What is commercial cryptography in China? Direct answer

Article 2 defines cryptography broadly as technologies, products, and services that use specific transformations to encrypt information or provide security authentication. The category can therefore cover a cryptographic authentication function even when confidentiality is not the main purpose. Articles 6-8 then divide cryptography into core, ordinary, and commercial categories.

Core and ordinary cryptography protect state-secret information and are subject to strict unified management. Commercial cryptography protects information that is not a state secret, and citizens, legal persons, and other organisations may lawfully use it to protect network and information security.

The word commercial describes the statutory non-state-secret category; it does not mean that only businesses use it or that every product sold commercially follows a mandatory approval route. The law also requires authorities to treat foreign-invested enterprises lawfully and equally in commercial-cryptography research, production, sale, service, and import or export activities.

The Cryptography Law took effect on 1 January 2020. The revised Commercial Cryptography Administration Regulation took effect on 1 July 2023 and applies within China to commercial-cryptography research, production, sale, service, testing, certification, import, export, application, and supervision. Its definition confirms that commercial cryptography includes technologies, products, and services used for encryption protection or security authentication of non-state-secret information.

Commercial-cryptography status alone does not trigger universal approval. Article 24 of the law and Article 11 of the implementing regulation require commercial-cryptography activities to comply with applicable laws, administrative regulations, mandatory national standards, and publicly declared standards. More specific facts determine the remaining duties.

Record the protected information, cryptographic function, product or service, supplier, operator, and China use case. Check each possible route separately because a commercial-cryptography product may fall outside some mandatory routes.

The record should identify the protected information, explain why it is or is not a state secret, describe the encryption-protection or security-authentication function, and keep the commercial-cryptography classification separate from every downstream approval, assurance, assessment, and trade-control decision.