We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

CryptographyChina

China Cryptography Law Compliance deadlines and calendar

Effective dates, annual duties, renewal windows, change notices, and event-driven checks under China's cryptography rules.

There is no single annual filing for every organization. Deadlines depend on the actor and activity: , testing, electronic certification, or a product, service, import, or export.

Back to main artifactReview sources
Author
Sorena AI
Published
Jul 5, 2026
Updated
Oct 15, 2026
5 sections9 primary sources
Overview

This calendar separates historical legal milestones from recurring duties, transaction triggers, and system-lifecycle gates. Start with the actor and activity within China; the rules do not impose one cryptography filing calendar on every organization that uses encryption.

Section 1

Which dates apply to your organization?

Identify the activity first. The Cryptography Law defines cryptography as technologies, products, and services that use specified transformations to encrypt information or provide security authentication. It separates core and ordinary cryptography, which protect state-secret information, from , which protects information that is not a state secret.

Additional dates apply if the organization is a recognized , an operator of legally identified (CII), or a licensed . Product, service, import, and export controls are usually triggered by a planned transaction or release rather than a common annual date.

  • General commercial user: screen products, services, systems, and cross-border movements when they are introduced or materially changed; the sources do not set one annual filing for all users.
  • CII operator: report the previous year's use and assessments by 31 January; assess the cryptography application plan, assess again before operation, repeat at least annually after operation, and reassess a plan changed during construction.
  • : track the 15 January annual report, certificate expiry, the three-month renewal lead time, 30-day change filings, annual training, and six-year record retention.
  • : track the five-year licence, the 60-day renewal lead time, 30-day change filings, an assessment at least annually, and annual staff training.
  • Importer or exporter: screen each proposed transaction against the current import-licence and export-control lists; mass-market consumer products are excluded from those controls under Cryptography Law Article 28.
Section 3

Recurring and event-driven deadlines

The fixed and relative deadlines below apply only to the named actor. Convert each relative period into an internal calendar date from the certificate expiry, change date, system stage, or reporting year that starts the clock.

The electronic certification rules concern providers that use to provide electronic certification services in China. Separate rules apply to electronic-government certification services.

  • By 15 January each year: a recognized reports its previous year's work and statistics through the provincial-level cryptography authority.
  • By 31 January each year: a CII operator reports the previous year's use and activity to its .
  • At least once each year: a CII operator completes a after the infrastructure begins operating. Assessment is also required for the application plan, before operation, and again if that plan changes during construction.
  • By 31 March each year: each CII reports the previous year's sector-level CII management to the national cryptography, cybersecurity, and public-security authorities. This is the protection department's deadline, not a universal operator filing date.
  • At least once each year: a licensed conducts a cryptography-compliance assessment, corrects identified problems, and submits the report to the provincial-level cryptography authority where it is domiciled.
  • Three months before expiry: a seeking renewal applies in writing to the National Cryptography Administration. Its qualification certificate is valid for five years.
  • 60 days before expiry: an seeking renewal applies in writing to the National Cryptography Administration. Its licence is valid for five years.
  • Within 30 days after a listed change: a testing body applies to change its record after changes to its name, registered address, legal-person form, named senior or technical roles, authorized signatories, or approved business scope.
  • Within 30 days after a listed change: an electronic-certification licensee completes the change procedure after changes to its name, domicile, legal representative, or relevant equipment or facilities, or after building or relocating its electronic-certification system.
  • Within 30 days after an assessment report is formed: an operator of an important network or information system subject to submits the report and related work information for filing with the national or relevant provincial-level cryptography authority.
  • Every year: testing-body professionals complete at least 40 training hours; relevant electronic-certification technical and security staff complete at least 20 training hours.
  • For at least six years: testing bodies retain original testing records and testing reports.
  • For at least six years: operators that perform their own application security assessments retain their original assessment records and assessment reports under Article 13 of the Management Measures. This operator duty is separate from testing-body record retention.
Section 4

Authority decision periods are not filing deadlines

Some rules give an authority a period to decide an accepted application. These periods help with launch planning but do not extend the applicant's renewal or transaction deadline. Identify the import or export route before calculating the decision period; excluded review work and escalated approvals can extend the expected completion date.

