How do smart home security standards fit with China cybersecurity law? Direct answer

GB/T 41387-2022, Information security technology - Smart home general security specification, is shown as current on the official standards page. It was published on 15 April 2022 and took effect on 1 November 2022. The '/T' designation identifies a recommended national standard; the implementation date is not an approval deadline or annual renewal date for every connected product.

Use the standard only after defining the product boundary: device hardware and firmware, local hub, mobile app, cloud services, accounts, data flows, interfaces, update path, and third-party components. Record which clauses apply, the design or test evidence for each clause, exceptions, remediation, and retest results. If a contract, procurement rule, certification scheme, or sector rule incorporates the standard, document that separate source and its legal or contractual effect.

Then run the independent legal routes. A network operator for a China network may have classified protection and incident duties under Articles 23 and 27 of the consolidated 2025 Cybersecurity Law. A companion app may need MIIT app filing and must meet CAC app-governance and personal-information rules. Radio transmitters may need radio type approval unless an exemption applies. Under the cited band rules, certain outdoor access points, center stations, and point-to-point stations in the 2400 MHz or 5800 MHz bands need a station licence when they exceed the applicable power threshold. Covered telecom equipment connected to a public telecommunications network may require telecom network access under the current equipment catalogue.

For example, a smart camera sold with a China-facing companion app and cloud account needs separate decisions for the device boundary under GB/T 41387-2022, the app sponsor and app provider, the cloud or backend network operator, personal-information processing, and the radio configuration. A local-only sensor with no app, cloud service, or public-network connection can follow a different route, but its transmitter and any incorporated contractual standard still need their own checks. These are examples; the final result depends on the released functions, architecture, responsible entities, and current catalogues.

The official metadata page confirms the standard's identity and status but does not supply enough text for clause-level claims. Obtain the applicable edition before building the control map.