China Cryptography Law Commercial cryptography import, export, assessment, and security review triage

Encryption alone does not trigger the trade-control regime. Import and export screening now use different lists. The Commercial Cryptography Import Licensing List attached to Announcement No. 63 of 2020 remains the basis for commercial cryptography import licensing. For exports, Announcement No. 51 of 2024 replaced the 2020 commercial cryptography export list and procedure with China's unified Dual-Use Items Export Control List from 1 December 2024.

For exports, check listed dual-use items, temporary controls, and statutory catch-all cases. The 2024 Dual-Use Items Export Control Regulation also requires the exporter to understand the item's performance and main use and allows a classification consultation with the Ministry of Commerce when the exporter cannot determine whether the item is controlled.

The Law excludes commercial cryptography used in mass-market consumer products from this import licensing and export control regime. An official National Cryptography Administration policy answer describes these as products or technologies that the public can buy without restriction through ordinary retail channels, for personal use, and whose cryptographic function cannot easily be changed. Treat that description as official explanatory guidance and document the product facts; do not infer the exclusion from a consumer-facing brand name alone.

Commercial cryptography application security assessment asks whether an in-scope network and information system uses commercial cryptography compliantly, correctly, and effectively. CII national security review asks whether a critical information infrastructure operator's procurement of a network product or service involving commercial cryptography affects or may affect national security. The operator must assess that risk before use and apply to the Cybersecurity Review Office when the trigger is met. Neither that review nor an application security assessment determines whether an import or export licence is required.

Classify the exact item or technology against the applicable import or export entry and technical description. Record enough detail to repeat the match: product and component names, model and version, cryptographic functions, algorithms and key lengths where relevant to the entry, whether users can change the cryptographic function, and whether software, source code, object code, technical data, or a service is transferred. A customs commodity code is a reference point, not the legal classification.

For a listed import, apply to the Ministry of Commerce for a commercial cryptography import licence under the 2020 Import Licensing List and the Commercial Cryptography Administration Regulation. For an export, apply under the Dual-Use Items Export Control Regulation. A single export licence application requires applicant identity documents, the contract or agreement, a technical description or test report, final-user and final-use evidence, and any other required materials. The export regulation sets a 45-working-day decision period after acceptance, but time for classification, expert consultation, or on-site checks is excluded, and cases requiring State Council or Central Military Commission approval are not subject to that period.

For exports, preserve final-user and final-use evidence, contracts, invoices, books, documents, and business correspondence for at least five years. If a licence is active and the item type, destination, final user, final use, or another licence fact changes, stop using the licence and follow the reapplication or change procedure before continuing.

Screen non-sale and special customs movements as well as conventional shipments. The dual-use export regime covers transfers from China to destinations abroad and provision of controlled items by Chinese persons or organizations to foreign persons or organizations. Internal movements between specified special customs supervision areas and bonded supervision sites do not require an export licence under that regime, but remain subject to customs supervision. If Customs questions whether an export is controlled, it may withhold release while the item is classified.

For an important network and information system that is required by law, administrative regulation, or another national provision to use commercial cryptography protection, the operator must prepare and assess its commercial cryptography application plan, assess the system before operation, conduct an assessment at least once each year after operation, and file the report and related work information within 30 days after the report is formed.

For critical information infrastructure required to use commercial cryptography, the CII Commercial Cryptography Use Provisions have applied since 1 August 2025. They require tested and certified commercial cryptography products and services, review by the National Cryptography Administration of the cryptographic algorithms, protocols, and key-management mechanisms used, and an annual operator report to the relevant protection department by 31 January covering the prior year's commercial cryptography use and assessments.

Application security assessment is distinct from the national security review in Cryptography Law Article 27. The national security review question arises when a CII operator procures a network product or service involving commercial cryptography that affects or may affect national security. Under the Cybersecurity Review Measures, the operator must assess the risk before use and apply to the Cybersecurity Review Office when the trigger is met. Record the operator status, procurement, national-security risk analysis, review submission, and outcome separately; do not infer review clearance from a cryptography assessment report or product certificate.

Assign separate owners for trade classification, customs execution, product security, the system assessment, and CII procurement review. They may use the same product specification and cryptography inventory, but each owner should approve only the conclusion within that route.

Reopen the record when the transaction or product no longer matches the facts reviewed. If a list description, consumer-product exclusion, CII status, or national-security-effect question remains uncertain, leave the conclusion open and seek case-specific guidance from the responsible authority or qualified counsel.