QuestionChina

Does an app need MIIT filing and CAC app governance review? Direct answer

An app sponsor providing internet information services through an app in China must complete MIIT filing before providing the service. The CAC app rules separately govern the app provider and any distribution platform.

There is no routine CAC approval called an 'app governance review' for every app. A distribution platform, however, must file with its provincial cyberspace authority within 30 days after starting operations.

Author
Sorena AI
Published
Jul 5, 2026
Updated
Jul 24, 2026
Questions
2

Structured answer sets in this page tree.

Primary sources
3

Cited legal and guidance references.

Publication metadata
Sorena AI
Published Jul 5, 2026
Updated Jul 24, 2026
Overview

An providing internet information services through an app in China must complete , and the must separately comply with the rules. These are separate tracks. The CAC rules impose operating duties, not one routine approval called an 'app governance review' for every app.

Search this module

Find a question or answer quickly

2 of 2 questions
Question 1

Short answer

The 2023 MIIT notice says an engaged in internet information services within China must complete app filing and may not provide those services without it. The filing work covers mobile apps, mini-programs, and quick apps. The sponsor files with its provincial communications administration through its network access service provider or app ; an app-store listing is not the filing. After receiving complete and accurate materials, the provincial communications administration completes the filing within 20 working days, issues a filing number, and publishes the filing information.

The MIIT notice moved existing apps through a September 2023 to March 2024 filing phase and entered normalized work in July 2024. Those transition dates have passed. A new covered app now files before service begins, and the sponsor files changes or cancellation with the original filing authority when the recorded information changes.

comes from the Mobile Internet Application Information Service Management Provisions, which took effect on 1 August 2022 and apply separately to app information services and distribution services provided within China. Covered information services include examples such as instant messaging, news, knowledge question-and-answer services, forums, livestreaming, e-commerce, online audiovisual services, and life services. An must maintain content, data-security, personal-information, minors, complaint, vulnerability, and incident controls as applicable to its service. A regulated service such as internet news requires the relevant licence, while a new technology, application, or function with public-opinion attributes or social-mobilization capacity requires the applicable .

A has distinct duties: it must file with its provincial cyberspace authority within 30 days after going online, authenticate app providers, verify relevant permits or assessments, review apps and updates, manage listed apps, and keep enforcement records. That platform filing is not a CAC filing imposed on every individual .

does not prove CAC-rule or privacy compliance. The rule on also prevents an app from denying its basic function merely because a user refuses personal information that is not necessary for that function. Determine the app category and basic function before setting required fields or permissions.

Citations
MIIT notice on mobile app filing work

States that app sponsors providing internet information services in China must complete filing, identifies filing channels and app forms, and bars unfiled apps from providing those services.

Question 2

What to keep as evidence

The evidence should identify each app form and each actor rather than relying on one screenshot from an app store.

  • Scope record for each app, mini-program, or quick app: package or service identifier, sponsor and provider entities, services, users, domains and Internet Protocol (IP) address resources, access provider, and distribution channels.
  • MIIT record: submitted information, access-provider or platform verification, filing number, required in-app display or link, public-query result, and change or cancellation records.
  • Provider controls: required service permits, any applicable new-function , content review, account verification, vulnerability response, data security, personal information, minors, complaints, and incident reporting.
  • Necessary-personal-information map: app category, basic function, each data field and permission, legal basis, whether it is necessary for the basic function, and behavior when consent is refused.
  • For a : provincial CAC filing, provider identity and permit verification, listing and update reviews, monitoring, complaints, warnings, suspensions, removals, retained records, and authority reports.
Citations
Operationalize the requirement

Build the China network security evidence file

Sorena AI helps turn the answer to "Does an app need MIIT filing and CAC app governance review?" into assigned controls and retained evidence.

Primary sources

References and citations

miit.gov.cn
Referenced sections
  • Supports the filing identifiers, submission path, display, public-query, change, cancellation, platform-checking, and supervision records.
Related guides

Explore more topics

China App Filing vs Personal Information Rules
Decide whether a China mobile app needs MIIT filing, personal-information controls, or both, with current triggers, duties, dates, and evidence.
China cybersecurity and data security requirements
China cybersecurity requirements by actor: network operators, data processors, CII operators, platforms, app providers, and distribution platforms.
China cybersecurity compliance checklist
A China cybersecurity checklist for scoping network duties, data security, CII procurement review, app rules, MIIT filing, and supporting standards.
China cybersecurity deadlines and compliance calendar
Separate China cybersecurity commencement dates from recurring duties, filing lead times, review periods, and event-driven response deadlines.
China Cybersecurity Law FAQ
Practical answers on China network-operator scope, MLPS evidence, important data, cybersecurity review, app filing and governance, and smart-home standards under the law in force from 1 January 2026.
China Cybersecurity Law vs EU Cyber Resilience Act
Compare China's network-operator rules with the EU CRA's product duties, including scope, actors, evidence, reporting dates, and launch decisions.
China Cybersecurity Law vs EU NIS2 Directive
Compare China's network-operator duties with NIS2 entity duties, including scope, management accountability, incident reporting, evidence, and enforcement.
China cybersecurity penalties and fines
Compare current China Cybersecurity Law and Data Security Law fines by actor, breach, severity, and enforcement consequence.
China Cybersecurity Review vs Data Export Assessment
Separate China's cybersecurity-review triggers from CAC data-export assessment triggers, thresholds, filings, evidence, timing, and reapplication rules.
China cybersecurity review workflow
Determine whether CII procurement, platform data processing, or a qualifying foreign listing triggers China's Cybersecurity Review Measures.
China mobile app filing and app governance
Identify the China app sponsor, complete MIIT filing before service, and separate provider, platform, privacy, content, and security duties.
China Smart-Home Security vs Telecom and Radio Approval
Separate GB/T 41387-2022 smart-home security evidence from China telecom network-access and radio approval decisions for connected products.
CII and network operator role triage
How to separate ordinary network operator duties from CII, procurement, and review-risk questions under China cybersecurity sources.
GB/T 22239-2019 classified protection baseline
How to scope and document a GB/T 22239-2019 classified protection baseline without treating the recommended standard as a standalone law.
GB/T 41387-2022 smart home security standard
How connected-device teams can scope and document GB/T 41387-2022 without treating it as an automatic certification or product-approval duty.
How do smart home security standards fit with China cybersecurity law?
GB/T 41387-2022 can organize smart-home security evidence, but it is a recommended standard, not a product approval. Check app, data, MLPS, telecom access, and radio requirements separately.
How does important data change China cybersecurity obligations?
Once data is officially identified as important data, the processor needs named governance, periodic risk assessments and reports, incident controls, and a separate export decision. An internal sensitivity label alone does not establish the legal category.
Is every company a network operator under China Cybersecurity Law?
No. Under China's Cybersecurity Law, a network operator is an owner or administrator of a network or a network service provider. Apply that definition to each China network or service, then test CII and other roles separately.
MLPS classified protection evidence map
Classify a China network under MLPS, complete level 2 or above filing, map controls, and retain assessment, remediation, and change evidence.
What is MLPS classified protection evidence?
MLPS evidence shows how a defined China network or system was graded and protected. Keep the scope, grading rationale, filing or assessment records where applicable, control mapping, test results, remediation, and reassessment history.
When does China cybersecurity review apply?
China cybersecurity review applies to CII procurement or network-platform data processing that affects or may affect national security, plus a mandatory pre-filing trigger for certain foreign listings involving more than one million users' personal information.