, import/export context, penalties, and 1 January 2020 effective date.
Use for qualification and supervision of commercial-cryptography product-testing and application-security-assessment bodies, including report, data, sample, and information-reporting rules.
Articles 12-21 support voluntary assurance, testing and certification body qualifications, mandatory catalogue-product assurance, and mandatory service certification.
Use as a current example of the separate commercial cryptography product certification catalogue and its product descriptions and certification bases.
Lists representative commercial cryptography product types used in official assessment and testing knowledge materials; the list supports examples, not a mandatory-catalogue conclusion.
Articles 9 and 11-15 support the separate CII product, service, technology, and application-assessment requirements.
Do not describe a supplier certificate as proof of all Cryptography Law duties. It supports only the product, service, version, scope, status, and period stated in the assurance record.
The evidence workflow below is Sorena's operational synthesis. The cited rules establish the legal routes and body duties but do not prescribe this exact internal approval process.
Sources (4)
Use for cryptography categories, commercial cryptography development and management, product/service controls, CII use, import/export context, penalties, and 1 January 2020 effective date.
Use for qualification and supervision of commercial-cryptography product-testing and application-security-assessment bodies, including report, data, sample, and information-reporting rules.
Articles 3, 5, and 15-20 support testing-body qualification and approved scope, independence, authorized-signatory and seal checks, six-year record retention, sample controls, and annual reporting.
Articles 2 and 6-15 support the distinct system-level purpose, lifecycle, evidence, retention, and filing of application security assessment.
Keep the classification decision, both catalogue checks where relevant, legal route, body qualification, approved scope, report or certificate, covered model and version, status, validity, surveillance, limitations, exceptions, and reviewer approval.
Reopen the decision when the cryptographic module, algorithm, protocol, key-management mechanism, hardware or software version, product scope, supplier, certificate, catalogue, service architecture, operator, or use changes.
Sources (2)
Use for cryptography categories, commercial cryptography development and management, product/service controls, CII use, import/export context, penalties, and 1 January 2020 effective date.
Use for qualification and supervision of commercial-cryptography product-testing and application-security-assessment bodies, including report, data, sample, and information-reporting rules.
The current Cybersecurity Law separately requires qualified assurance for before sale or provision. The Cryptography Law applies that framework to qualifying commercial cryptography products and seeks to avoid duplicate .
commercial cryptography application assessment is also coordinated with CII security assessment and network-security graded-protection testing to avoid duplication, but each conclusion must still identify its own legal basis and scope.
Sources (4)
Use for cryptography categories, commercial cryptography development and management, product/service controls, CII use, import/export context, penalties, and 1 January 2020 effective date.
Use for qualification and supervision of commercial-cryptography product-testing and application-security-assessment bodies, including report, data, sample, and information-reporting rules.
Article 25 supports the current network critical equipment and network security-specific product assurance requirement.
Supports the amendment's 1 January 2026 effective date.
Sorena AI helps turn a commercial cryptography testing or certification decision into assigned owners, controls, and records for review.
Research Copilot connects the official citation, decision, owner, retained evidence, and change history.
Check the China Cryptography Law scope decision and unresolved launch questions with Sorena.
China commercial cryptography checklist covering classification, product and service assurance, CII duties, trade controls, and retained evidence.
Record the legal route, product or system scope, testing-body qualification, report details, gaps, and reassessment triggers for China commercial cryptography assurance.
China cryptography effective dates, CII reports, annual assessments, licence renewals, change notices, and pre-operation checks.
Screen commercial cryptography imports under the 2020 list, exports under China's unified dual-use list, the consumer exclusion, system assessment, and CII review.
Answers on China's commercial-cryptography scope, product assurance, classified protection, CII assessment, procurement review, and trade controls.
China commercial cryptography requirements by role: standards, testing, certification, CII use and assessment, trade controls, and evidence.
Compare China's Cryptography Law and current Cybersecurity Law by scope, actor, product assurance, CII duties, evidence, and enforcement.
China commercial cryptography penalties by actor and violation, including fine bands, corrective orders, confiscation, licence action, and liability.
Procurement checks for commercial cryptography products and services used in China, including certificate scope, CII duties, and supplier changes.
Not every encrypted product imported into China needs a licence. Check the 2020 commercial-cryptography import list, the consumer-product exception, and any CII procurement review.
Using encryption does not create one universal China approval duty. Check classified protection, product, service, CII, procurement, and trade triggers.
See how China's cryptography rules connect with classified protection, product assurance, CII assessment, and cybersecurity review without merging the regimes.
Commercial cryptography protects information that is not a state secret. Learn how China defines the category and which separate facts trigger product, CII, or trade controls.
Commercial-cryptography assurance is often voluntary, but specified products and services require it. Covered CII also needs application assessment and qualified cryptography.