All posts by adm0n

Patent / 专利

China’s Prioritized Patent Examination Measures from 1 September 2026: A Guide for Foreign Applicants

  • CNIPA Order No. 85, the new Measures for the Administration of Prioritized Patent Examination, was promulgated on 28 July 2026 and takes effect on 1 September 2026, repealing the 2017 Measures (Order No. 76).
    国家知识产权局令第八十五号《专利优先审查管理办法》于2026年7月28日公布、自2026年9月1日起施行，同时废止2017年6月27日公布的旧办法（局令第76号）。
  • The Measures contain 24 articles in six chapters and cover four case types: invention applications in substantive examination before first processing, utility model and design applications, reexamination cases, and invalidation cases.
    新办法共24条、分六章，适用四类案件：处于实质审查阶段且未作出首次处理的发明专利申请，实用新型和外观设计专利申请，复审案件，以及无效宣告案件。
  • Cases running through a PPH bilateral or multilateral arrangement, or through pre-examination at a national IP protection or rapid-rights centre, are expressly outside these Measures.
    依据双边或多边协议开展的优先审查（即PPH专利审查高速路），以及经国家级知识产权保护中心、快速维权中心预审合格后的快速审查，明确不适用本办法，按有关规定处理。
  • Eligibility requires significant innovation value and commercialisation prospects, plus one of five listed grounds, with emerging and future industries and key core technologies placed first.
    适用条件要求申请”具有重要的创新价值以及转化运用前景”，并符合五项情形之一，其中新兴产业、未来产业与关键核心技术攻关被置于首位。
  • Prioritized examination carries no additional service fee, while abnormal filings or false materials trigger termination and penalties.
    办法明确优先审查服务不收取额外费用；同时对非正常专利申请、提交虚假材料等违反诚信原则的行为设置罚则并可停止优先审查。
  • For foreign-invested enterprises, the provincial IP bureau recommendation and the industrialisation evidence file are the two practical bottlenecks to prepare before 1 September 2026.
    对外资企业而言，省级知识产权局推荐意见环节与产业化证据材料，是2026年9月1日前需提前准备的两个实操瓶颈。

China’s Prioritized Patent Examination Measures from 1 September 2026: A Guide for Foreign Applicants | 中国专利优先审查新规2026年9月1日施行：外国申请人实操指南

Overview

On 28 July 2026 the China National Intellectual Property Administration (CNIPA) promulgated the Measures for the Administration of Prioritized Patent Examination (《专利优先审查管理办法》) as Order No. 85, signed by Commissioner Shen Changyu. Adopted at CNIPA’s 4th executive meeting on 16 July 2026, they take effect on 1 September 2026 and repeal the 2017 Measures of the same name (Order No. 76, promulgated 27 June 2017).

The Measures run to 24 articles in six chapters: General Provisions, Applicable Conditions, Filing a Request, Review and Examination Procedures, Supervision and Administration, and Supplementary Provisions. For foreign applicants and foreign-invested enterprises (FIEs), three questions matter: which filings can be accelerated, what evidence must support the request, and which channel applies.

What Changes on 1 September 2026

CNIPA’s official explanation gives three directions of change against the 2017 Measures.

First, the applicable conditions are recalibrated to the new situation and to national needs: acceleration is concentrated on high-quality applications in emerging and future industries, and the circumstances in which prioritized examination will not be granted are expressly stated.

Second, the whole-process management system is completed and quality orientation reinforced: central–local coordination is strengthened, the recommendation work of provincial IP administrations is standardised, and penalties are introduced for breaches of the principle of good faith.

Third, procedures and standards are optimised: prior-art submission requirements are refined and no additional fee is charged for the prioritized examination service.

Scope: Which Cases Qualify

Article 4 defines four categories of case:

  1. Invention patent applications in substantive examination for which no first processing has been made. “First processing” means the examiner has commenced examination and issued a notification; once that happens the window has closed.
  2. Utility model and design patent applications.
  3. Reexamination cases for invention, utility model and design patents.
  4. Invalidation cases for all three patent types.

The fourth category matters most strategically: it turns prioritized examination into an enforcement tool.

The PPH Carve-Out: The Most Important Point for Foreign Applicants

Article 4 also contains an exclusion foreign applicants must read first. Where prioritized examination is carried out under a bilateral or multilateral agreement between CNIPA and the patent examination authority of another country or region — the Patent Prosecution Highway — or where rapid examination follows pre-examination at a national-level IP protection centre or rapid-rights-protection centre, the matter is handled under separate rules and these Measures do not apply.

Foreign applicants therefore run on two tracks. A case accelerated on a favourable result from the USPTO, EPO, JPO, KIPO or another PPH partner office stays on the PPH track, and the Article 5 conditions, recommendation requirement and penalties of Order No. 85 do not govern it. A case seeking acceleration on the merits of the Chinese filing itself falls squarely under Order No. 85.

Eligibility Conditions Under Article 5

Article 5 sets a threshold, then a list. The threshold: the case must have significant innovation value and prospects for transformation and application. In addition it must fall within one of the following:

  1. It involves an emerging industry or future industry, or a key core technology tackling programme;
  2. It involves an industry specifically encouraged by a provincial-level or districted-city-level people’s government;
  3. The applicant has already industrialised the invention-creation, has completed preparations for industrialisation, or has evidence that another party is working it;
  4. The Chinese application is one for which the applicant first filed in China on the same subject matter and subsequently requested substantive examination in another country or region;
  5. Other circumstances of major significance to the national or public interest.

Ground (3) is the workhorse for FIEs with a Chinese manufacturing or R&D footprint; ground (4) rewards a China-first filing strategy.

Timeliness Benchmarks Established by the 2017 Measures

The 2017 Measures established turnaround benchmarks that remain the usual planning reference: invention applications received a first office action within 45 days of the date of consent and were concluded within one year; utility model and design applications within two months; reexamination cases within seven months; invalidation cases for inventions and utility models within five months; and invalidation cases for designs within four months.

These are benchmarks of the earlier Measures, not provisions of Order No. 85, and serve only as a historical comparator.

How to File: Procedural Background

Filing had to be electronic, with a defined document set: the request for prioritized examination, materials on the relevant prior art or prior design, and supporting evidence. Except for an application first filed in China and subsequently filed abroad, the request had to carry a recommendation opinion signed by a relevant State Council department or a provincial IP administration. Once granted, prioritized status could be stopped and the case returned to the ordinary procedure if the applicant made unsolicited amendments, responded out of time, submitted false materials, or the filing was found to be an abnormal patent application.

Practical Steps for Foreign Applicants and FIEs

Map your route into China. Foreign applicants use three routes: a direct Paris Convention filing claiming home-country priority; the Chinese national phase of a PCT application; and PPH acceleration. Only the first two are candidates for Order No. 85 treatment.

Build the provincial relationship early. The recommendation opinion cannot be compressed at the last minute. An FIE needs a working channel with the IP bureau of the province where the Chinese entity is registered, covering intake process, review cycle and documentary format. Groups with several subsidiaries should decide which entity is the filing vehicle, since that fixes the counterpart bureau.

Assemble the industry evidence file. Self-substantiation is the applicant’s burden: a technical field statement mapping the claimed subject matter to the relevant industrial catalogue or provincial encouraged-industry list; industrialisation-readiness materials such as production line documentation, supply contracts, capital expenditure approvals and board resolutions; and evidence that a third party is working the invention-creation.

Use invalidation acceleration tactically. Because invalidation cases are in scope, an FIE sued for infringement in China, or asserting its own rights, can accelerate the corresponding invalidation proceeding — changing the leverage position in parallel litigation and settlement talks.

Respect the integrity red lines. Abnormal patent applications and false supporting materials attract both termination of prioritized examination and the penalty provisions of the new Measures. Filing-volume targets, subsidy-driven behaviour and unsupervised outsourced drafting are the usual sources of exposure.

Plan the transition. Requests filed before 1 September 2026 fall under the 2017 Measures; those filed on or after it fall under Order No. 85. For a borderline case, weigh the readiness of the recommendation opinion and evidence file against the tighter eligibility standard of the new regime.

Wider Policy Context

At a State Council Information Office press conference on 29 July 2026 on IP protection and utilisation during the 15th Five-Year Plan period, CNIPA said it would implement examination on demand with greater intensity, combining prioritized, rapid and deferred examination in a “fast and slow in combination” model. Order No. 85 is the prioritized-examination component of that design. Separately, the Trademark Law was revised in 2026 and takes effect on 1 January 2027.

Related Reading

See our overview of patent filing routes into China (No. 198), IP enforcement strategy for FIEs (No. 201), and trademark registration (No. 203).

中国专利优先审查新规2026年9月1日施行：外国申请人实操指南

概述

2026年7月28日，国家知识产权局以国家知识产权局令第八十五号公布《专利优先审查管理办法》，由局长申长雨签发。该办法已于2026年7月16日经国家知识产权局第4次局务会议审议通过，自2026年9月1日起施行，同时废止2017年6月27日公布的原《专利优先审查管理办法》（局令第76号）。

新办法全文共24条，分六章：总则、适用条件、提出请求、审核与审查程序、监督管理、附则。对外国申请人及在华外资企业（FIE）而言，需要回答三个问题：2026年9月1日之后哪些案件可以加快、请求背后需要什么证据、以及哪一条加速通道真正适用。

2026年9月1日起有何变化

国家知识产权局官方解读将本次修改概括为三个方向。

一是结合新形势调整适用条件、突出国家需求：聚焦新兴产业和未来产业的高质量申请，并明确规定不予优先审查的情形。

二是完善全流程管理体系、强化质量导向：强化央地协同，规范省级知识产权局的推荐工作，并对违反诚信原则的行为设置罚则。

三是优化操作程序和标准：完善现有技术材料的提交要求；并且——对企业知识产权预算有直接意义的一点——明确优先审查服务不收取额外费用。

适用范围：哪些案件可以申请

第四条规定了四类案件：

  1. 发明专利申请：处于实质审查阶段且尚未作出首次处理的申请。”首次处理”指审查员已开始审查并发出通知书；一旦发出，本通道即告关闭。
  2. 实用新型和外观设计专利申请。
  3. 复审案件：发明、实用新型、外观设计专利的复审案件。
  4. 无效宣告案件：上述三种专利的无效宣告案件。

第四类的战略意义最大：它把优先审查从申请端工具转变为维权端工具。

PPH除外条款：外国申请人最重要的一条

第四条还包含一项外国申请人必须优先阅读的排除规定：依据国家知识产权局与其他国家或者地区专利审查机构签订的双边或者多边协议开展优先审查的（即专利审查高速路PPH），或者经国家级知识产权保护中心、快速维权中心预审合格后开展快速审查的，按照有关规定处理，不适用本办法。

外国申请人因此处于双轨环境。凭借在美国专利商标局、欧洲专利局、日本特许厅、韩国特许厅或其他PPH合作局取得的有利结论而加快的案件，仍走PPH自身规则，第八十五号令的第五条条件、推荐意见要求与罚则并不适用；基于中国申请本身实质内容与转化运用前景寻求加快的案件，则完全落入第八十五号令。应在9月之前按加速通道对每一件在审中国案件打标。

第五条适用条件

第五条先设门槛，再列情形。门槛是：申请或案件须具有重要的创新价值以及转化运用前景。此外还须符合下列情形之一：

  1. 涉及新兴产业和未来产业，或者关键核心技术攻关的；
  2. 涉及省级或者设区的市级人民政府重点鼓励的产业的；
  3. 申请人已经产业化实施该发明创造，或者已做好产业化实施准备，或者有证据证明他人正在实施其发明创造的；
  4. 就相同主题首次在中国提出专利申请后，又向其他国家或者地区提出实质审查请求的该中国专利申请；
  5. 对国家利益或者公共利益具有重大意义的其他情形。

对在中国拥有制造或研发布局的外资主体而言，第（三）项是主力条款，证据要求也最明确。第（四）项则奖励”中国首申”策略。

旧办法确立的时限基准

旧办法确立的周转时限，至今仍是最常被引用的规划参照：发明专利申请自同意之日起45日内发出第一次审查意见通知书、一年内结案；实用新型和外观设计专利申请两个月内结案；复审案件七个月内结案；发明和实用新型专利的无效宣告案件五个月内结案；外观设计专利的无效宣告案件四个月内结案。

上述数字是旧办法确立的时限基准，并非第八十五号令的条文，此处仅作历史对照。2026年9月1日起实际适用的时限，以新办法及国家知识产权局的实施实践为准。

如何提出请求：程序背景

既有程序框架要求：必须采用电子申请方式；须提交优先审查请求书、相关现有技术或现有设计的信息材料及相关证明文件；除”就相同主题首次在中国提出申请后又向境外提出申请”的情形外，请求书须由国务院有关部门或者省级知识产权局签署推荐意见。优先审查获同意后，申请人若主动修改申请文件、答复超期、提交虚假材料，或者被认定为非正常专利申请的，可以停止优先审查，案件转入普通程序。

外国申请人与外资企业的实操步骤

梳理入华路径。 外国申请人通常通过三条路径进入中国体系：以母国在先申请为优先权基础的巴黎公约路线直接申请；PCT国际申请进入中国国家阶段；以及基于合作局肯定性结论的PPH加速。其中只有前两者是第八十五号令的适用对象。

尽早建立省级沟通渠道。 省级推荐意见无法在最后时刻压缩。外资企业需要与中国主体注册地所在省份的知识产权局——必要时还包括设区的市级知识产权局——建立工作通道，掌握受理流程、审核周期与文件格式要求。在中国设有多家子公司的集团应明确由哪一主体作为加速案件的申请人，因为这直接决定对接哪一个机关。

搭建产业证据材料包。 自证责任在申请人。一份可站得住的材料包包含：技术领域说明，将权利要求所涉主题对应到相关产业目录或省级重点鼓励产业清单；产业化准备材料，如产线文件、供货合同、资本开支审批、董事会决议；以及在需要援引时，他人正在实施该发明创造的证据。

将无效宣告加速用作战术工具。 由于无效宣告案件在适用范围之内，在中国被诉侵权或正在主张自身权利的外资企业，可以就相应的无效宣告程序请求优先审查。压缩无效宣告时间表，会改变平行诉讼与和解谈判中的杠杆位置。

守住诚信红线。 非正常专利申请与虚假证明材料，现在不仅会导致停止优先审查，还会触发新办法引入的罚则。风险通常来自申请量考核指标、补贴驱动的申请行为，以及对外包撰写机构缺乏监督。

规划2026年9月1日前后的过渡。 该日期之前提交的请求适用旧办法，当日或之后提交的请求适用第八十五号令。对处于边界的案件，应权衡推荐意见与证据材料的就绪程度，与新制度更严格、更定向的适用标准之间的关系。

更广的政策背景

2026年7月29日，国务院新闻办公室举行新闻发布会，介绍”十五五”时期知识产权保护和运用情况。国家知识产权局表示，将实施更大力度的按需审查，综合运用优先审查、快速审查、延迟审查等”快慢结合”的审查模式。第八十五号令正是这一整体设计中的优先审查环节。此外，《中华人民共和国商标法》已于2026年修订，自2027年1月1日起施行。

相关阅读

可参阅本站入华专利申请路径概览（编号198）、外资企业知识产权维权与无效宣告策略（编号201）、商标注册与保护（编号203）。

Sources

Patent / 专利

Protecting industrial designs in China via the Hague Agreement

  • China acceded to the Hague Agreement (1999 Act) on 5 February 2022 and it took effect on 5 May 2022, giving foreign and Chinese applicants one filing route to protect an industrial design in China and dozens of other jurisdictions.
    中国于 2022 年 2 月 5 日递交《海牙协定》（1999 年文本）加入书，2022 年 5 月 5 日生效，为中外申请人提供一条在包括中国在内的数十个法域保护工业品外观设计的单一申请通道。
  • A single Hague international application — one language, one set of fees — can designate China and many other members, replacing a patchwork of separate national filings.
    一份海牙国际申请（一种语言、一套费用）即可指定中国与多个其他成员，取代零散的多国分别申请。
  • China’s design protection term is 15 years from the grant date, aligned with the 1999 Act minimum after the 2021 Patent Law amendment removed the old 10-year limit that had blocked accession.
    中国外观设计保护期为授权之日起 15 年；2021 年专利法修改将原先 10 年上限延长至 15 年，消除了加入海牙协定的法律障碍。
  • Foreign applicants can file directly with WIPO’s International Bureau or indirectly through CNIPA in English; China is designated in the application and examined by CNIPA under Chinese patent law.
    外国申请人可直接向世界知识产权组织国际局提交，也可通过国家知识产权局以英文转交；在申请中指定中国后，由国家知识产权局依中国专利法审查。
  • Later changes — ownership transfers, renewals, corrections — are managed centrally with WIPO, taking effect across all designated contracting parties, greatly simplifying portfolio management.
    此后的权属变更、续展、更正等均可向 WIPO 集中办理，在所有指定缔约方一并生效，大幅简化组合管理。
  • Partial designs are now protectable in China, broadening what foreign brands can shield — from a product’s overall look down to a component’s ornamental shape.
    中国现已保护局部外观设计，扩大了外国品牌可受保护的范围，从产品整体外观延伸至零部件的装饰性形状。
  • Hague is especially valuable for consumer, industrial and packaging designs that are rolled out across markets — furniture, electronics, vehicles, fashion, toys, bottles and containers.
    海牙对跨市场推出的消费、工业及包装设计尤为有价值——家具、电子、汽车、时尚、玩具、瓶罐与容器等。

Protecting industrial designs in China via the Hague Agreement | 通过海牙协定在中国保护工业品外观设计

Overview

For a foreign brand launching a product in China, the visual design — the shape of a bottle, the contour of a chair, the interface of a device — is often as valuable as the technology underneath. Until recently, protecting that design in China meant a standalone Chinese filing. Since 5 May 2022, there is a second, often cheaper route: the Hague Agreement Concerning the International Registration of Industrial Designs, to which China acceded as its 77th member.

