• Critical Information Infrastructure (CII) protection is codified in the 2021 《关键信息基础设施安全保护条例》, effective 1 September 2021 and reinforced through 2026 implementing rules.
  关键信息基础设施（CII）保护由2021年《关键信息基础设施安全保护条例》（2021年9月1日施行）确立，并通过2026年相关实施规则持续强化。
• CII operators must pass CAC-led network security review before procuring network products or services that may affect national security—a direct gate on inbound technology supply.
  关基运营者在采购可能影响国家安全的网络产品或服务前，须通过网信办主导的网络安全审查——这构成对境外技术供给的直接关口。
• A multi-sector identification mechanism designates CII across telecommunications, energy, finance, transport, public services, and e-government.
  跨行业认定机制在电信、能源、金融、交通、公共服务及电子政务等领域认定关基。
• Foreign suppliers face “secure and controllable” expectations, localisation of core data, and ongoing compliance audits once inside a CII supply chain.
  外国供应商一旦进入关基供应链，即面临”安全可控”要求、核心数据本地化及持续合规审计。
• As of 2026, designations have broadened to cloud, data centres, and large platforms, raising diligence obligations for entrants selling into these sectors.
  截至2026年，认定范围已扩展至云、数据中心及大型平台，提高了向这些行业销售的准入者尽调义务。
• Missteps can exclude a vendor from CII procurement entirely, a commercial outcome more damaging than a single deal loss.
  失误可能导致供应商被整体排除在关基采购之外，其商业后果甚于单一交易损失。

Critical Infrastructure Security Review in China: The CII Gate | 中国关键基础设施安全审查：CII关口

The Statutory Backbone

Critical Information Infrastructure protection in China is anchored by the 《关键信息基础设施安全保护条例》 (Regulations on the Security Protection of Critical Information Infrastructure), promulgated as State Council Order No. 745 on 30 July 2021 and effective from 1 September 2021. It sits beneath the 《网络安全法》 (2017) and works in tandem with the CAC’s 《网络安全审查办法》 (2022). Through 2026, implementing rules from the CAC and sector regulators have progressively sharpened the obligations on operators and their suppliers.

What Counts as CII?

CII means information infrastructure whose impairment or data leakage would gravely endanger national security, the national economy, or public welfare. Designation follows a multi-sector identification mechanism led by the CAC together with industry regulators. Sectors typically captured include:

• Telecommunications and broadcasting;
• Energy and power;
• Finance;
• Transport and logistics;
• Water, public-health, and other public services;
• E-government and national defence-adjacent systems.

By 2026, cloud computing platforms, large data centres, and systemically important internet platforms have been drawn into the CII perimeter, widening the population of operators—and their vendors—subject to review.

The Procurement Gate

The most consequential rule for foreign suppliers: a CII operator intending to procure network products or services that may affect national security must apply for a CAC-led network security review and may not proceed with the procurement until cleared. The review assesses:

• Risk of foreign-government control or coercion;
• Risk of tampering, surveillance, or data leakage;
• Supply-chain continuity and “secure and controllable” (安全可控) attributes.

This makes CII procurement a hard gate: a foreign technology vendor cannot close a sale into a CII operator without the operator first clearing review, often with the vendor’s own architecture and provenance under examination.

Supplier Obligations Once Designated

Suppliers that enter a CII supply chain assume durable duties:

• Secure-and-controllable commitments, including source transparency and remediation cooperation;
• Core-data localisation, keeping important and core data onshore;
• Ongoing audits, with the operator required to conduct annual self-assessments and report to the regulator;
• Incident response, with strict breach-notification timelines.

Foreign vendors should expect contractual clauses嵌入 (embedded) these obligations and should price the compliance burden accordingly.

2026 Trajectory

The 2024–2026 period has seen CII rules extended to emerging environments—edge computing, AI services, and cross-border cloud—and a tightening of the “secure and controllable” standard. For market entrants, the practical effect is that selling advanced IT, security, or cloud products into Chinese state-linked and platform customers now presupposes CII readiness. Early engagement with the operator’s regulatory channel is advisable before a bid is finalised.

Practical Guidance for Entrants

1. Determine if your customer is a CII operator. If so, assume the procurement gate applies and plan for review lead time.
2. Pre-position compliance artefacts: source provenance, security certifications, data-handling statements, and a local support entity.
3. Avoid sole-source foreign dependencies where a domestic alternative can be paired, easing the “secure and controllable” assessment.
4. Negotiate allocation of review risk in the contract—who bears delay, cost, and disqualification.
5. Localise core data and operations to reduce the surface area of review.