  • Testing-body qualification: the National Cryptography Administration ordinarily has 20 working days after accepting the application to review it and issue a written decision. Time needed for technical review is excluded, and the applicant must be told that time in writing.
  • Electronic-certification licence intake: the delegated provincial-level cryptography authority has five working days after receiving the application materials to accept a complete, properly formatted application, issue a one-time request for all required corrections, or issue a reasoned non-acceptance notice. This formality check precedes the national authority's decision period.
  • Electronic-certification cryptography licence: the National Cryptography Administration ordinarily has 20 working days after accepting the application to decide it. Time needed for technical review is excluded, and the applicant must be told that time in writing.
  • import licence: Regulation Article 34 ordinarily gives the competent commerce authority 45 working days after acceptance to decide with the National Cryptography Administration.
  • Dual-use export licence: Article 17 ordinarily allows 45 working days after acceptance. Classification, expert consultation, and on-site checks are excluded; State Council or State Council and Central Military Commission approval cases are outside that limit.
Section 5

What to calendar and retain

Record the legal trigger beside each date. An internal target is not a statutory deadline unless a law, regulation, licence, certificate, authority notice, or binding decision creates it.

A launch may also trigger cybersecurity, data, personal-information, or sector rules. Reuse verified facts such as the operator, system, product version, data flow, supplier, and release date, but document each legal conclusion separately.

  • Instrument, article, actor, and activity that create the date.
  • Certificate or licence number, scope, issue date, expiry date, and renewal submission date.
  • CII status, application plan, assessment report, remediation, 31 January operator report, filing or submission evidence, and next annual assessment date.
  • Testing-body annual report, staff training records, change filings, original testing records, and testing reports.
  • Electronic-certification annual assessment, remediation, report submission, training records, change filings, and any technical-review notice that affects the expected decision date.
  • Product or service model and version, required test or certification status, supplier evidence, and release approval.
  • Import or export classification, current control-list check, licence application and acceptance dates, any State Council referral, licence decision if required, and transaction date.
  • Self-assessing network or information-system operator: original assessment records and reports retained for at least six years, plus assessment filing evidence.
Plan the filing

Prepare the commercial cryptography evidence file

Sorena AI helps map each China cryptography deadline to its legal trigger, owner, evidence, and next review date.

Research workflow
Map official sources to evidence

Research Copilot connects the official citation, decision, owner, retained evidence, and change history.

Explore next step
Talk to Sorena
Review the China route

Check the China Cryptography Law scope decision and unresolved launch questions with Sorena.