This article explains how the Hague System works for China-bound designs, why China joined, what foreign applicants need to know about filing, examination, scope (including partial designs) and renewals, and where it fits alongside a direct CNIPA filing. It is general information, not legal advice.

What the Hague Agreement is

The Hague Agreement, administered by WIPO, establishes the Hague System for the international registration of industrial designs. Through one international application, an applicant can seek design protection in multiple contracting parties. It sits alongside the Madrid System for trademarks and the PCT for patents as one of the three pillars of the global industrial-property services framework.

China acceded to the 1999 Act of the Agreement. The instrument of accession was deposited on 5 February 2022 during the Beijing Winter Olympics, and the Agreement entered into force for China on 5 May 2022. At accession, China became the 77th member of the “Hague Union,” whose membership spans roughly 75 countries and two intergovernmental organisations (the EU and OAPI), covering about 94 states.

Why China joined — and what changed in domestic law

China’s ability to join turned on a single domestic-law change. Under the Patent Law in force before 1 June 2021, design protection lasted 10 years from the filing date. The 1999 Act of the Hague Agreement requires a minimum of 15 years. The 2021 amendment extended China’s design term to 15 years from the grant date, removing the incompatibility. With that obstacle gone, China completed its domestic ratification procedure in early 2022 and deposited the instrument of accession.

For foreign rights-holders, the practical effect is twofold:

  • Inbound: a foreign company can now obtain Chinese design protection through a single Hague filing rather than a separate Chinese application.
  • Outbound: Chinese companies gained a streamlined path to protect their designs abroad — but the focus here is the inbound route that matters to foreign-invested entrants.

How a foreign applicant uses Hague for China

There are two filing routes:

  1. Direct with WIPO. File the international application directly with WIPO’s International Bureau (in English, French or Spanish, one set of fees).
  2. Indirect via CNIPA. File through the China National Intellectual Property Administration in English; CNIPA forwards the application to WIPO. This is convenient for applicants already working with Chinese counsel.

Either way, the applicant designates China in the application. CNIPA then examines the designated China portion under Chinese patent law and the revised Implementing Regulations and Guidelines. Key practical points:

  • Priority. If the applicant claims priority from an earlier application, and did not submit a copy of that earlier application with the international filing, the copy must be submitted to CNIPA within three months of the international publication; the same deadline applies to priority fees and, where the applicant name differs, supporting proof.
  • Divisional applications. An applicant may file a divisional application with CNIPA within two months of the international publication.
  • Fees. Hague fees are paid directly to WIPO, not to CNIPA.

Scope: what designs are protectable, including partial designs

Chinese design protection covers the ornamental (not functional) appearance of a product or a part of a product. A significant expansion — relevant to foreign filers — is that partial designs are now protectable: a component’s decorative shape can be claimed even where the whole product is not new. This matters for industries such as automotive (a distinctive grille or light cluster), consumer electronics (a phone’s corner curvature or iconography) and packaging (a bottle shoulder contour).

Exclusions remain: designs contrary to public order or morality, designs that depend on the look of a different design (dependent designs in the old sense), and purely functional shapes are not registrable. Novelty is assessed against prior art worldwide as of the filing/priority date.

Examination and grant in China

CNIPA examines the China-designated portion for formalities and substantive grounds (novelty, comply with scope). Unlike some jurisdictions, China conducts a substantive examination of designs. If granted, the protection term is 15 years from the grant date. The owner receives a Chinese design patent right enforceable against infringement in China, identical in effect to a design right obtained via a direct national filing.

Centralised management after registration

One of Hague’s biggest efficiencies appears after registration. Changes that would otherwise require amending every national registration — a change of owner, a renunciation, a limitation, or a renewal — are recorded once with WIPO’s International Bureau and take effect across all designated contracting parties (subject to any individual designated-party formalities). For a foreign group rolling out a design across China and multiple export markets, this centralised administration sharply reduces administrative overhead and the risk of missed renewal deadlines.

Hague vs a direct CNIPA filing

DimensionHague internationalDirect CNIPA national
FilingOne application, one language, one fee setChinese-language application to CNIPA
CoverageChina + many members at onceChina only
Post-registration changesCentralised at WIPOPer-registration at CNIPA
ExaminationCNIPA examines China portionCNIPA examines
Best whenMulti-market launch, centralised portfolioChina-only or where local strategy differs

Many foreign filers use both: Hague for the broad, multi-market baseline and direct national filings where they want market-specific claim scope or faster local grant.

Practical steps for foreign brands

  1. Decide the footprint. If you will sell the design in China and at least one other Hague member, Hague is usually cheaper and simpler for the baseline.
  2. Capture priority. If you first filed elsewhere, note the three-month copy/fee deadlines measured from international publication.
  3. Consider partial-design claims where a component’s look is the differentiator.
  4. Plan renewals centrally — record ownership and renewal at WIPO to keep the China right alive without separate CNIPA action.
  5. Pair with trademark and patent strategy — design, brand and function are distinct rights; protect each deliberately.

Sources

  • 国家知识产权局 2022年5月例行新闻发布会（海牙协定生效实施准备）：https://www.cnipa.gov.cn/col/col2920/index.html
  • 中国实现对国际规则的承诺（知识产权报，海牙协定与马拉喀什条约2022-05-05在华生效）：https://www.cnipa.gov.cn/art/2022/2/23/art_55_173353.html
  • 国家知识产权局公告 第四八一號《关于加入海牙协定后相关业务处理暂行办法》（2022-05-05 施行），中国政府网：https://big5.www.gov.cn/gate/big5/www.gov.cn/zhengce/zhengceku/2022-06/07/content_5694459.htm
  • WIPO — Hague Agreement Concerning the International Registration of Industrial Designs：https://www.wipo.int/treaties/en/registration/hague/

Related reading

  • 中国外观设计专利 15 年保护期 / China’s 15-year design term
  • 商标国际注册马德里体系 / Madrid System for trademarks
  • 外国品牌在华 IP 布局 / IP strategy for foreign brands in China

通过海牙协定在中国保护工业品外观设计

概述

对进入中国市场的外国品牌而言，视觉设计——瓶身造型、座椅轮廓、设备界面——往往与技术本身同样值钱。过去在中国保护这种设计需单独提交中国申请。自 2022 年 5 月 5 日起，出现了第二条、往往更省钱的路径：中国作为第 77 个成员加入的《工业品外观设计国际注册海牙协定》。

本文说明海牙体系如何服务于面向中国的设计、中国为何加入、外国申请人须了解的提交与审查、保护范围（含局部外观设计）与续展，以及它与直接向国家知识产权局申请的异同。本文为一般性信息，非法律意见。

海牙协定是什么

海牙协定由世界知识产权组织（WIPO）管理，确立工业品外观设计国际注册的海牙体系。通过一份国际申请，申请人可在多个缔约方寻求外观设计保护。它与商标马德里体系、专利 PCT 共同构成全球工业产权服务框架的三大支柱。

中国加入的是该协定的 1999 年文本。加入书于 2022 年 2 月 5 日（北京冬奥会期间）递交，2022 年 5 月 5 日对中国生效。加入时，中国成为”海牙联盟”第 77 个成员，联盟约含 75 个国家与两个政府间组织（欧盟、OAPI），覆盖约 94 个法域。

中国为何加入——国内法的改变

中国能否加入取决于一项国内法修改。在 2021 年 6 月 1 日前施行的专利法中，外观设计保护期为自申请日起 10 年。海牙协定 1999 年文本要求最低 15 年。2021 年修法将中国外观设计保护期延长至授权之日起 15 年，消除了不兼容。障碍消除后，中国于 2022 年初完成国内批准程序并递交加入书。

对外国权利人，实际效果有二：

  • 引进来： 外国公司现可通过一份海牙申请获得中国外观设计保护，不必再单独提交中国申请。
  • 走出去： 中国企业获得便捷的海外设计保护路径——但本文聚焦对外资进入者更重要的”引进来”路径。

外国申请人如何经海牙进入中国

有两条提交路径：

  1. 直接向 WIPO 提交。 向世界知识产权组织国际局直接提交国际申请（英文、法文或西班牙文，一套费用）。
  2. 经国家知识产权局间接提交。 以英文通过国家知识产权局提交，由其转送 WIPO。对已有中国代理的申请人尤为便利。

无论哪种，申请人均在申请中指定中国。随后国家知识产权局依中国专利法及修订后的实施细则、审查指南审查被指定中国的部分。关键实务要点：

  • 优先权。 如主张在先申请优先权且未随国际申请提交在先申请副本，须自国际公布之日起三个月内向国家知识产权局提交副本；优先权费及申请人名称不一致时的证明亦同此期限。
  • 分案申请。 申请人可自国际公布之日起两个月内向国家知识产权局提出分案申请。
  • 费用。 海牙规费直接缴至 WIPO，而非国家知识产权局。

保护范围：可保护设计，含局部外观设计

中国外观设计保护产品或其部分的装饰性（非功能性）外观。对外国申请人意义重大的一项扩展是现已保护局部外观设计：即使整体产品不具新颖性，也可就零部件的装饰性形状提出申请。这对汽车（独特格栅或灯组）、消费电子（手机边角曲率或图标）和包装（瓶肩轮廓）等行业尤为关键。

排除情形仍然存在：违背公共秩序或善良风俗的设计、依赖另一设计外观的设计（旧法意义上的依赖设计）以及纯功能性形状不可注册。新颖性以申请日/优先权日时全球范围内的现有设计为准判断。

在中国的审查与授权

国家知识产权局就被指定中国的部分进行形式与实质审查（新颖性、范围合规）。与部分法域不同，中国对外观设计进行实质审查。若授权，保护期为授权之日起 15 年。权利人取得的中国外观设计专利权可在中国针对侵权主张，效力等同于直接国内申请取得的权利。

注册后的集中管理

海牙最大的效率提升出现在注册之后。本需逐一修改各国注册的变动——权利人变更、放弃、减项或续展——只需在 WIPO 国际局集中记录，即在所有指定缔约方生效（视各指定方个别手续而定）。对在中国与多个出口市场同步推出设计的外国集团而言，这种集中管理大幅降低行政负担与错过续展期限的风险。

海牙 vs 直接向国家知识产权局申请

维度海牙国际申请直接国家申请
提交一份申请、一种语言、一套费用中文申请递交国家知识产权局
覆盖中国 + 多个成员一次性仅中国
注册后变更WIPO 集中办理在国家知识产权局逐件办理
审查国家知识产权局审查中国部分国家知识产权局审查
适用情形多市场推出、组合集中管理仅中国，或需本地差异化策略

许多外国申请人两者并用：以海牙建立宽泛的多市场基线，在需要本地差异化权利要求或更快本地授权时另提直接国家申请。

外国品牌实操步骤

  1. 确定覆盖版图。 若设计将在中国及至少一个其他海牙成员销售，海牙通常对基线更省更简。
  2. 抓住优先权。 若先在其他地方申请，注意自国际公布起算的三个月副本/费用期限。
  3. 考虑局部外观设计权利要求，当零部件外观为差异化要点时。
  4. 集中规划续展——在 WIPO 记录权属与续展，无需单独国家知识产权局动作即可维持中国权利。
  5. 与商标、专利策略配合——设计、品牌与功能是不同的权利，须分别刻意保护。

Sources

  • 国家知识产权局 2022年5月例行新闻发布会（海牙协定生效实施准备）：https://www.cnipa.gov.cn/col/col2920/index.html
  • 中国实现对国际规则的承诺（知识产权报，海牙协定与马拉喀什条约2022-05-05在华生效）：https://www.cnipa.gov.cn/art/2022/2/23/art_55_173353.html
  • 国家知识产权局公告 第四八一號《关于加入海牙协定后相关业务处理暂行办法》（2022-05-05 施行），中国政府网：https://big5.www.gov.cn/gate/big5/www.gov.cn/zhengce/zhengceku/2022-06/07/content_5694459.htm
  • WIPO — Hague Agreement Concerning the International Registration of Industrial Designs：https://www.wipo.int/treaties/en/registration/hague/

相关阅读

  • 中国外观设计专利 15 年保护期 / China’s 15-year design term
  • 商标国际注册马德里体系 / Madrid System for trademarks
  • 外国品牌在华 IP 布局 / IP strategy for foreign brands in China
E-commerce Entry / 电商入华

Cross-border e-commerce export via overseas warehouses (Model 9810)

  • China expanded its cross-border e-commerce pilot zones to 175, covering all 31 provincial regions in February 2026. 2026年2月，中国将跨境电商综试区扩至175个，覆盖全部31个省级行政区。
  • Filing for cross-border e-commerce export overseas-warehouse (Model 9810) has been cancelled; only the standard trader filing is needed. 跨境电商出口海外仓（9810模式）备案已取消，企业仅需办理标准进出口收发货人备案。
  • Model 9810 lets sellers declare export goods bound for their own overseas warehouses via the Single Window. 9810模式允许卖家通过中国国际贸易单一窗口，将发往自有海外仓的出口货物申报出境。
  • The 2025 supplementary retail-import list added 28 categories such as smart appliances and fitness equipment. 2025年零售进口增补清单新增28类商品，如智能家电与健身器材。
  • Returned cross-border e-commerce exports may re-enter bonded zones for re-sorting and re-export. 跨境电商出口退货可退回保税区，进行重新分拣后再出口。
  • The annual per-buyer retail-import limit remains RMB 26,000, with a single-transaction cap of RMB 5,000. 零售进口个人年度限额维持2.6万元，单次交易限值5000元。
  • The expansion and de-filing measures lower the compliance barrier for SMEs entering China-linked cross-border export. 扩区与取消备案等措施降低了中小企业参与对华关联跨境电商出口的合规门槛。

Cross-border e-commerce export via overseas warehouses (Model 9810) | 跨境电商出口海外仓（9810模式）

China’s cross-border e-commerce sector has grown into a strategic pillar of its foreign trade, and the “overseas warehouse” (海外仓) model has become the dominant logistics backbone for Chinese sellers serving overseas consumers with fast, localised delivery. For foreign brands and trading companies looking to use China as a supply-base or fulfilment hub, understanding the regulatory treatment of cross-border e-commerce export — particularly Customs supervision Model 9810 — is essential. This article reviews the February 2026 expansion of pilot zones, the cancellation of the separate 9810 filing, how the model works through the Single Window, the 2025 retail-import list update, and the return/re-export facilitation.

Overview

Cross-border e-commerce in China is governed by a composite framework spanning the Ministry of Commerce (MOFCOM), the General Administration of Customs (GACC), the tax authority, and foreign-exchange regulators. Goods move under designated customs supervision models, each with its own coding and documentation logic. The two most relevant export models are:

  • Model 9610 — “cross-border e-commerce retail export” (business-to-consumer, small parcels, direct shipment).
  • Model 9810 — “cross-border e-commerce export to overseas warehouse” (B2B2C: goods first exported to the seller’s own or controlled overseas warehouse, then sold locally to end consumers).

This article focuses on 9810, the model that lets a seller build inventory abroad while still treating the initial outbound leg as a cross-border e-commerce export for customs and (where applicable) tax purposes.

The overseas-warehouse model solves the core pain of cross-border retail: delivery speed and returns. By pre-positioning stock in destination markets (the US, EU, Southeast Asia, etc.), sellers cut delivery times from weeks to days and can handle local returns — but they need a compliant export declaration for the first leg. Model 9810 provides that declaration pathway.

February 2026: pilot zones reach 175

In February 2026, the State Council approved the establishment of 20 new cross-border e-commerce comprehensive pilot zones (综试区). This brought the nationwide total to 175, spanning all 31 provincial-level regions of China (23 provinces, 5 autonomous regions, 4 municipalities, plus the respective administrative regions covered under the national layout). MOFCOM subsequently issued the 《跨境电商综试区创新发展指引》 (Guidelines on Innovative Development of Cross-Border E-Commerce Comprehensive Pilot Zones) to steer the new zones toward higher-quality, innovation-led growth.

Significance for investors:

  • Near-universal coverage. With pilot zones in every provincial region, almost any coastal or inland city with a manufacturing or trade base can anchor a cross-border e-commerce operation, giving foreign investors more location options for bonded warehouses, fulfilment, and export hubs.
  • Policy laboratory. Pilot zones are where the most flexible customs, tax, and foreign-exchange facilitation measures are tested first. Operating inside a zone typically means faster clearance, consolidated declarations, and simplified foreign-exchange settlement for cross-border receipts.
  • Innovation mandate. The MOFCOM guidelines push zones toward digital trade, overseas-warehouse networks, and integrated supply-chain services — exactly the ecosystem foreign sellers and platforms need.