Commercial Stakes

Exclusion from CII procurement is not a one-deal loss; it can be an industry-wide disqualification. Because CII operators span the backbone of the economy, a vendor barred on security grounds loses access to the most strategic and durable customer base in China. Treating CII readiness as a market-entry prerequisite—rather than a reactive clearance—is the disciplined approach for 2026.

中国关键基础设施安全审查：CII关口

法律主干

中国关键信息基础设施保护由《关键信息基础设施安全保护条例》确立。该条例于2021年7月30日以国务院第745号令公布，自2021年9月1日起施行。它位于《网络安全法》（2017年）之下，并与网信办《网络安全审查办法》（2022年）协同运作。2026年，网信办及各行业主管部门的实施规则持续细化运营者及其供应商的义务。

何为CII？

CII 指一旦遭到破坏、丧失功能或数据泄露，可能严重危害国家安全、国计民生或公共利益的网络基础设施。认定遵循由网信办会同行业主管部门主导的跨部门认定机制。通常被纳入的行业包括：

• 电信与广播电视；
• 能源与电力；
• 金融；
• 交通运输与物流；
• 水利、公共卫生及其他公共服务；
• 电子政务及国防相关系统。

至2026年，云计算平台、大型数据中心及具有系统重要性的互联网平台已被纳入 CII 范围，扩大了须接受审查的运营者及其供应商群体。

采购关口

对外国供应商最具约束力的规则是：关基运营者采购可能影响国家安全的网络产品或服务，须申报网信办主导的网络安全审查，且未获通过前不得采购。审查评估以下方面：

• 受外国政府控制或胁迫的风险；
• 被篡改、监视或数据泄露的风险；
• 供应链连续性及”安全可控”属性。

这使关基采购成为一道硬关口：外国技术供应商若未先由运营者通过审查（往往需审查供应商自身的架构与来源），便无法向关基运营者完成销售。

认定后的供应商义务

进入关基供应链的供应商须承担持续性义务：

• 安全可控承诺，包括来源透明与配合整改；
• 核心数据本地化，将重要数据与核心数据留存境内；
• 持续审计，运营者须开展年度自评估并向监管报告；
• 事件响应，须遵守严格的泄露通报时限。

外国供应商应预期合同中嵌入上述义务条款，并据此核算合规成本。

2026年走向

2024–2026年间，CII 规则已扩展至新兴场景——边缘计算、人工智能服务及跨境云——并收紧了”安全可控”标准。对市场准入者而言，其实质影响是：向中国的国资关联及平台客户销售先进 IT、安全或云产品，如今须以 CII 就绪为前提。在投标最终确定前，宜尽早与运营者的监管渠道沟通。

市场准入实务指引

1. 判定客户是否为 CII 运营者。 若是，应假定适用采购关口，并为审查预留前置时间。
2. 预先备妥合规材料：来源溯源、安全认证、数据处理说明及本地支持实体。
3. 避免 sole-source 外国依赖，在可搭配境内替代方案处采用，以缓解”安全可控”评估。
4. 在合同中约定审查风险分配——由谁承担延误、成本与失格。
5. 将核心数据与运营本地化，以缩减受审查的暴露面。

商业利害关系

被排除于关基采购之外，并非单一交易损失，而可能构成全行业失格。由于关基运营者横跨经济骨干，因安全原因被禁入的供应商将失去中国最具战略性与最稳定的客户群。将 CII 就绪作为市场准入前提——而非被动应对的审批——是2026年应有的纪律化做法。

Sources

• 国务院 (State Council) — 《关键信息基础设施安全保护条例》（2021年第745号令，2021年9月1日施行）
• 国家互联网信息办公室 (CAC) — 《网络安全审查办法》（2022年第8号令）
• 全国人民代表大会常务委员会 — 《网络安全法》（2017年6月1日施行）
• 国家互联网信息办公室 (CAC) — 关键信息基础设施安全保护相关实施规则及认定指南

