Search every question across sub-FAQs

Article 28 of the Cryptography Law and Articles 31-34 of the implementing regulation establish list-based import licensing. The operative import reference is the Commercial Cryptography Import Licence List issued with Announcement No. 63 of 2020. Listed items and technologies require an import licence from the Ministry of Commerce.

The import list has four product classes: encrypted fixed or mobile telephones; encrypted fax machines; cryptographic machines, including cryptographic cards; and equipment whose main function is IPSec or SSL VPN. The telephone and fax entries apply when the item provides encrypted data transmission and contains a symmetric algorithm with a key of at least 64 bits, an integer-factorisation asymmetric algorithm with a key of at least 768 bits, or an elliptic-curve asymmetric algorithm with a key of at least 128 bits. A cryptographic machine or card must meet one of those key-length conditions and reach at least 10 Gbps for symmetric encryption or decryption. An IPSec or SSL VPN device must meet one of the key-length conditions and reach at least 10 Gbps encrypted communication speed. These are list criteria, not examples that automatically capture every phone, fax machine, cryptographic module, or VPN product.

Match the product's technical characteristics and the imported technology to the list criteria. A listed commercial-cryptography import is handled through the dual-use item and technology import-licence process. The Ministry's current guidance directs businesses that cannot decide from the list to request a dual-use import-business consultation and identification.

For a listed import, the applicant submits the application, identity documents for the legal representative, principal business managers, and person handling the application, the contract or agreement, a technical description, final-user and final-use evidence, and any other material required by the Ministry of Commerce. The implementing regulation gives the Ministry an ordinary decision period of 45 working days after it accepts the application. The importer must obtain the licence before import and present it to Customs.

The implementing regulation also applies the licence rule to transit, transshipment, through shipment, re-export, and specified movements between overseas locations and comprehensive bonded zones, export-supervision warehouses, or bonded logistics centres. Do not assume that a movement avoids screening because it is not an ordinary domestic import.

Article 28 and Article 31 of the implementing regulation exclude commercial cryptography used in mass-market consumer products from this import-licence and export-control system. The cited provisions do not define a complete category test, so retain the facts and legal basis for applying the exception.

Import licensing and CII procurement review are separate. Under Article 40 of the implementing regulation and the Cybersecurity Review Measures, a CII operator must apply for review when a network-product or service procurement involving commercial cryptography affects or may affect national security.

Import and export lists are no longer symmetrical. The 2020 commercial-cryptography import list remains the import reference. From 1 December 2024, the unified PRC Dual-Use Items Export Control List replaced the commercial-cryptography export list and export procedure attached to Announcement No. 63 of 2020. Exporters must also consider controls outside the unified list when the catch-all conditions in the Export Control Law apply.

The record should show why the exact item and technology do or do not match the 2020 commercial-cryptography import list, why the mass-market consumer-product exception does or does not apply, and whether a CII procurement affects or may affect national security. If the same item will be exported, keep that conclusion separate because the unified dual-use export-control list now governs export screening.

Article 8 permits citizens, legal persons, and other organisations to use commercial cryptography to protect network and information security when the protected information is not a state secret. Official State Cryptography Administration guidance confirms that the law imposes no compulsory use requirement on ordinary users. The law does not require prior approval for every use of encryption.

A password shown in a login screen is not, by itself, cryptography under the official explanation: it is an access credential. Check the mechanism behind it. Specific transformations used to encrypt stored credentials, authenticate a user or message, or protect transmitted information can still be cryptography even when the interface calls the input a password.

The Cryptography Law has applied since 1 January 2020, and the revised Commercial Cryptography Administration Regulation has applied since 1 July 2023. If the protected information is a state secret, stop this commercial-cryptography analysis: core or ordinary cryptography and the applicable state-secrets controls govern that branch instead.

Mandatory duties depend on more specific facts. The Cryptography Law addresses specified products and services, qualifying critical information infrastructure (CII) uses and procurements, and listed imports or exports. The 2023 implementing regulation also covers electronic certification and requires network operators to use commercial cryptography according to the network-security classified-protection system. The electronic-certification measures effective 1 July 2026 require the provider to hold the named cryptography-use licence.

Voluntary testing or certification does not remove the standards duty. Any commercial-cryptography activity must still comply with applicable laws, administrative regulations, mandatory national standards, and the operator's publicly declared standards.

Start with the function and protected information, not the presence of a familiar algorithm or library. Article 2 covers both encryption protection and security authentication, and it applies to technologies, products, and services.