Cancellation of the separate 9810 filing

A major simplification introduced for cross-border e-commerce export to overseas warehouses: the separate filing/registration for Model 9810 has been cancelled. Previously, enterprises often faced an additional, distinct filing obligation specific to the 9810 overseas-warehouse business. Now:

  • Enterprises need only complete the standard importer/exporter filing (进出口收发货人备案) with Customs — the ordinary registration that any trader conducting import/export must hold.
  • Once that standard filing is in place, the enterprise may declare goods under Model 9810 directly through the China International Trade Single Window (国际贸易单一窗口).

Practical effect:

  • Lower barrier to entry. SMEs and foreign-invested trading companies no longer need a specialised, separate overseas-warehouse filing; the standard trader credential is sufficient.
  • Faster onboarding. Eliminating a discrete approval step shortens the time from deciding to use 9810 to actually declaring the first shipment.
  • Same compliance core. The substance of customs supervision (accurate manifests, value declaration, overseas-warehouse data linkage) remains; what was removed is the redundant front-end registration.

How Model 9810 works through the Single Window

Under Model 9810, the export declaration describes goods that are destined for the seller’s own overseas warehouse rather than for immediate delivery to an identified overseas consumer. The typical flow:

  1. Standard trader filing. The enterprise holds valid importer/exporter registration with Customs.
  2. Pre-position stock. The seller ships goods from China to its overseas warehouse (or a warehouse it controls) in the destination market.
  3. Single Window declaration (9810). At export, the enterprise declares the shipment under Model 9810 via the Single Window, submitting the customs declaration, manifest, and overseas-warehouse reference data.
  4. Outbound clearance. Customs clears the goods as cross-border e-commerce export to overseas warehouse; the goods depart China.
  5. Local sale and fulfilment. After arrival, the overseas warehouse picks, packs, and ships to end consumers in the destination country, with last-mile delivery handled locally.
  6. Data reconciliation. The enterprise maintains records linking the 9810 export declaration to subsequent overseas sales, supporting tax and foreign-exchange settlement.

Why sellers use 9810:

  • Localised delivery speed. Stock already abroad means 2–5 day delivery versus 10–20 days for direct parcel.
  • Return handling. Local returns can be restocked in the overseas warehouse instead of being shipped back to China immediately.
  • Tax and FX treatment. The model offers a recognised export pathway that can support export tax rebate (where applicable) and the settlement of cross-border foreign-exchange proceeds.

The 2025 retail-import list update

On the import side, China maintains a positive list (正面清单) of goods eligible for cross-border e-commerce retail import, enjoying simplified customs and tax treatment (a personal-items-style levy with the transaction limit). In 2025, a supplementary retail-import list added 28 new categories, including:

  • Smart home appliances (智能家电)
  • Fitness equipment (健身器材)
  • Eco-friendly building materials (环保建材)

Alongside the expansion, the annual per-buyer limit remains RMB 26,000, and the single-transaction cap stays at RMB 5,000. Goods within the limit are taxed under the cross-border retail-import regime (generally more favourable than general trade tariff + VAT); goods exceeding the limit fall back to general trade treatment.

Relevance to foreign brands: the widened list opens the door for more consumer categories to enter China via the bonded-import (Model 1210) or direct-import (Model 9610) retail channels, with the same per-buyer ceiling. Brands in the newly added categories (smart appliances, fitness, eco-materials) gain a clearer, lower-friction route to Chinese consumers.

Returns and re-export facilitation

A long-standing friction in cross-border e-commerce export was the treatment of returned goods. Under facilitation measures, returned cross-border e-commerce export goods may re-enter bonded zones (海关特殊监管区域 / 保税区) for re-sorting and re-export.

The mechanism:

  • Returned 9810 (or 9610) goods that come back to China can be admitted into a bonded zone rather than being treated as a fresh, fully-taxed import.
  • Inside the zone, the goods may be re-sorted (重新分拣), inspected, repackaged, or consolidated, then re-exported without undergoing the full general-trade import taxation.
  • This preserves the cost efficiency of the export model when individual overseas sales fail, are refused, or are returned for quality/ sizing reasons.

For sellers operating overseas warehouses, this means a returned item does not automatically become a dead loss subject to Chinese import duty on re-entry; instead it can cycle back through the bonded zone and be re-shipped to another market. It materially improves the unit economics of cross-border returns.

Practical playbook for foreign sellers

  1. Get the standard trader filing first. Complete importer/exporter registration with Customs; you do not need a separate 9810 filing.
  2. Choose a pilot-zone location. With 175 zones nationwide, pick one aligned to your supply chain (coastal for export speed, inland for cost) and use its Single Window integration.
  3. Set up the overseas warehouse linkage. Maintain accurate overseas-warehouse master data so 9810 declarations reconcile with downstream sales.
  4. Plan the import list angle. If you also sell into China, check the 2025 positive list (now +28 categories) and the RMB 26,000 annual / RMB 5,000 per-order limits.
  5. Use bonded returns. Route eligible returns into a bonded zone for re-sorting and re-export rather than full import.
  6. Watch the innovation guidelines. MOFCOM’s 综试区创新发展指引 signals where facilitation will deepen — overseas-warehouse networks, digital trade, and integrated logistics.

Sources

跨境电商出口海外仓（9810模式）

中国跨境电商已成长为外贸的战略支柱，”海外仓”模式也成为中国卖家以快速、本地化配送服务海外消费者的主导物流骨架。对于希望以中国为供应链基地或履约枢纽的外国品牌与贸易公司而言，理解跨境电商出口（尤其是海关监管代码9810模式）的监管待遇至关重要。本文梳理2026年2月综试区扩围、9810备案取消、该模式经单一窗口如何运作、2025年零售进口清单更新，以及退货与再出口便利。

概述

中国跨境电商由商务部（MOFCOM）、海关总署（GACC）、税务机关与外汇管理部门共同构建的框架监管。货物在指定的海关监管模式下流转，各模式有各自的代码与单证逻辑。最相关的两种出口模式为：

  • 9610模式 — “跨境电商零售出口”（B2C，小包裹，直接寄递）。
  • 9810模式 — “跨境电商出口海外仓”（B2B2C：货物先出口至卖家自有或控制的海外仓，再于当地销售给终端消费者）。

本文聚焦9810，即让卖家在海外建库存的同时，仍将首段出境环节作为跨境电商出口进行海关申报，并在适用时享受相关税务处理。

海外仓模式解决了跨境零售的核心痛点：配送时效与退货。通过目的市场（美国、欧盟、东南亚等）前置备货，卖家将配送时间从数周缩短至数日，并能处理本地退货——但首段出境需要合规的出口申报。9810即为该申报路径。

2026年2月：综试区达175个

2026年2月，国务院批准新设20个跨境电商综合试验区（综试区），使全国总数达到175个，覆盖中国全部31个省级行政区（23个省、5个自治区、4个直辖市，以及纳入全国布局的相关行政区）。商务部随后发布《跨境电商综试区创新发展指引》，引导新综试区迈向更高质量、创新引领的发展。

对投资者的意义：

  • 近乎全域覆盖。 综试区遍布各省级区域，几乎任何具备制造或贸易基础的海岸或内陆城市均可承载跨境电商业务，为外国投资者在保税仓、履约与出口枢纽的选址上提供更多选择。
  • 政策试验田。 综试区是最先试点最灵活海关、税收与外汇便利措施之地。在区内运营通常意味着更快通关、汇总申报，以及跨境电商收款的简化结汇。
  • 创新导向。 商务部指引推动综试区向数字贸易、海外仓网络与一体化供应链服务发展——正是外国卖家与平台所需的生态。

9810备案取消

针对跨境电商出口海外仓的一项重大简化：9810模式的单独备案/登记已被取消。此前，企业常须额外办理专门针对9810海外仓业务的备案。现在：

  • 企业仅需向海关办理标准进出口收发货人备案——任何开展进出口的经营者都必须持有的常规注册。
  • 该标准备案完成后，企业即可通过中国国际贸易单一窗口直接以9810模式申报货物。

实务效果：

  • 降低准入门槛。 中小企业与外商投资贸易公司不再需要专门、独立的海外仓备案；标准贸易资质即可。
  • 更快上线。 取消一道独立审批环节，缩短了从决定使用9810到实际申报首单的时间。
  • 合规内核不变。 海关监管实质（准确舱单、价格申报、海外仓数据联动）仍在；被移除的是冗余的前置登记。

9810如何通过单一窗口运作

在9810模式下，出口申报所描述的货物发往卖家自有海外仓，而非立即交付已确定的海外消费者。典型流程：

  1. 标准贸易备案。 企业持有有效的海关进出口收发货人注册。
  2. 前置备货。 卖家将货物从中国发往目的市场的自有（或受控）海外仓。
  3. 单一窗口申报（9810）。 出口时，企业通过单一窗口以9810模式申报，提交报关单、舱单与海外仓关联数据。
  4. 出境通关。 海关按跨境电商出口海外仓放行，货物离境。
  5. 本地销售与履约。 到货后，海外仓拣货、打包并配送至目的国终端消费者，末端配送本地化。
  6. 数据对账。 企业留存将9810出口申报与后续海外销售关联的记录，支撑税务与外汇结汇。

卖家使用9810的原因：

  • 本地化时效。 货物已在海外，配送2–5天，相较直邮的10–20天大幅提速。
  • 退货处理。 本地退货可存入海外仓重新上架，而非立即退回中国。
  • 税务与外汇处理。 该模式提供被认可的出口路径，可支撑出口退（免）税（如适用）及跨境电商外汇收款的结汇。

2025年零售进口清单更新

在进口侧，中国对适用跨境电商零售进口、享受简化海关与税收待遇（按个人物品式征收、受交易限值约束）的商品维持正面清单。2025年，零售进口增补清单新增28类商品，包括：

  • 智能家电
  • 健身器材
  • 环保建材

随扩围同步，个人年度限额维持2.6万元，且单次交易限值保持5000元。限额内商品按跨境电商零售进口税制征缴（通常优于一般贸易关税+增值税）；超限商品回归一般贸易处理。

对外国品牌的相关性：拓宽后的清单为更多消费品类经保税进口（1210模式）或直购进口（9610模式）零售渠道进入中国打开大门，且适用同一人均上限。新增类别（智能家电、健身、环保建材）的品牌获得了更清晰、低摩擦触达中国消费者的路径。

退货与再出口便利

跨境电商出口长期痛点之一是退货处理。在便利措施下，跨境电商出口退货可退回保税区（海关特殊监管区域/保税区），进行重新分拣后再出口。

机制如下：

  • 退回的9810（或9610）货物返华后，可进入保税区，而非被视为全新、全额征税的进口。
  • 在区内，货物可重新分拣、查验、重新包装或拼装，随后再出口，而无需经历一般贸易进口的完税前置。
  • 这使得在个别海外销售失败、被拒或因质量/尺码退货时，出口模式的成本效率得以保持。

对于运营海外仓的卖家，这意味着单件退货不会自动变为需在中国复进口时缴纳关税的死损；相反，它可经保税区循环，再发往其他市场。这显著改善了跨境退货的单位经济。

外国卖家的实务指南

  1. 先办标准贸易备案。 向海关完成进出口收发货人注册；无需单独9810备案。
  2. 择定综试区选址。 全国175个综试区，选取契合供应链者（沿海求出口速度，内陆求成本），利用其单一窗口集成。
  3. 建立海外仓数据联动。 维护准确的海外仓主数据，使9810申报与下游销售对账一致。
  4. 规划进口清单角度。 若同时向中国销售，核对2025年正面清单（已+28类）及2.6万元年度/5000元单笔限值。
  5. 善用保税退货。 将符合条件的退货导入保税区重新分拣再出口，而非全额进口。
  6. 关注创新指引。 商务部《综试区创新发展指引》预示便利将深化之处——海外仓网络、数字贸易与一体化物流。

来源

Related reading —

Cybersecurity / 网络安全

Cybersecurity & MLPS (等保) for FIEs

  • China operates a mandatory, tiered cybersecurity regime (MLPS + CII) that FIEs cannot opt out of; MLPS is the baseline obligation for virtually every network operator.
    中国实行强制、分层的网络安全制度（等保＋关键信息基础设施），外商投资企业无法退出；等保几乎适用于所有网络运营者，是合规底线。
  • MLPS 2.0 (GB/T 22239-2019, effective 1 December 2019) has five steps: grading, filing, remediation, graded assessment, and supervision.
    等保2.0（GB/T 22239-2019，2019年12月1日施行）含定级、备案、建设整改、等级测评、监督检查五步骤。
  • Systems are graded into five levels (L1–L5); most foreign commercial operations land at Level 2 or 3, with Level 3 requiring an annual assessment.
    系统分为五级（第一至第五级）；多数外资商业运营落在二级或三级，三级须每年测评。
  • CII operators (telecom, finance, energy, transport, etc.) must localize important data and personal information, pass a CAC cross-border security assessment, and meet duties beyond MLPS.
    关键信息基础设施运营者（电信、金融、能源、交通等）须境内存储重要数据和个人信息、通过网信办跨境安全评估，并承担对等保之外的额外义务。
  • The China subsidiary (not the overseas HQ) is normally the MLPS filing party; material changes such as new data types or M&A can reset the grading.
    备案主体通常为境内子公司（非境外总部）；新数据类型、并购等重大变更可重置系统定级。
  • Enforcement is active—non-compliance can block a product launch, trigger fines, and intersect with PIPL and the Data Security Law.
    执法真实且日趋活跃——不合规可阻断产品上线、招致罚款，并与《个人信息保护法》及《数据安全法》相交叠。

Cybersecurity & MLPS (等保) for FIEs | 网络安全与等保（外资适用）

Overview

China operates a tiered, legally mandated cybersecurity regime that foreign-invested enterprises (FIEs) cannot opt out of. Two concepts sit at its centre: the Multi-Level Protection Scheme (MLPS, 网络安全等级保护, often called “等保”) and Critical Information Infrastructure (CII, 关键信息基础设施). MLPS is the baseline obligation for virtually every network operator in China; CII is a higher, security-hardened subset applied to systems whose disruption would threaten national security, the economy, or public welfare. Both rest on the Cybersecurity Law (effective 1 June 2017) and are administered by the public-security authorities (MLPS) and the cyberspace regulator (CII identification).

This article explains how MLPS 2.0 works, what the five grading levels mean for an FIE, how CII is designated and what extra duties it triggers, and the practical steps a foreign company should take to stay compliant.

MLPS 2.0: the graded-protection baseline

MLPS 2.0 is the current generation of China’s graded cybersecurity protection system, anchored by the national standard GB/T 22239-2019 (“Baseline for Graded Cybersecurity Protection”), released in May 2019 and effective 1 December 2019. It replaced the 1.0 framework and expanded coverage from traditional IT systems to cloud computing, mobile internet, IoT, industrial control systems, and big data.

The scheme has five steps: (1) grading (定级) — the operator assesses the impact of a breach and assigns a level; (2) filing/registration (备案) — the grading is submitted to and recorded by the public-security bureau; (3) construction and remediation (建设整改) — the system is brought up to the standard’s technical and management controls; (4) graded assessment (等级测评) — an accredited third-party evaluator tests compliance; and (5) supervision and review (监督检查) — ongoing oversight by the public-security authority.

Under the Cybersecurity Law, network operators that fail to implement MLPS face rectification orders, fines, and — for serious cases — penalties against responsible individuals. For an FIE, MLPS compliance is typically a precondition for launching customer-facing systems, passing partner security reviews, and obtaining the data-export and licensing approvals described in related articles.

The five protection levels

MLPS divides systems into five levels by the harm that a breach would cause:

  • Level 1 (自主保护级): damage limited to the legitimate interests of citizens, legal persons, or other organizations, with no harm to the state, social order, or public interest. Often self-assessed.
  • Level 2 (指导保护级): serious damage to those interests, or harm to social order/public interest, but no harm to national security. Requires filing; generally assessed periodically (commonly every two years).
  • Level 3 (监督保护级): serious harm to social order/public interest, or harm to national security. The most common level for commercial systems of meaningful scale; requires filing and an annual graded assessment.
  • Level 4 (强制保护级): particularly serious harm to social order/public interest, or serious harm to national security — typical of core finance, energy, and transport systems; assessed at least every six months.
  • Level 5 (专控保护级): particularly serious harm to national security — state-controlled, rarely seen in the private sector.

Most foreign-invested commercial operations land at Level 2 or Level 3. A practical rule: if the system handles large numbers of users, payment data, or personal information, expect Level 3 and an annual assessment obligation.

Critical Information Infrastructure (CII)

Beyond MLPS, the Cybersecurity Law requires the state to identify Critical Information Infrastructure — networks and systems in key industries (telecom, energy, transport, water, finance, public services, e-government, and national defence) whose impairment or data leakage would cause serious harm to national security, the national economy, people’s livelihoods, or the public interest. CII is designated by the relevant industry regulator and coordinated by the CAC.

CII operators owe duties that go well beyond MLPS: they must (a) store important data and personal information collected/generated in China on domestic soil; (b) pass a CAC security assessment before any cross-border transfer (see the PIPL article); (c) conduct regular security testing and risk assessment; (d) engage only vendors and products that meet CII security requirements; and (e) comply with dedicated CII security-protection regulations (the State Council’s 2021 CII Security Protection Regulation). An FIE in a sensitive sector — a cloud operator, a payment institution, a large platform, or a utility-linked business — should assume it may be designated CII and plan accordingly.