• China’s data-security review is led by the CAC under the 2022 《网络安全审查办法》, reinforced by the 2021 《数据安全法》 and 《个人信息保护法》, all in force through 2026.
  中国的数据安全审查由网信办依据2022年《网络安全审查办法》主导，并辅以2021年《数据安全法》与《个人信息保护法》，上述规则在2026年持续有效。
• Network security review is mandatory for CII operators procuring network products/services that may affect national security, and for platforms holding over one million users’ personal information seeking overseas listing.
  网络安全审查对采购可能影响国家安全的网络产品/服务的关基运营者，以及拟境外上市、掌握超100万用户个人信息的平台具有强制性。
• A “data export” security assessment by the CAC is required before important data or large-scale personal information leaves China, gating many inbound and outbound deals.
  重要数据或大规模个人信息出境前，须通过网信办的数据出境安全评估，这构成众多境内外交易的关口。
• As of 2026, review focus has sharpened on cross-border data flows, algorithm filing, and the security of core data centres and cloud services.
  截至2026年，审查重点已聚焦跨境数据流动、算法备案，以及核心数据中心与云服务的安全。
• Deal teams must screen data assets for “important data” classification and build CAC assessment timelines into the transaction schedule.
  交易团队须对数据资产是否构成”重要数据”进行筛查，并将网信办评估时限纳入交易时间表。
• Penalties for non-compliance include rectification, suspension of data-export activities, fines, and in serious cases criminal referral.
  违规后果包括责令改正、暂停数据出境活动、罚款，严重者移送刑事处理。

Data Security Review in China: CAC-Led Controls for 2026 | 中国数据安全审查：2026年网信办主导的管控

The Legal Triad

China’s data governance rests on three pillars, all operative in 2026:

• The 《网络安全法》 (Cybersecurity Law, effective 1 June 2017);
• The 《数据安全法》 (Data Security Law, effective 1 September 2021);
• The 《个人信息保护法》 (PIPL, effective 1 November 2021).

These are implemented and enforced, for security-review purposes, primarily by the Cyberspace Administration of China (CAC, 国家互联网信息办公室). The central procedural instrument is the 《网络安全审查办法》 (Network Security Review Measures), revised by the CAC with twelve other departments and effective from 1 June 2022 (CAC Order No. 8).

When Network Security Review Is Mandatory

Two scenarios trigger a mandatory CAC-led review:

1. Critical Information Infrastructure (CII) operators procuring network products or services that may affect national security. The CII operator must apply for review through its industry regulator; the product or service cannot be procured before clearance.
2. Platform operators with personal information of more than one million users that seek an overseas listing (initial public offering outside mainland China). Such a listing requires a CAC security review beforehand.

The review examines risks of control by foreign governments, data tampering or leakage, supply-chain disruption, and the concentration of important data.

Data Export Security Assessment

Perhaps the most transaction-relevant mechanism is the CAC’s security assessment for cross-border data transfers. Under PIPL and the Data Security Law, before “important data” or large volumes of personal information are transferred outside China, the handler must pass a CAC-led assessment (or meet an alternative pathway such as certification or a standard contract, subject to thresholds). For market entrants, this gates:

• Sharing group data with an overseas parent;
• Cloud or SaaS arrangements routing data offshore;
• M&A where the target’s data must be integrated into a foreign group.

The assessment evaluates the necessity of the transfer, the volume and sensitivity of data, and the protection level in the receiving jurisdiction.

2026 Enforcement Emphasis

Entering 2026, CAC activity has concentrated on:

• Cross-border flow governance, including tightening of important-data inventories and the promotion of free-trade-zone “negative lists” for data export;
• Algorithmic governance, with the 2022 《互联网信息服务算法推荐管理规定》 requiring algorithm filing for recommendation services;
• Core infrastructure security, covering data centres, cloud, and large-platform resilience.

The through-line is that data is treated as a sovereign asset: control over it, and its movement across borders, is a national-security question, not merely a privacy one.

Practical Steps for Entrants

1. Classify the data. Determine whether the target holds “important data” or “core data”, and quantify personal-information volumes against the one-million-user and export thresholds.
2. Map transfer pathways. Identify every outbound flow—group reporting, vendor access, cloud replication—and match it to the correct mechanism (assessment, certification, standard contract).
3. File early for listings. Any overseas IPO by a qualifying platform must clear CAC review before launch.
4. Negotiate the SPA. Make data-export clearance a condition precedent and allocate remediation costs.
5. Localise where needed. In-sector data centres and in-China storage reduce exposure.

Consequences of Non-Compliance

CAC can order rectification, suspend data-export activities, confiscate unlawful gains, and impose fines reaching significant sums; serious cases may trigger criminal referral. For an acquirer, unmitigated data-export risk can destroy the value of a data-rich target and delay or block an overseas listing. Treating data-security review as a parallel, co-equal workstream to antitrust and foreign-investment review is now standard prudence.