The result can change when the product model, service design, supplier, network protection level, operator, deployment, catalogue entry, or control list changes. Reopen the analysis when one of those facts changes.

The record should show why the function is or is not commercial cryptography and the result of each relevant standards, product, service, electronic-certification, network-level, CII, procurement-review, import, and export check.

First, Article 41 of the Commercial Cryptography Administration Regulation, in force since 1 July 2023, requires network operators to use commercial cryptography according to the network-security classified-protection system. The state cryptography administration sets use, management, and application-assessment requirements by protection level. The rule applies to network operators beyond CII.

The Cybersecurity Law's classified-protection duties are broader than encryption. Article 23 also requires governance, technical protections, monitoring, at least six months of network logs, data classification, and important-data backup. Commercial cryptography can support those duties but does not replace them.

Second, Article 26 of the Cryptography Law and Article 20 of the implementing regulation require covered commercial-cryptography products to pass testing and certification before sale or provision. The product must both be commercial cryptography and fall within the current catalogue of critical network equipment and specialised cybersecurity products; an encryption feature or a listing in the separate voluntary commercial-cryptography certification catalogue does not establish the mandatory route by itself. The Cybersecurity Law separately requires listed products to pass qualified testing or certification and calls for mutual recognition to avoid duplication.

The current network-product catalogue, effective since 3 July 2023, includes routers with at least 12 Tbps bidirectional system throughput and 550,000 routing-table entries, switches with at least 30 Tbps bidirectional throughput and 10 Gpps forwarding, rack servers meeting stated CPU and memory thresholds, and PLC equipment meeting the stated instruction-time threshold. It also lists product categories such as firewalls, intrusion-detection systems, VPN products, public-key infrastructure, file-encryption products, and identity-authentication products. These are catalogue examples, not a conclusion that every listed product uses commercial cryptography or falls under Cryptography Law Article 26.

Third, qualifying CII operators must conduct a commercial-cryptography application security assessment. The CII Commercial Cryptography Use Management Provisions have applied since 1 August 2025 and require assessment of the application plan, reassessment if that plan changes during construction, a passing assessment before operation, and assessment at least annually after operation. CII already under construction on that date follows the construction and pre-operation rules; CII already operating follows the annual-assessment rule. The Cybersecurity Law, in its current form since 1 January 2026, separately requires a CII operator to assess its network security and possible risks at least annually. The cryptography rules require coordination among the cryptography assessment, CII security testing, and classified-protection assessment, but each legal conclusion remains distinct.

Fourth, a CII operator procuring a network product or service involving commercial cryptography must complete a national-security review when the procurement affects or may affect national security. The operator performs the initial risk assessment and applies to the Cybersecurity Review Office when that condition is met; commercial cryptography, CII status, or a large purchase alone does not establish the condition.

Reuse the same technical facts while recording separate legal conclusions. A product may raise an Article 26 catalogue question without being procured by a CII operator. A CII deployment may require an Article 27 application assessment even when the procurement does not meet the national-security-review condition.

For each route, record the legal trigger, responsible operator or supplier, competent process, supporting evidence, and the legal basis for recognising an earlier test or assessment. A direction to avoid duplication does not automatically make one report a substitute for another. The Cryptography Law cross-references also do not establish compliance with unrelated cybersecurity, data, personal-information, or sector-specific duties.

Reopen the decisions when the product model or cryptographic function changes, the catalogue or standards change, the network's classified-protection level changes, infrastructure is identified as CII, the commercial-cryptography application plan changes during construction, the supplier or procurement scope changes, or a new national-security risk appears. An annual assessment date does not postpone a reassessment expressly triggered during construction or by a major cryptography incident or security hazard.

Maintain separate records for the Article 26 product or service route, the CII commercial-cryptography lifecycle assessment, the graded-protection conclusion, the annual CII network-security assessment, and any procurement cybersecurity review. Link shared technical facts without merging the legal results.

Article 2 defines cryptography broadly as technologies, products, and services that use specific transformations to encrypt information or provide security authentication. The category can therefore cover a cryptographic authentication function even when confidentiality is not the main purpose. Articles 6-8 then divide cryptography into core, ordinary, and commercial categories.

Core and ordinary cryptography protect state-secret information and are subject to strict unified management. Commercial cryptography protects information that is not a state secret, and citizens, legal persons, and other organisations may lawfully use it to protect network and information security.