Obligations and enforcement for foreign-invested enterprises

For an FIE, the key compliance actions are: confirm which Chinese entity owns each system (the in-China subsidiary, not the overseas parent, is usually the filing party); grade and file every internet-facing or data-bearing system with the local public-security bureau; remediate to GB/T 22239-2019; and commission an accredited assessor. Level 3+ systems need recurring annual assessments, and any material change (new data type, new region, M&A) can reset the grading.

Enforcement is real and increasingly active. Public-security authorities conduct spot checks, and regulators share findings across the MLPS–CII–data-export stack. Non-compliance can block a product launch, trigger fines, and — where personal information or important data is involved — intersect with PIPL and the Data Security Law. Foreign groups should treat MLPS as a continuing programme owned by a local accountable executive, not a one-time certificate.

What to do next

  • Inventory your systems in China and assign a business owner to each; the China subsidiary (not the HQ) is normally the MLPS filing party.
  • Grade every system honestly against GB/T 22239-2019; expect Level 2–3 for user-facing or data-bearing systems.
  • File and remediate with an accredited evaluator, and schedule the recurring assessment (annual for Level 3).
  • Assess CII exposure if you operate in telecom, finance, energy, transport, or platform services; prepare for domestic storage and CAC assessment.
  • Build a running compliance programme (policies, logs, drills) rather than a one-off audit, and coordinate with your PIPL and data-export obligations.

Sources

Related reading

  • see also: PIPL compliance for foreign companies — CII and threshold processors must localize and pass CAC assessment before export.
  • see also: Anti-monopoly & merger control filing — M&A can reset system grading and trigger new filings.
  • see also: VIE structures & regulatory trends — data-security review of offshore listings.

网络安全与等保（外资适用）

概述

中国建立了分层、法定的网络安全制度，外商投资企业（FIE）无法选择退出。其两大核心概念是网络安全等级保护制度（MLPS，”等保”）与关键信息基础设施（CII）。等保几乎适用于中国境内每一个网络运营者，是合规底线；关键信息基础设施则是在等保之上、针对一旦遭到破坏将危害国家安全、经济或公共利益的系统所施加的更高安全等级。二者均以《网络安全法》（2017 年 6 月 1 日施行）为依据，分别由公安机关（等保）与网信部门（CII 认定）主管。

本文说明等保 2.0 的运作方式、五个保护等级对外资企业的含义、CII 如何认定及其附加义务，以及外资企业落地合规的实务步骤。

等保 2.0：分级保护的底线

等保 2.0 是中国网络安全等级保护制度的现行版本，以国家标准 GB/T 22239-2019《信息安全技术 网络安全等级保护基本要求》 为锚点，该标准于 2019 年 5 月发布、2019 年 12 月 1 日施行，替代 1.0 框架，并将保护范围从传统信息系统扩展至云计算、移动互联、物联网、工业控制系统与大数据。

该制度包含五个步骤：（一）定级——运营者评估系统被破坏后的危害程度并划定等级；（二）备案——将定级结果报送公安机关登记；（三）建设整改——按标准的技术与管理要求补齐短板；（四）等级测评——由具备资质的第三方测评机构验证合规；（五）监督检查——公安机关持续监督。

依《网络安全法》，未落实等保的运营者将面临责令改正、罚款，严重者追究直接责任人员的责任。对外资企业而言，等保合规通常是上线面向用户系统、通过合作方安全审查、以及取得数据出境与许可审批（见相关文章）的前置条件。

五个保护等级

等保按系统被破坏后的危害程度分为五级：

  • 第一级（自主保护级）：对公民、法人或其他组织合法权益造成损害，但不损害国家、社会秩序或公共利益，通常自主定级。
  • 第二级（指导保护级）：对相关权益造成严重损害，或危害社会秩序、公共利益，但不危害国家安全；须备案，一般定期测评（常见每两年一次）。
  • 第三级（监督保护级）：严重危害社会秩序、公共利益，或危害国家安全；有相当规模的商业系统最常见，须备案并每年测评。
  • 第四级（强制保护级）：特别严重危害社会秩序、公共利益，或严重危害国家安全——多见于金融、能源、交通核心系统，至少每半年测评一次。
  • 第五级（专控保护级）：特别严重危害国家安全——国家专控，民企罕见。

多数外资商业运营落在二级或三级。实务经验：若系统处理大量用户、支付或个人信息，应预期为三级并承担年度测评义务。

关键信息基础设施（CII）

在等保之外，《网络安全法》第三十一条要求国家认定关键信息基础设施——电信、能源、交通、水利、金融、公共服务、电子政务、国防科技工业等重要行业和领域中，一旦遭到破坏、丧失功能或数据泄露，可能严重危害国家安全、国计民生、公共利益 networks and systems。CII 由相关行业主管部门认定、网信办统筹协调。

CII 运营者的义务远超等保：须（一）将在境内收集、产生的重要数据和个人信息存储在境内；（二）任何跨境提供前通过网信办安全评估（见 PIPL 文章）；（三）定期开展安全检测与风险评估；（四）仅采购满足 CII 安全要求的产品与服务；（五）遵守专门的 CII 安全保护法规（2021 年国务院《关键信息基础设施安全保护条例》）。处于敏感行业的外资企业——云服务商、支付机构、大型平台、与公用设施关联的业务——应假设自身可能被认定为 CII 并提前规划。

外资企业的义务与执法

对外资企业，关键合规动作包括：确认各系统的中国境内责任主体（通常是境内子公司，而非境外母公司，作为备案主体）；就每个面向互联网或承载数据的系统向当地公安机关定级备案；按 GB/T 22239-2019 整改；并委托具备资质的测评机构测评。三级及以上系统须持续年度测评，任何重大变更（新数据类型、新区域、并购）都可能重置定级。

执法真实且日趋活跃。公安机关开展抽查，监管发现会在等保—CII—数据出境体系间共享。不合规可能阻断产品上线、招致罚款，并在涉及个人信息或重要数据时与 PIPL、《数据安全法》相交叠。外资集团应将等保视为由本地问责高管持续负责的常设项目，而非一次性证书。

下一步建议

  • 盘点中国境内系统并为每个系统指定业务责任人；备案主体通常为境内子公司（非总部）。
  • 对照 GB/T 22239-2019 如实定级；面向用户或承载数据的系统应预期二级至三级。
  • 备案与整改并委托具备资质的测评机构，安排周期性测评（三级每年一次）。
  • 评估 CII 暴露面：若经营电信、金融、能源、交通或平台业务，须为境内存储与网信办评估做准备。
  • 建立常态化合规项目（制度、日志、演练）而非一次性审计，并与 PIPL 和数据出境义务统筹。

来源

相关阅读

  • 参见：外资企业的个人信息保护法合规 — CII 与达到阈值处理者须境内存储并通过网信办评估方可出境。
  • 参见：反垄断与经营者集中申报 — 并购可能重置系统定级并触发新备案。
  • 参见：VIE 架构与监管趋势 — 境外上市的数据安全审查。
Cybersecurity / 网络安全

Cybersecurity Review in China 2026: New Scrutiny for Foreign Security Vendors

  • On 6 August 2026 the Cybersecurity Review Office (under the Cyberspace Administration of China) announced a network-security review of products sold by Palo Alto Networks in China, citing protection of critical information infrastructure.
    2026年8月6日，国家网络安全审查办公室公告，依据《国家安全法》《网络安全法》和《网络安全审查办法》，对派拓公司（Palo Alto Networks）在华销售的产品实施网络安全审查。
  • The review signals heightened scrutiny of foreign cybersecurity vendors whose products plug into China’s critical information infrastructure (CII).
    该审查释放出对深度接入中国关键信息基础设施（CII）的外国网络安全厂商审查趋严的信号。
  • Under the Cybersecurity Review Measures, suppliers of network products and services to CII operators are subject to review; a completed review can lead to procurement restrictions for affected products.
    依据《网络安全审查办法》，向关键信息基础设施运营者提供网络产品和服务的供应商须接受审查；审查结论可导致相关产品采购受限。
  • China’s 2026 measures on cybersecurity and data governance — including the draft rules for large personal-information processors published on 7 August 2026 — continue to raise the compliance bar for foreign technology firms.
    中国2026年的网络安全与数据治理措施——包括2026年8月7日公布的《大型个人信息处理者个人信息保护规定（征求意见稿）》——持续提高外资科技企业的合规门槛。
  • The review comes amid a broader set of reciprocal measures, including export-control adjustments on drones and countermeasures against US entities announced by MOFCOM on 5 August 2026.
    该审查发生在更广泛的对等措施背景下，包括商务部2026年8月5日公布的无人机出口管制调整与针对美国实体的反制措施。
  • For foreign vendors, the practical implication is to design China offerings with review-readiness: data localisation, source-code and architecture transparency, and CII supply-chain documentation.
    对外国厂商而言，实际含义是在设计中国产品时就具备审查就绪性：数据本地化、源代码与架构透明度、以及CII供应链文档。

Cybersecurity Review in China 2026: New Scrutiny for Foreign Security Vendors | 中国2026年网络安全审查：外国安全厂商的新一轮审视

Why this matters now

On 6 August 2026, China’s Cybersecurity Review Office announced a network-security review of products that Palo Alto Networks sells in China. The announcement, published on the Cyberspace Administration of China (CAC) website, invokes the National Security Law, the Cybersecurity Law and the Cybersecurity Review Measures, and states the purpose as protecting critical information infrastructure and guarding against network-security risks. For foreign technology companies — especially cybersecurity vendors, cloud providers and equipment makers whose products sit inside Chinese enterprises’ networks — the review is a concrete reminder that China’s security review regime is an active, operational gate, not a dormant provision.

The review framework at work

The Cybersecurity Review Measures (effective 15 February 2022) establish the legal basis for reviewing network products and services that operators of critical information infrastructure (CII) intend to purchase, or that could affect national security. A review focuses on risks to the security and stable operation of CII; risks of illegal data collection, retention, use, processing and export; risks of products or services being illegally controlled or interrupted; and risks to supply-chain security. Where a review is opened, the outcome can range from conditions attached to procurement to prohibitions on use. The Palo Alto review sits in this framework: a foreign security vendor whose products are deployed in networks that may include CII must now demonstrate that its offering does not create unacceptable risks. For vendors, the review process itself demands cooperation — providing information, materials, technical documents and access for assessment — and non-cooperation can itself lead to a negative conclusion.

The broader 2026 context

The announcement is not isolated. On 7 August 2026, CAC published the draft Provisions on the Protection of Personal Information by Large Personal Information Processors, consolidating two earlier drafts, with a comment deadline of 7 September 2026. The draft extends obligations to processors handling personal information of 10 million or more individuals, deepening the regime that foreign platforms and data-heavy businesses must already navigate. On 5 August 2026, MOFCOM announced tightened export controls on drones and drone-related dual-use items to the United States (Announcement No. 34 of 2026), along with countermeasures against several US entities (Order No. 2 and Order No. 3 of 2026). Taken together, the sequence shows a government that is simultaneously building out its cybersecurity gate, its data-governance rulebook and its reciprocal-trade toolkit — all of which foreign technology firms must treat as a single, connected compliance environment.

Practical steps for foreign technology vendors

  1. Assess CII exposure. Determine whether your products or services are used by operators of critical information infrastructure in China; if so, map which products fall within review scope.
  2. Prepare review documentation. Assemble security designs, source-code access arrangements, data-flow maps, third-party component lists and supply-chain documentation in a review-ready format.
  3. Review data practices. Confirm that products deployed in China comply with personal-information protection and data-export rules, including the emerging large-processor obligations for relevant businesses.
  4. Structure local presence. Where possible, align with data localisation expectations and consider whether a local entity, local storage and local support improve the review posture.
  5. Monitor the political risk layer. Because security reviews can interact with broader reciprocity measures, maintain a watch on MOFCOM export-control and countermeasure announcements that may affect your group.
  6. Build in response discipline. If a review opens, cooperate within statutory timeframes, keep internal records consistent, and engage counsel familiar with the Cybersecurity Review Measures.

Risks and compliance notes

The highest risk for a foreign vendor is complacency: assuming that a sale to a Chinese enterprise is “just a commercial deal” when the product’s deployment may trigger review. Sales into government, finance, energy, transportation and telecom networks — classic CII sectors — deserve the most scrutiny. Also note that the review regime is evolving quickly; the large-processor draft shows that obligations can expand to new categories of actors. Finally, the interconnection with export controls and countermeasures means a vendor’s Chinese business can be affected by measures aimed at its home country; global compliance teams should model those scenarios. None of this argues against the Chinese market — it argues for entering it with the same security-review maturity that the market now expects.

中国2026年网络安全审查：外国安全厂商的新一轮审视

为什么当下重要

2026年8月6日，国家网络安全审查办公室宣布对派拓公司（Palo Alto Networks）在华销售的产品实施网络安全审查。公告发布于中央网信办（国家互联网信息办公室）官网，援引《国家安全法》《网络安全法》和《网络安全审查办法》，目的表述为保障关键信息基础设施安全稳定运行、防范网络安全风险隐患。对外资科技企业——尤其是产品部署在中国企业网络内部的安全厂商、云服务商与设备制造商——这次审查是一个具体提醒：中国的安全审查制度是一道活跃、运转中的闸门，而非沉睡的条款。

运行中的审查框架

《网络安全审查办法》（2022年2月15日施行）为审查关键信息基础设施（CII）运营者拟采购、或可能影响国家安全的网络产品与服务确立了法律依据。审查聚焦以下风险：关键信息基础设施安全稳定运行；非法收集、存储、使用、加工、传输、提供、公开、删除个人信息与重要数据；产品服务被非法控制或干扰；以及供应链安全。一旦启动审查，结论可能从附加采购条件到禁止使用。派拓审查正处在此框架中：产品可能部署于包含CII的网络中的外国安全厂商，现在必须证明其产品不会产生不可接受的风险。对厂商而言，审查过程本身要求配合——提供信息、材料、技术文档并接受评估——不配合本身即可导致不利结论。

2026年更宏观的背景

该公告并非孤立事件。2026年8月7日，国家网信办公布《大型个人信息处理者个人信息保护规定（征求意见稿）》，整合两份早前草案，意见反馈截止2026年9月7日。草案将义务扩展到处理1000万人以上个人信息的处理者，深化了外资平台与数据密集型企业本已必须应对的监管体系。2026年8月5日，商务部公布加强对美国无人机及无人机相关两用物项出口管制（2026年第34号公告），并对多家美国实体采取反制措施（2026年第2号、第3号令）。综合来看，这一系列动作显示政府正同步构建网络安全闸门、数据治理规则与对等贸易工具箱——外资科技企业必须将三者视为一个相互联通的整体合规环境。

外资科技厂商的操作步骤

  1. 评估CII敞口。 确定产品或服务是否被中国关键信息基础设施运营者使用；如是，梳理哪些产品落入审查范围。
  2. 准备审查文档。 以审查就绪格式汇编安全设计、源代码访问安排、数据流图、第三方组件清单与供应链文档。
  3. 复核数据实践。 确认部署于中国的产品符合个人信息保护与数据出境规则，包括相关业务将面对的新兴大型处理者义务。
  4. 构建本地存在。 在可行处与数据本地化预期对齐，评估本地实体、本地存储与本地支持是否改善审查姿态。
  5. 盯住政治风险层。 由于安全审查可能与更广泛的对等措施相互作用，持续关注可能影响集团的商务部出口管制与反制公告。
  6. 建立应对纪律。 一旦启动审查，在法定期限内配合、保持内部记录一致，并聘请熟悉《网络安全审查办法》的法律顾问。

风险与合规提示

外国厂商最大的风险是自满：当产品部署可能触发审查时，却把对中资企业的销售仅当作”一桩商业交易”。政府、金融、能源、交通与电信网络——典型的CII领域——的销售最值得审慎对待。还需注意，审查制度正在快速演进；大型处理者草案表明义务可以扩展到新的主体类别。最后，与出口管制和反制措施的相互关联意味着，厂商的中国业务可能受到针对其母国措施的影响；全球合规团队应建模这些情景。这些都不构成回避中国市场的理由——而是提示要以市场现在所期望的同样的安全审查成熟度进入这个市场。

Sources

  • 中央网信办官网《国家互联网信息办公室关于〈大型个人信息处理者个人信息保护规定（征求意见稿）〉公开征求意见的通知》（2026-08-07，意见反馈截止2026-09-07）：https://www.cac.gov.cn/2026-08/07/c_1787851071612596.htm
  • 国家网络安全审查办公室2026-08-06公告：对派拓公司（Palo Alto Networks）在华销售的产品实施网络安全审查（据清华国际金融与经济研究中心2026年中美贸易争端大事记引述原文链接）：https://cifer.pbcsf.tsinghua.edu.cn/info/1136/3737.htm
  • 商务部《政策》栏目：商务部公告2026年第34号 公布加强无人机相关两用物项对美国出口管制（2026-08-05）；商务部令二〇二六年第2号、第3号 反制决定（2026-08-05）：https://www.mofcom.gov.cn/zcfb/index.html
  • 商务部官网《政务公开》：商务部公告2026年第33号 对进口打印复印办公设备发起对外贸易国家安全立案调查（2026-08-05，与网络安全审查同批对等动向）：https://www.mofcom.gov.cn/zwgk/index.html
Cybersecurity / 网络安全

China’s Draft Rule for Large Personal-Information Processors: What Foreign-Invested Platforms and Apps Need to Know

  • China’s cyberspace regulator has released a draft rule for “large personal-information processors,” consolidating two earlier platform-focused drafts into one accountability regime for the biggest data holders.
    国家网信部门发布《大型个人信息处理者个人信息保护规定（征求意见稿）》，将早前两份聚焦平台的规定整合为面向最大规模数据处理者的统一责任制度。
  • A processor handling over 10 million individuals’ personal information, or meeting other significance tests, must self-assess and file a recognition application through its provincial cyberspace authority.
    处理超过1000万人个人信息的处理者，或符合其他重大影响标准的，须自评估并通过省级网信部门申报大型个人信息处理者认定。
  • Core duties include data minimisation, encryption, de-identification, access control, minor-protection safeguards and use of the national online identity authentication public service.
    核心义务涵盖最小必要、加密、去标识化、访问控制、未成年人保护，以及应用国家网络身份认证公共服务。
  • The consultation closes on 7 September 2026, giving foreign-invested platforms and apps a clear compliance horizon to assess exposure.
    征求意见截至2026年9月7日，为外资平台与App提供了评估合规敞口的明确窗口。
  • The draft sits atop the Personal Information Protection Law and the Network Data Security Management Regulation, signalling converging oversight of super-platforms.
    征求意见稿置于《个人信息保护法》与《网络数据安全管理条例》之上，预示着对超级平台的趋同监管。
  • Practical step: map data-volume and business-footprint triggers now, and pre-position a recognition filing before the threshold is crossed.
    实操建议：立即对照数据量与业务足迹触发条件制图，并在越过门槛前预先准备认定申报。

China’s Draft Rule for Large Personal-Information Processors: What Foreign-Invested Platforms and Apps Need to Know | 大型个人信息处理者规定征求意见：外资平台与App须知

On 7 August 2026, the Cyberspace Administration of China (CAC) published the *Draft Provisions on the Personal Information Protection of Large Personal-Information Processors (for public comment)*. The draft consolidates two earlier consultation documents — the rules on establishing personal-information protection supervisory committees for large online platforms and the rules on large online platforms’ personal-information protection — into a single, broader regime that reaches any “large personal-information processor,” not only classic internet platforms.

