China requirements by role: standards, testing, certification, CII use and assessment, trade controls, and evidence.
Identify the actor and trigger before assigning controls. The rules differ for operators, product and service providers, bodies, CII operators, importers and exporters, and electronic certification providers.
China does not impose one approval on every use of encryption. This guide maps the main duties to the actor, product, service, system, or shipment that triggers them.
The Cryptography Law has applied since 1 January 2020. Article 8 allows citizens, legal persons, and other organizations to use lawfully to protect network and information security, while Articles 24-31 attach duties to particular commercial cryptography activities and actors. This page does not cover core or ordinary cryptography used to protect state-secret information.
The revised Administration Regulation has applied since 1 July 2023 to commercial cryptography research, production, sale, service, testing, certification, import, export, and application activities in China. The application-assessment measures have applied since 1 November 2023. The CII provisions effective 1 August 2025 apply to infrastructure identified as CII under the Cybersecurity Law, the CII Security Protection Regulation, and related rules.
Sources (8)
Use for cryptography categories, commercial cryptography development and management, product/service controls, CII use, import/export context, penalties, and 1 January 2020 effective date.
Use for qualification and supervision of commercial-cryptography product-testing and application-security-assessment bodies, including report, data, sample, and information-reporting rules.
Articles 11-34 and 38-42 support the detailed standards, testing, certification, electronic certification, import/export, and CII requirements.
Articles 2 and 5-15 support the CII actor boundary, accountable main person, qualified roles, funding, product, service, technology, data-protection, planning, assessment, 31 January annual reporting, and review duties.
Articles 2-3 and 10-17 support the license, five-year term, 30-day change filing, renewal timing, annual compliance assessment, annual training hours, and operating requirements effective 1 July 2026.
The joint-authority catalogue supplies the current product categories and technical thresholds and records that it replaced the 2017 catalogue from 3 July 2023.
Article 17 sets export decision timing, excluded review work, and approval exceptions.
Replaces the 2020 commercial cryptography export list and procedure from 1 December 2024.
Assign a separate conclusion for each route rather than using one 'Cryptography Law compliant' checkbox. The same product can be outside the mandatory network-product catalogue route yet still require CII controls or an import or export license because the triggers differ.
The owner mapping and evidence workflow below are Sorena's operational synthesis. The cited rules establish the duties but do not prescribe this exact internal process.
Sources (4)
Use for cryptography categories, commercial cryptography development and management, product/service controls, CII use, import/export context, penalties, and 1 January 2020 effective date.
Use for qualification and supervision of commercial-cryptography product-testing and application-security-assessment bodies, including report, data, sample, and information-reporting rules.
Articles 5, 12, and 15-20 support approved-scope, authorized-signatory, seal, six-year retention, and 15 January annual-report duties for testing bodies.
Articles 6-15 and 21 support assessment planning, pre-operation and annual assessment, evidence, retention, filing, incident response, and the 1 November 2023 effective date.
Keep enough evidence to reproduce each conclusion: actor, exact item and version, cryptographic function, applicable article, catalogue or list entry and threshold, accountable operator, test or certificate scope, assessment, filing or license, reviewer, date, and unresolved question.
For a self-performed , retain original records and reports for at least six years. File the assessment report and related work information within 30 days after the report is formed when the assessment measures apply.
Sources (2)
Use for cryptography categories, commercial cryptography development and management, product/service controls, CII use, import/export context, penalties, and 1 January 2020 effective date.
Articles 13-15 support self-assessment sign-off, six-year retention, filing within 30 days, sampling, and incident response.
The current Cybersecurity Law separately governs network-security graded protection, product and service duties, network critical equipment and network security-specific products, CII protection, and certain procurement reviews. Its 2025 amendment took effect on 1 January 2026.
Keep personal-information, data-export, app-governance, and other network-security conclusions in their own source-backed analyses. The 2025 CII cryptography provisions require protection for core data, important data, and personal information in covered CII according to the applicable data-protection and personal-information rules, but that cryptography control does not complete those separate legal analyses.
Sources (3)
Use for cryptography categories, commercial cryptography development and management, product/service controls, CII use, import/export context, penalties, and 1 January 2020 effective date.
Use for the current text, including Article 23 graded protection, Article 25 product assurance, and Articles 33-40 CII duties.
Supports the amendment's 1 January 2026 effective date.
Sorena AI helps turn a China Cryptography Law decision into assigned owners, controls, and records for review.
Research Copilot connects the official citation, decision, owner, retained evidence, and change history.
Check the China Cryptography Law scope decision and unresolved launch questions with Sorena.
China commercial cryptography checklist covering classification, product and service assurance, CII duties, trade controls, and retained evidence.
Record the legal route, product or system scope, testing-body qualification, report details, gaps, and reassessment triggers for China commercial cryptography assurance.
China cryptography effective dates, CII reports, annual assessments, licence renewals, change notices, and pre-operation checks.
Screen commercial cryptography imports under the 2020 list, exports under China's unified dual-use list, the consumer exclusion, system assessment, and CII review.
Answers on China's commercial-cryptography scope, product assurance, classified protection, CII assessment, procurement review, and trade controls.
Compare China's Cryptography Law and current Cybersecurity Law by scope, actor, product assurance, CII duties, evidence, and enforcement.
China commercial cryptography penalties by actor and violation, including fine bands, corrective orders, confiscation, licence action, and liability.
Procurement checks for commercial cryptography products and services used in China, including certificate scope, CII duties, and supplier changes.
When China commercial cryptography testing or certification is voluntary or mandatory, and what product, service, body, and scope evidence to keep.
Not every encrypted product imported into China needs a licence. Check the 2020 commercial-cryptography import list, the consumer-product exception, and any CII procurement review.
Using encryption does not create one universal China approval duty. Check classified protection, product, service, CII, procurement, and trade triggers.
See how China's cryptography rules connect with classified protection, product assurance, CII assessment, and cybersecurity review without merging the regimes.
Commercial cryptography protects information that is not a state secret. Learn how China defines the category and which separate facts trigger product, CII, or trade controls.
Commercial-cryptography assurance is often voluntary, but specified products and services require it. Covered CII also needs application assessment and qualified cryptography.