中国数据安全审查：2026年网信办主导的管控

法律三重支柱

中国数据治理建立在三大支柱之上，均于2026年有效：

• 《网络安全法》（2017年6月1日施行）；
• 《数据安全法》（2021年9月1日施行）；
• 《个人信息保护法》（2021年11月1日施行）。

就安全审查而言，上述法律主要由国家互联网信息办公室（网信办）实施与执行。其核心程序性文件是《网络安全审查办法》——由网信办联合其他十二部门修订，自2022年6月1日起施行（第8号令）。

网络安全审查的强制触发

两类情形触发网信办主导的强制性审查：

1. 关键信息基础设施运营者采购可能影响国家安全的网络产品或服务。关基运营者须通过行业主管部门申报审查，且在获批前不得采购该产品或服务。
2. 掌握超过100万用户个人信息的平台运营者拟赴境外上市（在中国大陆以外首次公开发行）。此类上市须事先通过网信办安全审查。

审查评估被外国政府控制、数据被篡改或泄露、供应链中断，以及重要数据集中等方面的风险。

数据出境安全评估

最具交易相关性的机制，或许是网信办主导的数据出境安全评估。依据《个人信息保护法》与《数据安全法》，在”重要数据”或大规模个人信息向境外提供前，处理者须通过网信办评估（或满足认证、标准合同等替代路径，并受门槛限制）。对市场准入者而言，这构成以下交易的关口：

• 与境外母公司共享集团数据；
• 将数据离岸路由的云或 SaaS 安排；
• 标的的数据须并入外国集团的并购交易。

评估考察传输的必要性、数据的体量及敏感性，以及接收方所在法域的保护水平。

2026年执法重点

进入2026年，网信办的工作集中于：

• 跨境流动治理，包括收紧重要数据目录，并推动自贸试验区数据出境”负面清单”；
• 算法治理，依据2022年《互联网信息服务算法推荐管理规定》对推荐服务实行算法备案；
• 核心基础设施安全，涵盖数据中心、云及大型平台韧性。

其内在逻辑在于：数据被视为一种主权资产——对其的控制及跨境流动，是一个国家安全问题，而非单纯的隐私问题。

市场准入实务步骤

1. 对数据分类。 判定标的是否持有”重要数据”或”核心数据”，并量化个人信息体量，对照100万用户及出境门槛。
2. 梳理传输路径。 识别每一处出境流向——集团报告、供应商访问、云端复制——并匹配正确机制（评估、认证、标准合同）。
3. 上市前尽早申报。 符合条件的平台赴境外上市须在启动前通过网信办审查。
4. 协商协议条款。 将数据出境审批设为先决条件，并分配补救成本。
5. 必要时本地化。 境内数据中心与境内存储可降低风险敞口。

违规后果

网信办可责令整改、暂停数据出境活动、没收违法所得，并处以可观罚款；严重者可移送刑事处理。对收购方而言，未缓释的数据出境风险可能摧毁数据富集型标的的价值，并拖延或阻断境外上市。将数据安全审查视为与反垄断、外商投资审查并行且同等重要的工作流，已成为标准审慎做法。

Sources

• 国家互联网信息办公室 (CAC) — 《网络安全审查办法》（2022年第8号令，2022年6月1日施行）
• 国家互联网信息办公室 (CAC) — 数据出境安全评估相关规定及申报指南
• 全国人民代表大会常务委员会 — 《数据安全法》（2021年9月1日施行）、《个人信息保护法》（2021年11月1日施行）
• 国家互联网信息办公室 (CAC) — 《互联网信息服务算法推荐管理规定》（2022年）

• Foreign acquisitions of Chinese technology companies are swept into three overlapping regimes: MOFCOM/NDRC security review, SAMR antitrust clearance, and technology-export licensing.
  外资收购中国科技企业同时落入三套相互叠加的制度：发改委/商务部安全审查、市场监管总局反垄断审批，以及技术出口许可。
• The Catalogue of Prohibited and Restricted Technology Exports (revised 2020, with ongoing 2023–2025 refinement) can block or condition the transfer of sensitive know-how embedded in a target.
  《中国禁止出口限制出口技术目录》（2020年修订，并在2023–2025年持续完善）可阻止或附条件于标的中敏感技术诀窍的转移。
• “Control” of a critical-technology enterprise triggers mandatory national security review even below merger thresholds, and semiconductors sit at the centre of 2026 scrutiny.
  取得关键技术企业”控制权”即便未达并购门槛亦触发强制性国家安全审查，而半导体正处于2026年审查的核心。
• The 2022 revised Anti-Monopoly Law and SAMR guidance treat entanglements between tech giants and startups as potentially competition-reducing, adding a second gate.
  2022年修订《反垄断法》及市场监管总局指引将科技巨头与初创企业间的捆绑视为可能减损竞争，构成第二道关口。
• Deals should budget for parallel timelines and build a technology-export clearance condition into the SPA before signing.
  交易应为并行的审查时限预留预算，并在签约前于股权转让协议中设置技术出口审批先决条件。
• As of 2026, the “small yard, high fence” approach means narrow but strict controls on frontier tech rather than blanket bans, raising the premium on precise target mapping.
  截至2026年，”小院高墙”思路意味着对前沿技术采取范围窄但强度高的管控，而非全面禁止，这进一步凸显精确梳理标的的重要性。