The word commercial describes the statutory non-state-secret category; it does not mean that only businesses use it or that every product sold commercially follows a mandatory approval route. The law also requires authorities to treat foreign-invested enterprises lawfully and equally in commercial-cryptography research, production, sale, service, and import or export activities.

The Cryptography Law took effect on 1 January 2020. The revised Commercial Cryptography Administration Regulation took effect on 1 July 2023 and applies within China to commercial-cryptography research, production, sale, service, testing, certification, import, export, application, and supervision. Its definition confirms that commercial cryptography includes technologies, products, and services used for encryption protection or security authentication of non-state-secret information.

Commercial-cryptography status alone does not trigger universal approval. Article 24 of the law and Article 11 of the implementing regulation require commercial-cryptography activities to comply with applicable laws, administrative regulations, mandatory national standards, and publicly declared standards. More specific facts determine the remaining duties.

Record the protected information, cryptographic function, product or service, supplier, operator, and China use case. Check each possible route separately because a commercial-cryptography product may fall outside some mandatory routes.

The record should identify the protected information, explain why it is or is not a state secret, describe the encryption-protection or security-authentication function, and keep the commercial-cryptography classification separate from every downstream approval, assurance, assessment, and trade-control decision.

Article 25 of the Cryptography Law and Article 12 of the implementing regulation encourage voluntary commercial-cryptography testing and certification. Voluntary assurance does not waive Article 11: the activity must still comply with applicable laws, administrative regulations, mandatory national standards, and the operator's publicly declared standards. Testing and certification bodies must hold the required qualifications and work within their approved scope under the applicable technical specifications and rules.

Mandatory assurance applies to a narrower group. A commercial-cryptography product involving national security, the national economy and people's livelihoods, or the public interest must be included in the catalogue of critical network equipment and specialised cybersecurity products and pass qualified testing and certification before sale or provision. Both conditions matter: a cryptographic product outside that catalogue, or a listed network product that is not commercial cryptography, does not enter this mandatory route on those facts alone. A commercial-cryptography service that uses critical network equipment and specialised cybersecurity products must pass service certification.

The current network-product catalogue, effective since 3 July 2023, includes routers, switches, rack servers, and PLC equipment that meet stated technical thresholds, plus categories such as firewalls, intrusion-detection systems, VPN products, public-key infrastructure, file-encryption products, and identity-authentication products. Match the exact product and threshold. Do not substitute the separate commercial-cryptography product certification catalogue, which supports the national voluntary certification system, for the mandatory network-product catalogue.

Article 27 applies when laws, administrative regulations, or other state rules require a CII to use commercial cryptography for protection. The CII operator must conduct the commercial-cryptography application security assessment itself or commission a commercial-cryptography testing body.

Articles 38 and 39 of the implementing regulation require the operator to prepare a commercial-cryptography application plan, provide funding and professional staff, and plan, build, and operate the cryptography protection system alongside the CII. The CII provisions effective 1 August 2025 make the lifecycle explicit: assess the application plan, reassess it if it changes during construction, pass an assessment before operation, and assess at least annually after operation. CII already under construction on that date follows the construction and pre-operation route; CII already operating follows the annual route. Its commercial-cryptography products and services must be tested and certified, while its algorithms, protocols, key-management mechanisms, and other cryptographic technologies must pass state cryptography administration review and appraisal.

A failed plan assessment means the plan cannot be used as the construction basis. A failed pre-operation assessment requires modification and prevents operation during the modification period. A failed annual assessment also requires modification, but the operator must take necessary measures to keep the operating CII secure during that work. A major cryptography-related security incident, major cryptography security hazard, or special emergency must be reported promptly and can require another assessment.

When the Commercial Cryptography Application Security Assessment Measures apply, file the assessment report and related work information with the National Cryptography Administration or the relevant province-level cryptography authority within 30 days after the report is formed. An operator that performs its own assessment must retain the original records and report for at least six years. These filing and retention duties belong to the system assessment; they do not turn a product report into a system-assessment result.

Article 42 requires coordination with CII security testing and the network-security classified-protection assessment system to avoid duplicate work. Coordination does not erase the separate trigger, scope, or required conclusion for each assessment.

The record should show whether assurance is voluntary, mandatory for an Article 26 product or service, or part of the CII application-assessment lifecycle. Keep the exact catalogue entry, qualified-body scope, report or certificate, CII trigger, assessment stage, result, filing, and remediation together.