For foreign-invested businesses operating consumer apps, e-commerce storefronts, ride-hailing or delivery services, social products, or any service that scales to millions of Chinese users, the draft is a material compliance event. This article explains who is captured, what changes, and the practical steps to take during the consultation window.

Who is a “large processor”

The draft applies a multi-factor test rather than a single mechanical threshold. Under Article 2, a “large personal-information processor” is a processor whose personal-information protection and supervision are subject to the provisions. Recognition is triggered when any of the following conditions is met:

  1. Scale: the processor handles the personal information of more than 10 million natural persons.
  2. Importance of service: it provides important online services involving personal-information processing, or its business scope covers multiple lines of business that involve personal-information processing.
  3. Impact: its personal-information processing activities have an important influence on national security, economic operation, social stability, public health and safety, or similar interests.

Article 3 obliges processors that handle more than 10 million individuals’ data, and those that self-assess into the second or third condition, to file a recognition application through the provincial cyberspace authority to the national cyberspace authority. Provincial authorities must complete a completeness check within 15 working days of receiving the materials; if complete, they forward the materials and a preliminary opinion to the national authority. Authorities may also urge a processor that meets the conditions but has not filed to do so.

Key compliance duties

The draft imposes obligations that go well beyond the baseline PIPL duties:

  • Data minimisation. Collection must be limited to what is necessary to provide the product or service; over-collection is prohibited.
  • Technical and organisational safeguards. Processors should adopt encryption, de-identification, access control and anonymisation, may apply the national data-label/identification technology, and are encouraged to obtain personal-information protection certification.
  • Minor protection. Processing personal information of minors under 14 requires the consent of a parent or guardian, and convenient channels must be provided for giving and withdrawing that consent.
  • National identity service. Processors are encouraged to use the national online identity authentication public service.
  • Monitoring and response. Processors must build internal management systems and operating procedures covering processing activities, rights-response and security obligations, strengthen monitoring and early warning of personal-information security, and detect and dispose of security incidents in a timely manner.
  • International engagement. The draft encourages large processors to participate in international standards and rule-making on personal-information protection and to promote mutual recognition of rules and standards with other countries and regions.

Consultation timeline and process

The CAC notice sets the comment deadline at 7 September 2026. Feedback may be submitted by email to shujuju@cac.gov.cn or by post to the Cyberspace Administration of China’s Network Data Administration Bureau in Beijing, with the envelope marked “大型个人信息处理者个人信息保护规定征求意见.” Because the draft is still at the consultation stage, the final obligations, recognition form and timetable may shift — but the direction is clear: accountability for the largest data holders is being formalised.

Practical steps for foreign-invested platforms

  1. Size the footprint. Quantify the number of natural persons whose personal information you process in China; if you are near or above 10 million, assume you are in scope.
  2. Assess the qualitative triggers. Even below 10 million, multi-line consumer businesses with systemic reach should self-assess the “importance” and “impact” prongs.
  3. Pre-position the filing. Prepare the recognition application materials (data-scale evidence, processing-activity description, safeguard design) so a filing can be lodged promptly if triggered.
  4. Harden the baseline. Encrypt and de-identify at rest and in transit, restrict access on least-privilege, and stand up a minor-consent workflow.
  5. Engage the consultation. Where group policy allows, submit comments through the recognised industry association channel before 7 September 2026.

大型个人信息处理者规定征求意见：外资平台与App须知

2026年8月7日，国家互联网信息办公室发布《大型个人信息处理者个人信息保护规定（征求意见稿）》。该稿将早前两份文件——关于大型网络平台设立个人信息保护监督委员会的规定、以及关于大型网络平台个人信息保护的规定——整合为一项覆盖任何”大型个人信息处理者”、而非仅限传统互联网平台的统一制度。

对于运营消费类App、电商店面、网约车或配送服务、社交产品，或任何在中国拥有数百万用户规模的外商投资企业而言，该征求意见稿是一项重要的合规事件。本文说明谁被纳入、有何变化，以及在征求意见窗口期应采取的实操步骤。

何为”大型个人信息处理者”

该稿采用的是多因素测试，而非单一机械门槛。根据第二条，大型个人信息处理者的个人信息保护及其监督管理适用本规定。符合下列条件之一的，应认定属于大型个人信息处理者：

  1. 规模： 处理1000万人以上自然人个人信息。
  2. 服务重要性： 提供涉及个人信息处理的重要网络服务，或者经营范围涵盖多种业务且涉及个人信息处理。
  3. 影响： 个人信息处理活动对国家安全、经济运行、社会稳定、公共健康和安全等具有重要影响。

第三条规定，处理1000万人以上自然人个人信息，以及自评估认为符合第二条第二款第二、三项条件的处理者，应当通过所在地省级网信部门向国家网信部门申报大型个人信息处理者认定并按要求提交材料。省级网信部门应自收到申报材料之日起15个工作日内完成完备性查验；材料齐全的，将材料与初步认定意见报送国家网信部门。省级以上网信、电信主管部门、公安机关等部门认为符合认定条件但未主动申报的，应督促其申报。

核心合规义务

该稿施加了超出《个人信息保护法》基线的义务：

  • 最小必要。 收集个人信息应限于提供产品或者服务所必需，不得过度收集。
  • 技术与组织保障。 采取加密、去标识化、访问控制、匿名化等措施；可应用国家数据标签标识技术；鼓励通过个人信息保护认证。
  • 未成年人保护。 处理不满十四周岁未成年人个人信息应取得监护人同意，并提供便捷的同意与撤回渠道。
  • 国家身份服务。 鼓励应用国家网络身份认证公共服务。
  • 监测与响应。 围绕处理活动、权利响应、安全义务建立健全内部管理制度与操作规程，加强监测预警，及时发现处置安全事件。
  • 国际参与。 鼓励参与个人信息保护国际标准和规则制定，推动与其他国家、地区规则标准协调互认。

征求意见时间与程序

网信办通知设定意见反馈截止时间为2026年9月7日。可通过电子邮件发送至 shujuju@cac.gov.cn，或邮寄至北京市海淀区阜成路15号国家互联网信息办公室网络数据管理局（信封注明”大型个人信息处理者个人信息保护规定征求意见”）。该稿尚处征求意见阶段，最终义务、认定表单与时间表可能调整，但方向明确：最大数据持有者的责任正在制度化。

外资平台实操步骤

  1. 测算足迹。 量化在华处理的自然人个人信息数量；若接近或高于1000万，应假定自身落入范围。
  2. 评估定性触发条件。 即便低于1000万，具有系统性触达的多线消费业务也应自评估”重要性”与”影响”两项。
  3. 预先准备申报。 备妥认定申报材料（数据规模证据、处理活动说明、保障措施设计），以便在触发时及时提交。
  4. 夯实基线。 对静态与传输中数据加密、去标识化，按最小权限限制访问，并建立未成年人同意工作流。
  5. 参与征求意见。 在集团政策允许范围内，于2026年9月7日前通过认可的行业协会议事渠道提交意见。

Practitioner Quick Reference

  • One regime, broader reach: the draft folds two platform rules into a single “large processor” regime covering 10M+ individuals or systemic-impact handlers.
    一项制度、更广覆盖：该稿将两份平台规则整合为覆盖1000万以上或具系统影响处理者的”大型处理者”制度。
  • File through the province: recognition applications go via the provincial cyberspace authority to the national CAC; completeness check is 15 working days.
    经省级申报：认定申请由省级网信部门报送国家网信办；完备性查验为15个工作日。
  • Deadline 7 September 2026: the consultation window is the time to assess and, if eligible, comment.
    截止2026年9月7日：征求意见窗口是评估并（如符合）提交意见的时机。
  • Baseline must rise: minimisation, encryption, de-identification, access control and minor-consent are explicit duties.
    基线须抬高：最小必要、加密、去标识化、访问控制与未成年人同意均为明示义务。

Common Pitfalls

  • Assuming “platform” only means social media: the test reaches any processor at 10M individuals or with systemic impact, including e-commerce and on-demand apps.
    误以为”平台”仅指社交媒体：测试覆盖任意达1000万或具系统影响的处理者，含电商与按需服务App。
  • Waiting for the final text: the recognition filing and safeguard build-out take months; starting during consultation is cheaper than scrambling after promulgation.
    等待终稿：认定申报与保障体系建设需数月；在征求意见期启动比颁布后仓促应对更划算。
  • Treating PIPL compliance as sufficient: the draft adds duties (minimisation, national identity service, minor workflows) beyond the PIPL baseline.
    以为符合个保法即足够：该稿新增了超出个保法基线的义务（最小必要、国家身份服务、未成年人流程）。

Sources

Cybersecurity / 网络安全

Cybersecurity Review and Critical Information Infrastructure Procurement Compliance for Foreign-Invested Enterprises

  • The Cybersecurity Review regime applies whenever a Critical Information Infrastructure (CII) operator procures network products or services that may affect national security — and foreign-invested enterprises supplying those products are squarely within scope.
    当关键信息基础设施（CII）运营者采购可能影响国家安全的网络产品与服务时，网络安全审查制度即被触发；向这些运营者供应产品的外商投资企业同样被直接纳入监管视野。
  • The legal backbone is the Cybersecurity Law (2017), the Regulation on CII Protection (State Council Decree No. 745, 2021) and the Cybersecurity Review Measures (CAC Decree No. 8, 2022), now reinforced by active enforcement against foreign-made security products in 2026.
    制度主干为《网络安全法》（2017）、《关键信息基础设施安全保护条例》（国务院令745号，2021）与《网络安全审查办法》（国家网信办等13部门令第8号，2022），并在2026年针对境外安全产品的执法中持续强化。
  • CII operators must “prioritise the procurement of secure and trustworthy” products and submit to security review before signing; using unreviewed or failed products triggers fines of 1–10 times the procurement value.
    CII运营者须”优先采购安全可信的网络产品”，并在签约前申报审查；使用未申报或审查未通过的产品，将面临采购金额一倍以上十倍以下的罚款。
  • A supplier need not be a CII operator itself — providing products or services to a CII operator can independently trigger a review, as the August 2026 review of a US network-security vendor’s China-sold products illustrates.
    供应商本身不必是CII运营者——仅为CII运营者提供产品即可能单独触发审查，2026年8月对某美国网络安全厂商在华销售产品的审查即为例证。
  • Foreign-invested enterprises should embed review-trigger analysis into procurement playbooks, vendor due diligence and contract clauses, and retain evidence of supplier commitments not to extract user data or interrupt supply.
    外商投资企业应将”审查触发”分析嵌入采购流程、供应商尽调与合同条款，并留存供应商”不非法获取用户数据、不中断供应”的承诺证据。
  • The review is risk-based and time-bound (generally 30 + 15 working days, with a special procedure extending to about 90), and explicitly states it is not intended to restrict or discriminate against foreign products and services.
    审查以风险为本且有明确时限（一般30+15个工作日，特别审查最长约90个工作日），并明确规定其目的不是限制或歧视国外产品与服务。

Cybersecurity Review and Critical Information Infrastructure Procurement Compliance for Foreign-Invested Enterprises | 网络安全审查与关键信息基础设施采购合规：外商投资企业的实务指南

Why this matters now

For a foreign-invested enterprise (FIE) selling network equipment, cloud services, security software or industrial control components into the China market, the question is no longer whether cybersecurity rules apply, but *when a procurement crosses the line into a national-security review*. China’s cybersecurity framework has matured from a set of principles into an operational, enforcement-driven regime. The clearest recent signal came on 6 August 2026, when the Cybersecurity Review Office announced a review of products sold in China by a US network-security vendor — the second time, after the 2023 review of a US memory-chip maker, that the measure was applied to specific foreign-made products rather than to entities. For FIEs on either side of a CII procurement — as the operator, the supplier, or both — the compliance calculus has sharpened.

This article explains the statutory triggers, the three pillars of the legal framework, what the review actually assesses, the 2026 enforcement signal, and the concrete steps an FIE should take. It does not address the separate (though related) regimes of data-export security assessment, standard contracts and certification, which are covered elsewhere on this site.

The statutory trigger: who and when

The trigger is defined in Article 2 of the Cybersecurity Review Measures: a CII operator procuring network products and services, or a platform operator conducting data-processing activities, that *may affect or may affect* national security must undergo cybersecurity review. The wording is deliberately forward-looking — the operator must pre-assess the risk before signing and file for review where the risk exists.

Two points matter for foreign suppliers in particular. First, the obligation to file sits with the CII operator (the buyer), not the supplier. Second, and often overlooked, a supplier can be pulled into a review even when it is not itself a CII operator: providing products or services *to* a CII operator is exactly the scenario the 2026 review targeted. The Measures (Article 21) also state that where foreign-investment security review or data-security review have separate rules, those apply alongside.

CII itself is defined broadly in the Regulation on CII Protection: public communications and information services, energy, transport, water conservancy, finance, public services, e-government, defence science and industry, and other networks/systems whose disruption or data breach would seriously endanger national security, the public interest or social stability. Telecom, finance, energy, transport, healthcare and government IT are the obvious sectors — precisely the sectors where foreign technology is most often deployed.

The three pillars of the legal framework

Pillar one — the Cybersecurity Law (adopted 2016, effective 2017). Article 35 imposes the core duty: a CII operator procuring network products and services that may affect national security shall pass the security review organised by the cyberspace authority and relevant departments. Article 37 separately restricts CII operators from storing personal information and important data overseas or providing it abroad without assessment.

Pillar two — the Regulation on CII Protection (State Council Decree No. 745, effective 1 September 2021). This fills in the duty-holder detail: operators must build a dedicated security-management organ, conduct at least one security testing and risk assessment per year, and — critically for procurement — “prioritise the procurement of secure and trustworthy network products and services” and put any potentially security-affecting procurement through the national cybersecurity review. Article 19 makes this a positive legal obligation, not mere guidance.

Pillar three — the Cybersecurity Review Measures (CAC Decree No. 8, effective 15 February 2022). Thirteen departments jointly issued the Measures, which specify the review objects (core network devices, important communications products, high-performance computers and servers, large-capacity storage, large databases and application software, network-security devices, cloud-computing services, and other products/services materially affecting CII, network and data security). They set the 45-working-day baseline (30 + 15, with a special procedure of about 90 working days) and the penalty ladder.

What the review assesses

Article 10 of the Measures lists the national-security risk factors the review weighs:

  • the risk that products/services, once in use, lead to illegal control of, interference with or destruction of CII;
  • the risk that supply interruption harms the business continuity of CII;
  • the security, openness, transparency and source diversity of the product/service, and the risk of supply interruption for political, diplomatic or trade reasons;
  • the provider’s compliance with Chinese laws, administrative regulations and departmental rules;
  • the risk of core data, important data or large volumes of personal information being stolen, leaked, destroyed, illegally used or illegally exported;
  • for listings abroad, the risk that CII, core data, important data or large volumes of personal information fall under foreign-government influence or control; and
  • other factors endangering CII, network and data security.