Explore next step
Primary sources

References and citations

Commercial Cryptography Testing Body Management Measures, Order No. 2
oscca.gov.cn5 citations
Referenced sections
  • Current testing-body qualification, reporting, renewal, change, training, and retention rules.
  • Article 29 states that the measures took effect on 1 November 2023.
  • Articles 12, 13, 17, 19, and 20 establish the five-year certificate, three-month renewal lead time, 30-day change procedure, annual 40-hour training, six-year retention, and 15 January report.
Show 2 more
  • Article 8 establishes the 20-working-day testing-body decision period and excludes technical-review time.
  • Articles 12-20 identify testing-body certificate, change, training, report, and retention records.
Commercial Cryptography Administration Regulation, State Council Order No. 760
mee.gov.cn4 citations
Referenced sections
  • Current administrative regulation for commercial cryptography activities, testing, certification, CII assessments, network operators, and supervision.
  • Articles 2 and 12-42 set the current scope and the testing, certification, electronic certification, application-assessment, CII, and network-operator framework.
  • Article 34 supports the commercial cryptography import decision period. Current exports follow the separate dual-use regime.
Show 1 more
  • Articles 13-21 and 38-42 identify the qualification, certification, CII assessment, and network-security records that determine the applicable route.
Electronic Certification Service Cryptography Use Management Measures, Order No. 6
oscca.gov.cn4 citations
Referenced sections
  • Current electronic-certification licence, renewal, change, annual assessment, training, and enforcement rules from 1 July 2026.
  • Article 25 states the 1 July 2026 effective date and repeal of the earlier measures.
  • Articles 10-12, 16, and 17 establish the five-year licence, 30-day change procedure, 60-day renewal lead time, annual assessment, and annual 20-hour training.
Show 1 more
  • Articles 7-8 establish the five-working-day formality review, the 20-working-day electronic-certification licence decision period, and the exclusion of technical-review time.
CII Commercial Cryptography Use Management Provisions, Order No. 5
oscca.gov.cn3 citations
Referenced sections
  • Current CII planning, construction, pre-operation, annual assessment, reporting, and enforcement rules.
  • Article 25 states that the provisions took effect on 1 August 2025.
  • Articles 4, 5, and 11-14 establish the 31 January operator report, 31 March protection-department report, and the plan-stage, construction-change, pre-operation, and at-least-annual CII assessment duties.
PRC Cryptography Law
oscca.gov.cn3 citations
Referenced sections
  • Primary law for cryptography categories, commercial cryptography duties, CII use, testing and certification, import/export controls, and the 1 January 2020 effective date.
  • Articles 2, 6, 8, and 24-28 define the categories and establish the commercial cryptography, CII, testing, certification, and import/export routes.
  • The adoption statement and Article 44 support the 26 October 2019 adoption and 1 January 2020 effective dates.
Commercial Cryptography Application Security Assessment Management Measures, Order No. 3
oscca.gov.cn2 citations
Referenced sections
  • Assessment process, evidence retention, and the 30-day assessment-report filing period for important networks and information systems.
  • Article 13 sets self-assessment requirements and requires original assessment records and reports to be retained for at least six years. Article 14 requires an operator of an important network or information system to submit an assessment report and related work information within 30 days after the report is formed.

Related guides

China commercial cryptography compliance checklist

China commercial cryptography checklist covering classification, product and service assurance, CII duties, trade controls, and retained evidence.

China commercial cryptography testing evidence template

Record the legal route, product or system scope, testing-body qualification, report details, gaps, and reassessment triggers for China commercial cryptography assurance.

China cryptography import, export, and security review triage

Screen commercial cryptography imports under the 2020 list, exports under China's unified dual-use list, the consumer exclusion, system assessment, and CII review.

China Cryptography Law FAQ

Answers on China's commercial-cryptography scope, product assurance, classified protection, CII assessment, procurement review, and trade controls.

China Cryptography Law requirements

China commercial cryptography requirements by role: standards, testing, certification, CII use and assessment, trade controls, and evidence.

China Cryptography Law vs Cybersecurity Law

Compare China's Cryptography Law and current Cybersecurity Law by scope, actor, product assurance, CII duties, evidence, and enforcement.

Show all related guides (14)

China cryptography penalties, fines, and liability

China commercial cryptography penalties by actor and violation, including fine bands, corrective orders, confiscation, licence action, and liability.

Commercial cryptography procurement checklist

Procurement checks for commercial cryptography products and services used in China, including certificate scope, CII duties, and supplier changes.

Commercial cryptography products and testing evidence

When China commercial cryptography testing or certification is voluntary or mandatory, and what product, service, body, and scope evidence to keep.

Do imported cryptography products need special review?

Not every encrypted product imported into China needs a licence. Check the 2020 commercial-cryptography import list, the consumer-product exception, and any CII procurement review.

Does using encryption trigger China Cryptography Law duties?

Using encryption does not create one universal China approval duty. Check classified protection, product, service, CII, procurement, and trade triggers.

How does cryptography compliance overlap with China cybersecurity law?

See how China's cryptography rules connect with classified protection, product assurance, CII assessment, and cybersecurity review without merging the regimes.

What is commercial cryptography in China?

Commercial cryptography protects information that is not a state secret. Learn how China defines the category and which separate facts trigger product, CII, or trade controls.

When is commercial cryptography testing or certification needed?

Commercial-cryptography assurance is often voluntary, but specified products and services require it. Covered CII also needs application assessment and qualified cryptography.