Answers on commercial-cryptography classification, product and service assurance, CII assessment, procurement review, and import or export controls.
Use the answers to identify the applicable route and the facts to retain. Product catalogues, import and export lists, classified-protection requirements, and CII conclusions still need a current, fact-specific check.
Structured answer sets in this page tree.
Cited legal and guidance references.
Classify first, then distinguish ordinary lawful use from the separate triggers for product or service assurance, electronic-certification permission, classified-protection requirements, assessment, procurement review, and import or export controls.
These focused FAQ modules break this artifact into narrower answer sets so teams can move straight to the right source-backed guidance.
Not every encrypted product imported into China needs a licence. Check the 2020 commercial-cryptography import list, the consumer-product exception, and any CII procurement review.
Using encryption does not create one universal China approval duty. Check classified protection, product, service, CII, procurement, and trade triggers.
See how China's cryptography rules connect with classified protection, product assurance, CII assessment, and cybersecurity review without merging the regimes.
Commercial cryptography protects information that is not a state secret. Learn how China defines the category and which separate facts trigger product, CII, or trade controls.
Commercial-cryptography assurance is often voluntary, but specified products and services require it. Covered CII also needs application assessment and qualified cryptography.
Start by identifying whether the technology, product, or service uses specific transformations for encryption protection or security authentication. Then determine whether it protects state-secret information or information that is not a state secret. is the category for the latter.
Commercial-cryptography status alone does not determine whether testing, certification, assessment, review, or a licence is mandatory. Articles 25-28 of the law set several routes, and the 2023 implementing regulation adds electronic-certification, classified-protection, and detailed application requirements.
The responsible actor changes by route. An ordinary user may lawfully choose ; a network operator must apply the classified-protection requirements for its network; a covered operator has additional application and procurement duties; and a supplier, electronic-certification service provider, importer, or exporter must check the rules for its own activity.
An FAQ answer cannot determine whether a specific product appears in a current catalogue or control list. Record the exact item, supplier, operator, use, source version and check date, conclusion, and unresolved questions.
Keep broader network-security and data-law conclusions separate even when they use the same technical facts. The implementing regulation links to classified protection, assessment, and procurement review, but it does not merge the legal regimes.
Each answer below states the controlling rule first. A specific product, system, operator, or shipment still needs a current catalogue, list, protection-level, or operator-status check.
protects information that is not a state secret through cryptographic technologies, products, or services used for encryption protection or security authentication. Core and ordinary cryptography protect state-secret information and are subject to a separate classified regime. The word commercial identifies the legal category; it does not mean that the protected information must be sold or used for profit.
No. Citizens, legal persons, and other organizations may lawfully use to protect network and information security. Testing and certification are generally encouraged voluntarily. A mandatory route needs an additional trigger, such as a catalogue-covered network product, a service using that product, a network or information system required by national rules to use commercial cryptography, a qualifying use or procurement, a listed import or export, or an electronic certification service that uses commercial cryptography.
A product must pass qualified testing and certification before sale or provision when it is legally included in the catalogue of . A commercial cryptography service must be certified when it uses equipment or products in that catalogue. A listing in a separate commercial cryptography product certification catalogue does not by itself establish the Article 26 trigger.
Yes, when a provider uses to provide electronic certification services in China. Since 1 July 2026, the provider must hold an Electronic Certification Service Cryptography Use Licence from the National Cryptography Administration. The licence is valid for five years, renewal requires an application 60 days before expiry, listed changes require a change procedure within 30 days, and the provider must conduct a cryptography-compliance assessment at least annually. Electronic-government electronic certification services follow a separate provider-qualification route.
The assessment is required for a network or information system that a law, administrative regulation, or national provision requires to use protection. The operator must assess the commercial cryptography application plan, must not operate a completed system that has failed the pre-operation assessment, and must assess the operating system at least annually. A covered operator may self-assess only when it has the equipment, governance, personnel, and professional capability required by the Assessment Measures; otherwise it must commission a qualified commercial cryptography testing body.
No. A network operator must apply the requirements associated with China's and its confirmed protection level. is a separately identified category with additional governance, product, technology, assessment, reporting, and procurement-review duties. A classified-protection level does not by itself prove that the network is CII.
No. The exclusion removes used in from the Cryptography Law's import-licensing and export-control system. It does not decide product certification, network use, application security assessment, procurement review, or other cybersecurity duties. Because the cited legislation does not provide a complete product test, document the actual model, retail availability, intended users, distribution restrictions, and whether its cryptographic function can readily be changed before relying on the exclusion.
Sorena AI helps assign owners, document controls, and retain the records behind each FAQ decision.
Research Copilot records the official citation, decision, owner, evidence, and change history.
Check the China Cryptography Law scope decision and unresolved launch questions with Sorena.