For a foreign supplier, the most relevant factors are supply-chain continuity, transparency of the product’s architecture, and — increasingly — whether the product could become a vector for data extraction or remote control. The 2026 enforcement action against a foreign security vendor centred precisely on the paradox that a security product can itself become a security risk if compromised or externally controlled.

The 2026 enforcement signal

On 6 August 2026 the Cybersecurity Review Office announced a review, under the Cybersecurity Law and the Measures, of products sold in China by a US network-security company, citing the need to safeguard CII and prevent cybersecurity risks. Chinese regulators had, earlier in 2026, directed domestic institutions to stop using certain US and Israeli security products and to complete migration to domestic alternatives within the first half of the year. The pattern is consistent: reviews now target *products* (not just entities), focus on CII supply-chain security, and operate alongside a broader “secure and trustworthy” procurement preference in sensitive sectors.

The practical takeaway for FIEs is not panic but preparation. The Measures explicitly state the review is “not intended to restrict or discriminate against foreign products and services,” and China continues to welcome foreign products into its market. The differentiator is demonstrable supply-chain resilience, source transparency and contractual commitments.

Practical compliance steps for FIEs

  1. Map your exposure. Identify whether your customers include CII operators or platform operators handling large-scale personal information. If so, your products are in the review’s line of sight even when you are not the filer.
  2. Build review-trigger analysis into the sales cycle. Equip local teams to recognise when a customer’s procurement will require a filing, and pre-empt delays by surfacing the issue early.
  3. Harden the supplier commitments. The Measures let CII operators require providers to promise not to illegally obtain user data, not to illegally control or manipulate user equipment, and not to interrupt supply without just cause. Put these in writing and be able to evidence them.
  4. Localise where it reduces risk. Source diversity, in-country support, transparent architecture and local data handling are exactly the factors the review rewards. A wholly import-dependent supply chain is the weakest posture.
  5. Keep contracts review-aware. Where a contract is signed before review, include a condition that it takes effect only after the product passes review, to avoid the “use unreviewed product” penalty of 1–10 times procurement value.
  6. Coordinate with the FIE’s data-export posture. Cybersecurity review overlaps with data-export security assessment and PIPL compliance; treat them as one programme rather than three silos.

Related reading

  • Critical information infrastructure recognition and the annual self-assessment obligation.
  • Data-export pathways: security assessment, standard contract and certification compared.
  • PIPL compliance for foreign-invested enterprises operating in China.

网络安全审查与关键信息基础设施采购合规：外商投资企业的实务指南

为何重要

对于向中国市销售网络设备、云服务、安全软件或工业控制部件的外商投资企业（FIE）而言，问题已不再是”网络安全规则是否适用”，而是”一项采购何时越过红线、进入国家安全审查”。中国的网络安全框架已从原则性规定，发展为可操作、强执法的制度体系。最清晰的近期信号出现在2026年8月6日——网络安全审查办公室宣布对某美国网络安全厂商在华销售产品启动审查，这是继2023年对某美国存储芯片企业之后，第二次将审查直接指向特定境外制造的产品而非实体。无论外商投资企业处于CII采购的哪一端——作为运营者、供应商或兼而有之——合规逻辑都已显著收紧。

本文阐释法定触发条件、法律框架的三大支柱、审查究竟评估什么、2026年的执法信号，以及外商投资企业应采取的具体步骤。数据出境安全评估、标准合同与认证等相对独立（但相关）的制度，不在本文讨论范围，本站点另有专文。

法定触发：谁、何时

触发条件规定于《网络安全审查办法》第二条：关键信息基础设施运营者采购网络产品与服务，或网络平台运营者开展可能影响国家安全的数据处理活动，应当进行网络安全审查。措辞具有前瞻性——运营者须在签约前预判风险，并在风险存在时申报审查。

有两点对外国供应商尤为重要。其一，申报义务落在CII运营者（买方）身上，而非供应商。其二（也最常被忽视）：供应商即便自身不是CII运营者，也可能被卷入审查——仅为CII运营者提供产品，正是2026年审查所针对的情形。《办法》第二十一条还规定，外商投资安全审查、数据安全审查另有规定的，应一并适用。

CII的定义见于《关键信息基础设施安全保护条例》，范围宽泛：公共通信和信息服务、能源、交通、水利、金融、公共服务、电子政务、国防科技工业，以及其他一旦遭到破坏、丧失功能或数据泄露可能严重危害国家安全、公共利益或社会稳定的网络设施与信息系统。电信、金融、能源、交通、医疗与政府IT是最典型的行业——也正是外国技术最常部署的领域。

法律框架的三大支柱

支柱一——《网络安全法》（2016通过，2017施行）。 第三十五条规定核心义务：CII运营者采购可能影响国家安全的网络产品与服务，应当通过国家网信部门会同有关部门组织的国家安全审查。第三十七条另限制CII运营者未经评估不得将个人信息与重要数据境外存储或提供境外。

支柱二——《关键信息基础设施安全保护条例》（国务院令745号，2021年9月1日施行）。 细化义务主体：运营者须设立专门安全管理机构、每年至少开展一次网络安全检测与风险评估，且——对采购尤为关键——”优先采购安全可信的网络产品”，并将任何可能影响安全的采购纳入国家网络安全审查。第十九条将其确立为积极的法定义务，而非软性指引。

支柱三——《网络安全审查办法》（国家网信办等13部门令第8号，2022年2月15日施行）。 该办法明确审查对象（核心网络设备、重要通信产品、高性能计算机与服务器、大容量存储设备、大型数据库与应用软件、网络安全设备、云计算服务，以及对CII、网络与数据安全有重要影响的其他产品服务），设定45个工作日的基准时限（30+15，特别审查约90个工作日），并规定罚则梯度。

审查评估什么

《办法》第十条列举审查权衡的国家安全风险因素：

  • 产品服务投入使用后导致CII被非法控制、干扰或破坏的风险；
  • 供应中断损害CII业务连续性的风险；
  • 产品服务的安全性、开放性、透明性、来源多样性，以及因政治、外交、贸易因素导致供应中断的风险；
  • 提供者遵守中国法律、行政法规与部门规章的情况；
  • 核心数据、重要数据或大量个人信息被窃取、泄露、毁损、非法利用或非法出境的风险；
  • 赴国外上市情形下，CII、核心数据、重要数据或大量个人信息受外国政府影响或控制的风险；
  • 其他危害CII、网络与数据安全的因素。

对外国供应商而言，最相关的因素依次是供应链连续性、产品架构的透明度，以及——日益重要——产品是否会成为数据提取或远程控制的载体。2026年对某外国安全厂商的执法，恰恰聚焦于”安全产品本身可能因其被控制或存在后门而转化为安全风险”这一悖论。

2026年的执法信号

2026年8月6日，网络安全审查办公室依据《网络安全法》与《办法》，宣布对某美国网络安全公司在华销售产品启动审查，理由为保障CII安全、防范网络安全风险。在此之前的2026年内，中国监管部门已要求境内机构停止使用该厂商等部分美国、以色列安全产品，并在上半年内完成向国产替代的迁移。脉络一致：审查如今指向*产品*（而非仅实体），聚焦CII供应链安全，并与敏感行业”安全可信”采购偏好并行推进。

对外商投资企业的实务启示不是恐慌，而是准备。《办法》明确审查”不是要限制或歧视国外产品和服务”，中国仍欢迎国外产品进入市场。差异点在于可证明的供应链韧性、来源透明度与合同承诺。

外商投资企业的实务步骤

  1. 梳理暴露面。 识别客户是否包含CII运营者或处理大规模个人信息的平台运营者。若是，即便你不是申报方，产品也已进入审查视野。
  2. 将审查触发分析嵌入销售周期。 让本地团队能够识别客户采购何时需要申报，并及早暴露问题以避免延误。
  3. 夯实供应商承诺。 《办法》允许CII运营者要求提供者承诺不非法获取用户数据、不非法控制或操纵用户设备、无正当理由不中断供应。将这些承诺书面化并备可佐证材料。
  4. 以本地化降低风险。 来源多样性、本地支持、透明架构与本地数据处理，正是审查所鼓励的因素。完全依赖进口供应链是最弱姿态。
  5. 让合同”审查友好”。 若合同在审查前签署，应附条件约定”经审查通过后方可生效”，以规避”使用未审查产品”面临的采购金额一倍以上十倍以下罚款。
  6. 与数据出境合规协同。 网络安全审查与数据出境安全评估、个保法合规相互重叠，应作为一个整体项目而非三座孤岛来管理。

延伸阅读

  • 关键信息基础设施认定与年度自评估义务。
  • 数据出境路径比较：安全评估、标准合同与认证。
  • 外商投资企业在华的个保法合规。

Sources

  • 国家互联网信息办公室等十三部门：《网络安全审查办法》（令 第8号，2022年2月15日施行）— https://www.cac.gov.cn/2022-01/04/c_1642894602182845.htm
  • 《关键信息基础设施安全保护条例》（国务院令 第745号，2021年9月1日施行）— https://www.cac.gov.cn/2021-08/17/c_1630785976988160.htm
  • 《中华人民共和国网络安全法》（主席令 第五十三号，2017年6月1日施行）— http://www.npc.gov.cn/npc/c2/c12435/c12488/201905/t20190521_270249.html
Cybersecurity / 网络安全

Data Classification, Grading and Critical Information Infrastructure Obligations for Foreign-Invested Enterprises

  • China mandates a data classification and grading (数据分类分级) baseline; the national standard GB/T 43697-2024 took effect on 1 October 2024.
    中国确立了数据分类分级基线制度，国家标准GB/T 43697-2024于2024年10月1日施行。
  • The Network Data Security Management Regulations (State Council Order No. 790, effective 1 January 2025) require handlers to classify and grade network data and identify important data.
    《网络数据安全管理条例》（国务院令790号，2025年1月1日施行）要求处理者对网络数据分类分级并识别重要数据。
  • Data is graded into core, important and general; important data triggers catalogue reporting and stricter export control.
    数据分为核心、重要、一般三级；重要数据触发目录报送与更严格的出境管控。
  • A critical information infrastructure operator (CIIO) owes extra duties: a security assessment, a person in charge, and annual risk assessment.
    关键信息基础设施运营者承担额外义务：安全评估、安全负责人与年度风险评估。
  • The 2026 financial-information sector guide shows the model: three primary classes, four grades, and a 67-item third-level list.
    2026年金融信息服务数据分类分级指南给出范本：3个一级类、4级、67项三级分类。
  • Cross-border data flows are gated by grade: important data needs a security assessment; unidentified data generally does not.
    数据出境按级别设闸：重要数据须安全评估，未被认定为重要数据的通常无需申报。

Data Classification, Grading and Critical Information Infrastructure Obligations for Foreign-Invested Enterprises | 外资企业的数据分类分级与关键信息基础设施义务

The Baseline: Classify and Grade

China’s data-governance stack is built on one foundational duty: data classification and grading (数据分类分级). The Data Security Law (2021) created the system; the Cybersecurity Law, the PIPL and the Network Data Security Management Regulations (State Council Order No. 790, effective 1 January 2025) give it teeth. The national standard GB/T 43697-2024, Data Security Technology — Rules for Data Classification and Grading, released on 21 March 2024 and effective 1 October 2024, is the general rulebook that industry regulators and handlers follow.

How Grading Works

Under GB/T 43697-2024, data is graded by its importance to economic and social development and the harm that leakage, tampering, destruction or unlawful use would cause. The framework has three tiers:

  • Core data: covers areas or groups with high coverage or precision/scale/depth, whose unlawful use could directly affect political security—e.g. data on national security key areas, the national economic lifeline, major public welfare or major public interest.
  • Important data: specific fields, groups or regions, or data of a certain precision and scale, whose alteration or leakage could directly endanger national security, economic operation, social stability, public health or safety.
  • General data: everything else, further sub-divided by handlers as needed (often 2–4 internal levels).

Key principles: scientific and practical, clear boundaries, grade up where in doubt (就高从严), point-and-area combined, and dynamic updating.

What “Important Data” Actually Means for an FIE

Important-data identification is the practical flashpoint. The 2026 CAC guidance on the financial-information sector illustrates the live model: data is classified by business attribute into three primary classes (business, user, enterprise), then sub-divided into nine secondary and 67 tertiary classes; it is graded into core, important, sensitive-general and routine-general. Handlers follow a defined flow—data inventory, classification, grading, a graded catalogue, important-data directory reporting, and dynamic updating.

For an ordinary FIE, the safe reading is: you are expected to run a data inventory and apply the grading rules yourself, and to report important data to the competent department once identified. Under the Provisions on Promoting and Regulating Cross-Border Data Flows, data not notified or published as important by a department or region does not require a security assessment—but the action obligation to classify and identify is not waived.

Critical Information Infrastructure (CII) Duties

If a handler is designated a critical information infrastructure operator (CIIO), the obligations rise sharply:

  • a security assessment before commencing operations and on material change;
  • a person in charge of network security and a dedicated management body;
  • an annual risk-assessment report on network data processing;
  • stricter rules on data location and on cross-border transfer of personal information and important data, which generally requires a CAC security assessment.

CIIO status is determined by the relevant industry regulator; an FIE in telecom, finance, energy, healthcare, transport or cloud/services with national-scale reach should assume it may be in scope.

The Network Data Security Management Regulations in Practice

State Council Order No. 790 operationalises the above: it sets the classify-and-grade duty, the important-data catalogue and reporting obligation, the CIIO security assessment and person-in-charge requirements, and the dedicated duties of large platform providers (e.g. an easy-to-find option to turn off personalised recommendation, and an annual personal-information protection social-responsibility report for the largest platforms). It also optimises the cross-border mechanism: a handler may export personal information where it meets the conditions, and data not notified as important need not be assessed as such.

Why This Matters for Cross-Border Flows

Classification and grading is the gate to every export route. The chain is: inventory → classify → grade → identify important data → if important, security assessment before export; if general and within the standard-contract or certification bands, the lighter routes apply; if a CIIO, assessment is the default. An FIE that has not graded its data cannot know which route it needs, and mis-grading important data as general is a direct violation.

Practical Steps for a Foreign-Invested Enterprise

  1. Inventory the data you hold in China by business scene and entity.
  2. Apply GB/T 43697-2024 to classify (by industry/business attribute) and grade (core/important/general).
  3. Identify and report important data to the competent department; keep the catalogue dynamic.
  4. Check CIIO status with your industry regulator; if in scope, build the assessment, person-in-charge and annual-report files.
  5. Map each data stream to its export route before any transfer; do not move data you have not graded.

Related Reading

See our cross-border data transfer rules (No. 35), the field-level data export negative list (No. 57) and the amended Cybersecurity Law in force from 2026 (No. 178).

外资企业的数据分类分级与关键信息基础设施义务

基线：分类与分级

中国数据治理体系的基石是一项基础义务——数据分类分级。2021年《数据安全法》建立了制度；《网络安全法》《个人信息保护法》与《网络数据安全管理条例》（国务院令790号，2025年1月1日施行）赋予其执行力。国家标准GB/T 43697-2024《数据安全技术 数据分类分级规则》于2024年3月21日发布、2024年10月1日施行，是行业主管部门与数据处理者遵循的通用规则。

分级如何运作

根据GB/T 43697-2024，数据依其在经济社会发展中的重要程度，以及遭篡改、破坏、泄露或非法使用所造成的危害进行分级，框架分三级：

  • 核心数据：对领域、群体、区域具有较高覆盖度或达到较高精度、较大规模、一定深度，非法使用可能直接影响政治安全——如国家安全重点领域、国民经济命脉、重大民生、重大公共利益相关数据。
  • 重要数据：特定领域、特定群体、特定区域或达到一定精度规模，遭篡改或泄露可能直接危害国家安全、经济运行、社会稳定、公共健康与安全的数据。
  • 一般数据：其余数据，由处理者按需再细分（通常2—4级）。

基本原则：科学实用、边界清晰、就高从严、点面结合、动态更新。

“重要数据”对外资企业的实际含义

重要数据识别是实务焦点。网信办2026年金融信息服务领域指南给出了鲜活范本：数据按业务属性分为业务、用户、企业3个一级类，再细分9个二级、67个三级类；按核心、重要、敏感一般、常规一般分为4级。处理者按既定流程作业——数据梳理、分类、分级、形成分级清单、报送重要数据目录、动态更新。

对普通外资企业，稳妥理解是：应自行开展数据盘点并套用分级规则，并在识别到重要数据后向主管部门报送。依据《促进和规范数据跨境流动规定》，未被相关部门、地区告知或公开发布为重要数据的，无需作为重要数据申报安全评估——但分类分级与识别的”作为”义务并不因此免除。

关键信息基础设施（CII）义务

若被认定为关键信息基础设施运营者（CIIO），义务显著加重：

  • 运营前及重大变更前开展安全评估；
  • 设置网络安全负责人与专门管理机构；
  • 每年提交网络数据处理风险评估报告；
  • 数据与系统的存放及个人信息、重要数据出境受到更严约束，通常须通过网信部门安全评估。

CIIO身份由相关行业主管部门认定；在电信、金融、能源、医疗、交通或云/服务领域具有全国规模的外资企业，应假定自己可能落入范围。

《网络数据安全管理条例》的落地

国务院令790号将上述要求落地：确立分类分级义务、重要数据目录与报送义务、CIIO安全评估与负责人要求，以及大型平台企业的专有责任（如提供易于查找的个性化推荐关闭选项、最大平台每年发布个人信息保护社会责任报告）。同时优化了跨境机制：处理者符合条件即可出境个人信息；未被通知为重要数据的，无需作为重要数据申报评估。

为何这关系到跨境流动

分类分级是每条出境路径的闸门。链条为：盘点→分类→分级→识别重要数据→若为重要数据，出境前安全评估；若为一般数据且落在标准合同或认证区间，走较轻路径；若为CIIO，评估为默认。未分级的外资企业无从判断该走哪条路；把重要数据误判为一般数据，属直接违规。

外资企业的实操步骤

  1. 盘点数据：按业务场景与主体梳理在华持有的数据。
  2. 套用GB/T 43697-2024：按行业/业务属性分类，按核心/重要/一般分级。
  3. 识别并报送重要数据给主管部门；目录保持动态更新。
  4. 核实CIIO身份：与行业主管部门确认；若落入范围，建立评估、负责人与年度报告档案。
  5. 每条数据流映射至出境路径后再传输；未分级的数据不要动。

延伸阅读

可参阅本站跨境数据传输规则（编号35）、字段级数据出境负面清单（编号57）与2026年施行的修订《网络安全法》（编号178）。

Sources

Cybersecurity / 网络安全

China’s amended Cybersecurity Law in force from 1 January 2026: AI clauses, tenfold penalties and wider extraterritorial reach

  • The Decision amending the Cybersecurity Law was adopted on 28 October 2025 and takes effect on 1 January 2026, with 14 amendments and a reissued text.
    修改《网络安全法》的决定于2025年10月28日通过、2026年1月1日起施行，共14项修改并重新公布。
  • A new Article 20 builds the first basic-law “development plus oversight” framework for artificial intelligence in China.
    新增第20条，在中国基础性法律层面首次为人工智能构建”发展保障+安全监管”双重框架。
  • Maximum fines jump from the million-yuan range to RMB 10 million, and dual liability on units and responsible individuals is now the norm.
    罚款上限由百万级跃升至1000万元级，单位与直接责任人的双罚制成常态。
  • Critical information infrastructure operators face procurement-linked penalties of one to ten times the purchase amount.
    关键信息基础设施运营者面临”采购金额1—10倍”的罚则。
  • Extraterritorial application is widened: overseas actors harming China’s cybersecurity may be pursued and sanctioned, including asset freezes.
    域外适用扩大，境外危害中国网络安全的机构、组织、个人可被追究法律责任并面临包括冻结财产在内的制裁。
  • Personal information handling is explicitly tied to the Civil Code and PIPL, tightening the legal basis for processing.
    个人信息处理被明确要求遵守《民法典》《个人信息保护法》，做实法律衔接。
  • Foreign-invested enterprises should re-screen CII status, verify product certifications, and re-align cross-border data and remote-access arrangements.
    外商投资企业应重新梳理关键信息基础设施认定、核验产品认证，并对齐跨境数据与远程访问安排。

China’s amended Cybersecurity Law in force from 1 January 2026: AI clauses, tenfold penalties and wider extraterritorial reach | 2026年1月1日施行的新修改《网络安全法》：人工智能专条、阶梯式重罚与域外适用扩围

Overview: Why This Matters to Foreign-Invested Enterprises

The *Decision of the Standing Committee of the National People’s Congress on Amending the Cybersecurity Law* was adopted at the 18th session of the 14th NPC Standing Committee on 28 October 2025, promulgated by Presidential Order No. 61, and takes effect on 1 January 2026, with 14 amendments and a reissued text.

The Cybersecurity Law, the Data Security Law and the Personal Information Protection Law form the backbone of China’s network and data security legal system. The amendment raises the fine ceiling by an order of magnitude, introduces the first basic-law AI framework, tightens the Civil Code/PIPL link, and expands extraterritorial reach.

The Legislative Facts

The amending Decision was passed at the 18th meeting of the Standing Committee of the 14th NPC on 28 October 2025, promulgated by Presidential Order No. 61, and takes effect on 1 January 2026; the original law had been in force since 1 June 2017, and the amendment renumbers the articles and reissues the full text. Per the Constitution and Law Committee report of 27 October 2025, the Standing Committee deliberated on 25 October, the Committee studied the articles clause by clause that evening, and — after consulting relevant departments — fixed the effective date as 1 January 2026, adopting the suggestions to add AI-promotion content and to widen extraterritorial application.

A New Guiding Principle and the AI Article

The first amendment inserts a new Article 3: “Cybersecurity work adheres to the leadership of the Communist Party of China, implements the holistic view of national security, coordinates development and security, and advances the building of a cyber power.”

The headline addition is new Article 20 — the AI clause. It provides that the state supports foundational AI theoretical research and R&D of key technologies such as algorithms, promotes training-data and computing-power infrastructure, improves AI ethics norms, strengthens risk monitoring, assessment and security supervision, and promotes sound AI application and development; it also supports innovative cybersecurity management and the use of new technologies such as AI to raise protection levels.

Personal Information Linkage

The former Article 40 becomes new Article 42 and adds a second paragraph: a network operator processing personal information must comply with this Law and with laws and administrative regulations such as the Civil Code and the Personal Information Protection Law.

Stepped Penalties: The Order-of-Magnitude Jump

The former Article 59 becomes new Article 61 with a graded, stepped schedule; the maximum fine rises to RMB 10 million.

SeverityWhoUnit fine (RMB)Individual fine (RMB)
General duty failure (Art. 23/27), persistsNetwork operator50k–500k10k–100k
CII duty failure (Art. 35/36/38/40), persistsCII operator100k–1m10k–100k
Serious: large leak / CII partial lossEither500k–2m50k–200k
Especially serious: CII main-function lossEither2m–10m200k–1m

The design is graduated: a first-tier failure draws a warning and a modest fine; only persistence or actual harm escalates. The upper tiers — large-scale data leakage or a CII losing partial function, and a CII losing its main function — carry the RMB 10 million ceiling and individual liability up to RMB 1 million.

Product Certification and the Closing of Applications

New Article 63 targets the supply side: selling or providing network key equipment or dedicated cybersecurity products that have not passed security certification or detection, or that are unqualified, draws an order to stop sales or provision, a warning and confiscation of unlawful gains; where gains are below RMB 100,000 an additional RMB 20,000–100,000 fine applies, and where gains exceed RMB 100,000 an additional one-to-five-times fine applies; in serious cases, business may be suspended, rectified, or licences revoked.

The former Article 61 becomes new Article 64, and disposal measures add “closing the application” alongside “closing the website”.

Critical Information Infrastructure: Procurement and Offshore Storage

The former Article 65 becomes new Article 67: a CII operator using products or services not security-reviewed, or that failed review, in violation of Article 37, is ordered to rectify, stop use, eliminate effects on national security, and fined one to ten times the procurement amount, with responsible individuals fined RMB 10,000–100,000.

New Article 65 (former Article 62) covers unauthorised cybersecurity certification, detection, risk assessment, or publicly releasing vulnerabilities, viruses, attack or intrusion information: a warning and up to RMB 100,000; persistent or serious cases draw RMB 100,000–1,000,000 plus possible suspension, closure or licence revocation, with individuals fined up to RMB 100,000.

New Article 69 (merging former Articles 68 and 69(1)) covers failure to stop transmission of unlawful information, take elimination measures, keep records or report: a warning and up to RMB 500,000; persistent or serious cases draw RMB 500,000–2,000,000 plus possible suspension, closure or revocation, with individuals fined RMB 50,000–200,000; especially serious impact raises the fine to RMB 2,000,000–10,000,000 and individuals to RMB 200,000–1,000,000; electronic-information and app-download providers failing Article 50(2) duties are punished under the same paragraphs.

New Article 71 (merging former Articles 64, 66 and 70) routes three categories to other laws: (1) publishing or transmitting information prohibited under Article 13(2) and other laws; (2) infringing personal-information rights under Articles 24(3) and 43–45; and (3) a CII operator storing personal information and important data offshore, or providing such data offshore, in violation of Article 39; stealing or illegally obtaining, selling or providing personal information not yet constituting a crime is punished by public security authorities.

Proportionate Penalties and Extraterritorial Reach

New Article 73 introduces a general leniency clause: where a violation also meets circumstances for lighter, mitigated or exempt punishment under the Administrative Penalty Law, those provisions apply.

The final amendment changes the former Article 75 to new Article 77 and widens extraterritorial application. Overseas institutions, organisations or individuals endangering China’s cybersecurity are now “pursued for legal liability according to law”; where serious consequences are caused, the public security department and relevant State Council departments “may decide to take freezing of assets or other necessary sanctions.” Adding “pursued for legal liability” and broadening the trigger materially expands the law’s reach beyond China’s borders.

How Officials Framed the Revision

The CAC Network Rule-of-Law Bureau described the amended law as enriching guiding principles, adding AI security and development content, aligning personal-information protection with the Civil Code and PIPL, improving the liability system, and widening extraterritorial application. He Bo, director of the CAICT Internet Law Research Center, noted the stepped penalties categorise general, persistent/serious and especially serious cases, applying punishment and education so enforcement “has both strength and warmth,” and called the 1 January 2026 effective date a marker that “China’s cybersecurity rule-of-law has entered a new stage”; the NPC Standing Committee Economic Law Office stated the amendment implements the thought on building a cyber power and that the three laws together constitute China’s network and data security legal system.

What Foreign-Invested Enterprises Should Do Next

  1. Re-screen CII status. Determine whether your China entity, or parts of it, are or may be designated critical information infrastructure, since the heaviest tiers and the procurement multiple attach to that status.
  2. Verify product certifications. Audit network key equipment and dedicated cybersecurity products against the certification/detection catalogues; obtain and retain proof before purchase and deployment.
  3. Re-align the legal basis for personal-information processing. Update privacy notices, processing records and contracts to cite Article 42(2) and the Civil Code/PIPL linkage.
  4. Build an approval path for outward vulnerability and security-information release. Article 65 rules require internal sign-off before any external disclosure.
  5. Review group-level cross-border data and remote access. The Article 71 offshore route and widened Article 77 reach bear directly on group clouds, cross-border systems and remote operations by overseas parent or affiliate staff.
  6. Re-rate the compliance budget and individual exposure. With dual liability normalised and a RMB 10 million ceiling, assign board-level ownership and director-officer risk awareness.

Related Reading

Two companion articles on this site cover adjacent ground without overlap: the Multi-Level Protection Scheme (MLPS) and foreign-invested enterprises, and the Regulations on Network Data Security Management; the cross-references are pointers.

2026年1月1日施行的新修改《网络安全法》：人工智能专条、阶梯式重罚与域外适用扩围

概览：本次修法对外商投资企业的含义

《全国人民代表大会常务委员会关于修改〈中华人民共和国网络安全法〉的决定》于2025年10月28日第十四届全国人大常委会第十八次会议通过，经国家主席令第六十一号公布，自2026年1月1日起施行，共14项修改并重新公布全文。

《网络安全法》与《数据安全法》《个人信息保护法》共同构成我国网络与数据安全法律体系的支柱；本次修法将罚款上限提高一个数量级，首次在基础性法律层面为人工智能设立框架，做实与《民法典》《个人信息保护法》的衔接，并扩大域外适用。

立法事实

修改决定于2025年10月28日第十四届全国人大常委会第十八次会议通过，由中华人民共和国主席令第六十一号公布，自2026年1月1日起施行。原法自2017年6月1日施行；本次修改相应调整条文顺序并重新公布全文。根据2025年10月27日宪法和法律委员会的报告，常委会于10月25日分组审议，宪法和法律委员会当晚逐条研究，并与有关部门研究后将施行时间确定为2026年1月1日；委员会采纳了”增加促进人工智能应用、运用人工智能提升网络安全保护水平”的意见，也采纳了”扩大域外适用情形”的建议。

新增指导原则与人工智能专条

第一项修改新增第3条：”网络安全工作坚持中国共产党的领导，贯彻总体国家安全观，统筹发展和安全，推进网络强国建设。”

实质性新增是第20条（人工智能专条）。其规定，国家支持人工智能基础理论研究和算法等关键技术研发，推进训练数据资源、算力等基础设施建设，完善人工智能伦理规范，加强风险监测评估和安全监管，促进人工智能应用和健康发展；同时规定，国家支持创新网络安全管理方式，运用人工智能等新技术，提升网络安全保护水平。这是中国基础性法律层面首次为人工智能构建”发展保障+安全监管”双重框架。

个人信息保护的衔接

修改将原第40条改为第42条并增加一款：网络运营者处理个人信息，应当遵守本法和《民法典》《个人信息保护法》等法律、行政法规的规定。这做实了与《民法典》《个人信息保护法》的衔接。

阶梯式罚则：量级的跃升

原第59条改为第61条，引入分级、阶梯式处罚安排，罚款上限由百万级跃升至1000万元级。

情节层级适用主体单位罚款（元）责任人罚款（元）
一般性义务未履行且拒不改正（第23、27条）网络运营者5万–50万1万–10万
关基义务未履行且拒不改正（第35、36、38、40条）关基运营者10万–100万1万–10万
严重后果：大量数据泄露、关基丧失局部功能二者均适用50万–200万5万–20万
特别严重后果：关基丧失主要功能二者均适用200万–1000万20万–100万

设计刻意呈阶梯状：第一层级仅招致警告与较低罚款；唯有拒不改正或实际造成危害才逐级抬升。但顶层——大规模数据泄露或关基丧失局部功能，以及关基丧失主要功能的特别严重情形——触及1000万元上限，责任人个人责任可达100万元。

产品认证检测与应用关停

新增第63条指向供给端：销售或提供未经安全认证、安全检测，或者不合格、不符合要求的网络关键设备和网络安全专用产品，将被责令停止销售或提供、警告并没收违法所得；无违法所得或不足10万元的，并处2万–10万元；违法所得10万元以上的，并处违法所得1–5倍；情节严重的，可责令暂停业务、停业整顿、吊销许可证或营业执照。

原第61条改为第64条，处置措施在”关闭网站”之外新增”关闭网站或者应用程序”。

关键信息基础设施：采购与境外存储

原第65条改为第67条：关基运营者违反第37条，使用未经安全审查或安全审查未通过的网络产品或者服务的，被责令限期改正、停止使用、消除对国家安全的影响，并处采购金额1–10倍罚款，责任人处1万–10万元。

新增第65条（原第62条）规制未经许可开展网络安全认证、检测、风险评估，或向社会发布系统漏洞、计算机病毒、网络攻击、网络侵入等网络安全信息：责令改正、警告，可处1万–10万元；拒不改正或情节严重的，处10万–100万元，并可责令暂停业务、停业整顿、关闭网站或应用程序、吊销许可证或营业执照，责任人处1万–10万元。

新增第69条（合并原第68条与第69条第1项）规制未停止传输违法信息、未采取消除处置措施、未保存记录或未报告：责令改正、警告、通报，可处5万–50万元；拒不改正或情节严重的，处50万–200万元，并可责令暂停业务、停业整顿、关闭网站或应用程序、吊销许可证或营业执照，责任人处5万–20万元；造成特别严重影响、特别严重后果的，处200万–1000万元，责任人处20万–100万元。电子信息发送服务提供者、应用软件下载服务提供者不履行第50条第2款安全管理义务的，依照前两款处罚。

新增第71条（合并原第64、66、70条）将三类行为交由其他法律、行政法规处理处罚：（一）发布或传输第13条第2款和其他法律禁止发布或传输的信息；（二）违反第24条第3款、第43至45条规定侵害个人信息权益；（三）违反第39条规定，关基运营者在境外存储个人信息和重要数据，或向境外提供个人信息和重要数据。窃取或非法获取、非法出售或非法提供个人信息尚不构成犯罪的，由公安机关依法处罚。

过罚相当与域外适用扩围

新增第73条引入一般从轻条款：违反本法规定但具有《行政处罚法》规定的从轻、减轻或不予处罚情形的，依照其规定。

最后一项修改将原第75条改为第77条，扩大域外适用。其现规定：境外的机构、组织、个人从事危害中华人民共和国网络安全活动的，”依法追究法律责任”；造成严重后果的，国务院公安部门和有关部门并可以决定对该机构、组织、个人采取冻结财产或者其他必要的制裁措施。原条文仅规定冻结财产等制裁，新增”依法追究法律责任”且触发情形扩大，使该法的域外辐射显著拓宽。

官方对本次修法的定调

中央网信办网络法治局指出，修改后的网络安全法”充实网络安全工作指导原则，增加促进人工智能安全与发展的内容，在个人信息保护方面做好与《民法典》和《个人信息保护法》的衔接，进一步完善网络安全法律责任制度，扩大域外适用情形”。中国信通院互联网法律研究中心主任何波在网信办官网刊文表示，新法设置阶梯式处罚，按一般性违法、拒不改正或情节严重、造成特别严重影响/后果分类施策，宽严相济，使执法”既有力度又有温度”；并称2026年1月1日施行”标志着我国网络安全法治建设进入新阶段”。全国人大常委会法工委经济法室表示，修改重点之一是贯彻网络强国重要思想、充实指导原则；网络安全法与数据安全法、个人信息保护法共同构成我国网络安全和数据安全法律体系。

外商投资企业下一步应做什么

  1. 重新梳理关基认定。 厘清中国实体或其部分是否被认定或可能被认定为关键信息基础设施，因为最重罚则层级与采购倍数均附着于该身份。
  2. 核验产品认证。 对照认证/检测目录审计网络关键设备与网络安全专用产品，在采购与部署前取得并留存证明。
  3. 对齐个人信息处理的法律依据。 更新隐私政策、处理记录与合同，引据第42条第2款及《民法典》《个人信息保护法》衔接。
  4. 建立漏洞与网络安全信息对外发布的审批路径。 第65条风险评估与信息发布规则要求任何对外披露前完成内部签批。
  5. 复核集团层面的跨境数据与远程访问。 第71条境外存储/提供路径与拓宽的第77条域外适用，直接关涉集团云、跨境系统与境外母公司或关联方人员的远程运维。
  6. 重估合规预算与个人风险。 双罚制常态化、上限1000万元，须配置董事会层级的责任归属与高管风险意识。

延伸阅读

本站另有两篇相邻主题文章，互不重叠：网络安全等级保护（MLPS）与外资企业、《网络数据安全管理条例》。新修改的《网络安全法》作为基础性法律居于二者之上；此处仅作交叉引用，不作重写。

Sources

Cybersecurity / 网络安全

China’s Network Data Security Regulation: what foreign-invested firms must do

  • China’s Network Data Security Regulation (State Council Order 790) took effect on 1 January 2025, turning the Cybersecurity Law, Data Security Law and PIPL into operational, enforceable obligations for every network data processor — including foreign-invested firms.
    《网络数据安全管理条例》（国务院令790号）自 2025 年 1 月 1 日起施行，将《网络安全法》《数据安全法》《个人信息保护法》转化为对每一个网络数据处理者（含外资企业）可执行、可处罚的具体义务。
  • Foreign companies that process personal information of individuals in China must designate a domestic representative or set up a local body and file its details with the city-level Cyberspace Administration (CAC).
    处理中国境内自然人个人信息的境外企业，须在中国境内设立专门机构或指定代表，并将其信息报送所在地市级网信部门。
  • Sensitive personal information — biometrics, health, finance, religious belief, specific identity, whereabouts — requires separate consent, and data on children under 14 needs guardian consent.
    生物识别、医疗健康、金融账户、宗教信仰、特定身份、行踪轨迹等敏感个人信息须取得单独同意，不满十四周岁未成年人个人信息须取得监护人同意。
  • “Important data” handlers must appoint a security manager and team, run risk assessments before sharing or outsourcing, and file an annual risk report to provincial-or-above authorities.
    重要数据处理者须明确数据安全负责人与管理机构，在提供、委托、共同处理前开展风险评估，并每年向省级以上主管部门报送风险评估报告。
  • Cross-border transfers of important data require a CAC security assessment; personal information can exit via assessment, certification, standard contract, or one of several statutory exemptions.
    重要数据出境须通过网信部门安全评估；个人信息出境可通过安全评估、保护认证、标准合同或若干法定豁免路径。
  • Large platforms (50M+ registered users or 10M+ monthly actives) face extra duties: an annual personal-information protection social-responsibility report and stricter cross-border controls.
    大型网络平台（注册用户 5000 万以上或月活 1000 万以上）承担额外义务：每年发布个人信息保护社会责任报告，并遵守更严格的数据跨境要求。
  • Penalties are substantial: routine violations draw fines up to ¥1 million, while national-security-review breaches can reach ¥100 million plus business suspension.
    处罚力度显著：一般违规罚款最高 100 万元，违反国家安全审查规定的可处 1000 万元罚款并责令停业整顿。

China’s Network Data Security Regulation: what foreign-invested firms must do | 网络数据安全管理条例：外资企业需要做什么

Overview

On 1 January 2025, the Network Data Security Regulation (网络数据安全管理条例) — State Council Order No. 790, promulgated on 24 September 2024 — came into force. It is the implementing layer beneath three statutes that foreign operators already know by name: the Cybersecurity Law (2017), the Data Security Law (2021) and the Personal Information Protection Law (2021). Where those laws set principles, Order 790 sets procedures, assignees and penalties.

For a foreign-invested enterprise (FIE) running a website, app, SaaS, e-commerce storefront, loyalty programme, HR system or IoT product in China, the Regulation is not background law — it is the rulebook that determines whether your data practices are lawful day to day. This article walks through the obligations that most often catch foreign operators off guard, the cross-border mechanics, and a practical compliance checklist. It is general information, not legal advice.

Who is in scope

The Regulation applies to “network data processing activities” in China — collection, storage, use, processing, transmission, provision, disclosure and deletion of electronic data over a network. If you operate any digital service that touches users or employees in mainland China, you are a network data processor (网络数据处理者) and bear the primary responsibility for the security of the data you handle.

Two extraterritorial hooks matter for foreign parents and platforms:

  • Article 26 (mirroring PIPL Article 53): an overseas processor of personal information of individuals in China that is required to establish a local body or designate a representative must file the body’s name (or the representative’s name) and contact details with the city-level Cyberspace Administration. This is the practical foothold CAC uses to reach foreign groups.
  • Article 54: China may take necessary measures against overseas organisations or individuals whose network data activities harm national security, public interest, or the personal-information rights of Chinese citizens.

Personal-information obligations

Most foreign businesses handle personal information — customers, leads, employees, newsletter subscribers. The Regulation tightens the rules:

  • Transparency. Personal-information processing rules must be集中 displayed, easy to access and prominently placed; sensitive-PI handling, retention periods and the methods for exercising rights must be stated clearly.
  • Sensitive PI needs separate consent. Biometrics, religious belief, specific identity, medical/health, financial accounts and whereabouts all require separate consent, not merely bundling into a privacy policy.
  • Minors under 14 require guardian consent and a dedicated processing rule.
  • Data portability and rights. Users can request access, copy, transfer, correct, delete, restrict processing, cancel accounts and withdraw consent; you must provide convenient channels and not erect unreasonable barriers.
  • Compliance audit. Processors must periodically — themselves or via a professional firm — audit their personal-information compliance.
  • Scale threshold. A processor of over 10 million individuals’ personal information is pulled into the “important data” duties on security manager, team and annual risk reporting (Articles 28, 30, 32).

Important-data duties

“Important data” is data that, if tampered with, destroyed, leaked or misused, could directly endanger national security, economic operation, social stability or public health and safety. The regime:

  • Identification and reporting. Processors must identify and declare important data under national rules; once a region or authority informs or publishes that certain data is important, the handler must fulfil protection duties.
  • Security manager + institution. Important-data handlers must designate a data-security负责人 (a management-layer member with direct reporting rights to authorities) and a dedicated management body.
  • Risk assessment before sharing. Before providing, entrusting or co-processing important data, a risk assessment is required (statutory duties excepted), covering purpose, necessity, recipient trustworthiness, contract safeguards and technical measures.
  • Annual report. Each year, important-data handlers file a risk-assessment report to provincial-or-above authorities, covering processed data, safeguards, incidents and — critically — cross-border transfer circumstances.

Cross-border transfer mechanics

This is where foreign groups feel the pinch. The Regulation preserves the existing three main lawful channels for personal-information export and adds statutory exemptions:

  1. CAC security assessment — mandatory for important-data exports and for large-volume PI transfers.
  2. PIPL certification by a professional institution.
  3. Standard contract filed with CAC.
  4. Exemptions — necessary to conclude/perform a contract with the individual; cross-border HR management under lawful rules/collective contract; statutory duties; emergencies protecting life/property; and treaty-based routes.

Important data cannot leave China without a CAC security assessment. Even after approval, transfers must not exceed the purpose, scope, type and volume assessed. CAC runs a dedicated cross-border data-security mechanism (Article 34).

Platform and AI-specific duties

If your China operation runs a platform or uses automation, note:

  • App-distribution platforms must verify and, where needed, suspend or stop distributing non-compliant applications.
  • Personalised recommendation must offer an easy-to-find, easy-to-operate opt-out and let users delete their profile tags.
  • Generative-AI providers must secure training data and the training process.
  • Large platforms (registered users ≥50M or MAU ≥10M) must publish an annual personal-information protection social-responsibility report and apply stricter cross-border controls; their annual important-data risk reports must also cover key-business and supply-chain data security.

Penalties

Enforcement is graded. Routine breaches (e.g. Articles 12, 22, 40–42) draw warnings, confiscation of unlawful gains, and — if unremedied or serious — fines up to ¥1 million plus possible suspension, rectification, licence revocation, and ¥10,000–¥100,000 personal fines for responsible individuals. National-security-review violations (Article 13) escalate to ¥1 million–¥100 million, suspension/revocation, and ¥100,000–¥1 million personal liability. Mitigation exists for voluntary correction and minor first-time offences.

Practical checklist for foreign firms

  1. Map your data. Inventory what you collect, where it lives, who touches it, and whether any slice could be “important data” or sensitive PI.
  2. Appoint ownership. Name a data-security lead (management layer) and a working team; document them.
  3. Close the extraterritorial gap. If you are an overseas processor of China PI, designate a local representative and file with the city-level CAC.
  4. Fix consent flows. Separate consent for sensitive PI; guardian consent for under-14s; honour portability and deletion rights with real, low-friction channels.
  5. Choose a transfer path. For any data leaving China, pick assessment / certification / standard contract / exemption and document the basis; never export important data without CAC approval.
  6. Run the audits. Periodic PI-compliance audits; annual important-data risk reports where triggered; large-platform reports if thresholds are met.
  7. Train and record. Keep policies, risk-assessment reports, transfer records and training evidence — penalties hinge on demonstrable diligence.

Sources

  • 网络数据安全管理条例（中华人民共和国国务院令 第790号，2024-09-24 公布，2025-01-01 施行），中国政府网：https://www.gov.cn/zhengce/content/202409/content_6977766.htm
  • 国务院公报《网络数据安全管理条例》（国令第790号）：https://www.gov.cn/gongbao/2024/issue_11646/202410/content_6980863.html
  • 中华人民共和国个人信息保护法（PIPL），全国人大：http://www.npc.gov.cn
  • 中华人民共和国数据安全法，全国人大：http://www.npc.gov.cn

Related reading

  • 数据出境安全评估与标准合同 / Data export security assessment and standard contract
  • 个人信息保护合规审计 / PIPL compliance audit
  • 外资企业数据本地化与跨境 / Data localisation for FIEs

网络数据安全管理条例：外资企业需要做什么

概述

2025 年 1 月 1 日，《网络数据安全管理条例》（国务院令790号，2024 年 9 月 24 日公布）正式施行。它是三部法律——2017 年《网络安全法》、2021 年《数据安全法》、2021 年《个人信息保护法》——之下的实施层。三部法律确立原则，790 号条例把它们变成可操作、可处罚的具体程序、责任主体与罚则。

对于在中国运营网站、App、SaaS、电商门店、会员体系、HR 系统或物联网产品的外商投资企业（FIE）而言，本条例不是”背景法”，而是决定你日常数据操作是否合规的实操手册。本文梳理最容易被外资运营方忽略的义务、数据跨境机制与一份合规清单。本文为一般性信息，非法律意见。

谁在范围内

条例适用于中国境内的”网络数据处理活动”——通过网络对电子数据进行收集、存储、使用、加工、传输、提供、公开、删除。只要你在 mainland China 运营任何触达用户或员工的数字服务，你就是网络数据处理者，并对所处理数据的安全承担主体责任。

两条域外效力条款对外国母公司和平台尤为关键：

  • 第二十六条（对应个保法第五十三条）：处理中国境内自然人个人信息的境外处理者，如依法须在中国境内设立专门机构或指定代表，应将其名称（或代表姓名）及联系方式报送市级网信部门。这是网信办触达外国集团的实务抓手。
  • 第五十四条：对中国国家安全、公共利益或公民个人信息权益造成危害的境外组织、个人，国家网信部门可会同有关部门采取必要措施。

个人信息义务

多数外资企业都处理个人信息——客户、线索、员工、订阅者。条例进一步收紧：

  • 透明性。 个人信息处理规则须集中展示、易于访问、置于醒目位置；敏感个人信息处理、保存期限与行权方式须清晰列明。
  • 敏感个人信息须单独同意。 生物识别、宗教信仰、特定身份、医疗健康、金融账户、行踪轨迹均须取得单独同意，不能仅裹挟进隐私政策。
  • 不满十四周岁未成年人须取得监护人同意，并制定专门处理规则。
  • 可携带权与行权。 用户可请求查阅、复制、转移、更正、删除、限制处理、注销账号、撤回同意；须提供便捷渠道，不得设置不合理障碍。
  • 合规审计。 处理者须定期（自行或委托专业机构）审计个人信息合规情况。
  • 规模门槛。 处理超过 1000 万人个人信息的处理者，被纳入”重要数据”级别的安全负责人、管理机构与年度风险评估义务（第二十八条、第三十条、第三十二条）。

重要数据义务

“重要数据”指一旦遭篡改、破坏、泄露或非法利用，可能直接危害国家安全、经济运行、社会稳定或公共健康安全的数据。其机制为：

  • 识别与申报。 处理者须按国家规定识别、申报重要数据；一旦地区或主管部门告知或公布某类数据为重要数据，处理者须履行保护义务。
  • 安全负责人 + 管理机构。 重要数据处理者须指定数据安全负责人（管理层成员，有权直接向主管部门报告）并设立专门管理机构。
  • 提供前风险评估。 在提供、委托处理、共同处理重要数据前须开展风险评估（法定职责除外），覆盖目的、必要性、接收方资信、合同保障措施与技术手段。
  • 年度报告。 重要数据处理者每年向省级以上主管部门报送风险评估报告，涵盖所处理数据、保障措施、安全事件，以及——关键地——数据出境情况。

数据跨境机制

这是外国集团感受最深的环节。条例保留了个人信息出境的三条主要合法路径并新增法定豁免：

  1. 网信部门安全评估——重要数据出境及大体量个人信息传输的强制路径。
  2. 个人信息保护认证（专业机构出具）。
  3. 标准合同（向网信部门备案）。
  4. 豁免情形——订立或履行与个人的合同所必需；依法制定的劳动规章制度/集体合同下的跨境人力管理；履行法定职责；紧急情况下保护自然人生命健康和财产安全；以及条约规定的路径。

重要数据未经网信部门安全评估不得出境。即便获批，传输也不得超出评估确定的目的、范围、种类与规模。网信部门建立数据出境安全管理专项工作机制（第三十四条）。

平台与人工智能专项义务

若你的中国业务运营平台或使用自动化，请注意：

  • 应用分发平台须核验应用，必要时警示、不予分发、暂停或终止分发不合规应用。
  • 个性化推荐须提供易于理解、便于操作的关闭选项，并允许用户删除个人特征标签。
  • 生成式人工智能提供者须保障训练数据及训练过程安全。
  • 大型网络平台（注册用户 ≥5000 万或月活 ≥1000 万）须每年发布个人信息保护社会责任报告，并施以更严格的跨境管控；其重要数据年度报告还须说明关键业务与供应链数据安全。

法律责任

执法分级。一般违规（如第十二、二十二、四十至四十二条）可处警告、没收违法所得，拒不改正或情节严重的罚款最高 100 万元，并可责令暂停业务、停业整顿、吊销许可，对责任人员处 1 万–10 万元罚款。违反国家安全审查规定（第十三条）可升至 100 万–1000 万元罚款、停业整顿/吊销，并对责任人员处 10 万–100 万元罚款。主动消除危害、轻微并及时改正的，可依法从轻、减轻或不予处罚。

外资企业实操清单

  1. 梳理数据。 盘点收集内容、存储位置、接触方，以及是否存在”重要数据”或敏感个人信息。
  2. 落实责任人。 指定管理层级的数据安全负责人与工作队，并形成文件。
  3. 补齐域外缺口。 若你是处理中国个人信息的境外处理者，指定境内代表并向市级网信部门报备。
  4. 修正同意流程。 敏感个人信息单独同意；不满十四周岁监护人同意；以真实、低摩擦渠道保障可携带与删除权。
  5. 选定出境路径。 任何出境数据须选择评估/认证/标准合同/豁免之一并留痕；重要数据未经评估不得出境。
  6. 开展审计。 定期个人信息合规审计；触发的年度重要数据风险评估；达标的大型平台报告。
  7. 培训与留证。 保存制度、评估报告、传输记录与培训证据——处罚往往取决于是否展现出可证明的勤勉。

Sources

  • 网络数据安全管理条例（中华人民共和国国务院令 第790号，2024-09-24 公布，2025-01-01 施行），中国政府网：https://www.gov.cn/zhengce/content/202409/content_6977766.htm
  • 国务院公报《网络数据安全管理条例》（国令第790号）：https://www.gov.cn/gongbao/2024/issue_11646/202410/content_6980863.html
  • 中华人民共和国个人信息保护法（PIPL），全国人大：http://www.npc.gov.cn
  • 中华人民共和国数据安全法，全国人大：http://www.npc.gov.cn

相关阅读

  • 数据出境安全评估与标准合同 / Data export security assessment and standard contract
  • 个人信息保护合规审计 / PIPL compliance audit
  • 外资企业数据本地化与跨境 / Data localisation for FIEs