Key Technology M&A Review in China: Security Meets Competition | 中国关键技术并购审查：安全与竞争的双重关口

Three Regimes, One Deal

A foreign buyer pursuing a Chinese technology target rarely faces a single clearance. Three regimes routinely converge:

1. National security review under the 2020 《外商投资安全审查办法》 (MOFCOM/NDRC Order No. 37) where the target sits in a key sector or holds critical technology.
2. Antitrust merger control under the 《反垄断法》 administered by SAMR, where turnover thresholds are met.
3. Technology-export control under the 《技术进出口管理条例》 and the 《中国禁止出口限制出口技术目录》 (Catalogue of Prohibited and Restricted Technology Exports), which governs whether the underlying know-how can lawfully leave Chinese control.

The third regime is the one most often missed by foreign teams who plan only for antitrust and security review.

The Technology Export Catalogue

The Catalogue, administered by MOFCOM, lists technologies whose export is prohibited or restricted. The 2020 revision significantly expanded restricted entries—adding or tightening items across civilian drones, AI, quantum computing, laser, and satellite technologies. It was further refined through 2023–2025 consultations, and as of 2026 the restricted list captures a broad band of frontier and dual-use know-how. Where a target’s value depends on a restricted technology, the buyer must obtain an export licence (or restructure to keep the technology in China) before the deal can close. Failure to do so can void the transaction or attract penalties.

Security Review of Tech Targets

Under Order No. 37, acquiring “control” of an enterprise in critical and emerging technologies triggers mandatory security review. The 2026 posture is unambiguous: semiconductors, advanced packaging, EDA tools, and certain AI model capabilities are treated as core national-security assets. The review’s two-stage clock (30 + 60+ working days) applies, and conditions short of prohibition—such as onshore retention of R&D, governance limits, or data-localisation—are common outcomes.

The Antitrust Overlay

Even where security review is cleared, SAMR merger control may independently bite. The 2022 revised 《反垄断法》 strengthened the treatment of “gun-jumping” and introduced a stop-the-clock mechanism for deficient filings. For tech deals, SAMR’s 2021 《关于平台经济领域的反垄断指南》 and subsequent guidance signal that acquisitions by dominant platforms of nascent competitors warrant close scrutiny for potential elimination of future competition. A clean security clearance does not immunise a deal from an antitrust hold.

“Small Yard, High Fence” in Practice

China’s 2024–2026 technology-control posture is often described as “small yard, high fence”: the restricted perimeter is deliberately narrow but the controls within it are strict. For market entrants this means most ordinary technology transactions proceed, but any target touching listed frontier items—advanced chips, certain algorithms, cryptography, and dual-use sensors—will face a high wall. Precise target mapping against the Catalogue and the key-sector annex is therefore the single highest-leverage step in deal planning.

Practical Deal Structuring

• Run a tri-regime screen early. Map the target to the security-review key sectors, the merger thresholds, and the export Catalogue simultaneously.
• Sequence the filings. Export-licence applications and security-review filings often inform each other; begin both before signing.
• Use SPA conditions precedent for export approval and security clearance, with long-stop dates reflecting the special-review clock.
• Consider onshore carve-outs. Retaining restricted technology and R&D within a Chinese subsidiary, while the foreign parent acquires non-restricted assets, can clear the export gate.
• Plan for behavioural remedies. Expect possible commitments on R&D location, local data storage, and board governance.

Consequences of Missteps

A technology-export violation is distinct from, and can be more severe than, a security-review failure: the restricted know-how cannot lawfully transfer, which may collapse the deal’s value thesis. Combined with possible antitrust hold and security-order unwinding, the cumulative risk is substantial. Foreign acquirers should treat the Catalogue as a first-read document, not an afterthought.

中国关键技术并购审查：安全与竞争的双重关口

三套制度，一项交易

外资收购中国科技标的，鲜少只需一道审批。三套制度通常会汇聚于同一交易：

1. 国家安全审查：依据2020年《外商投资安全审查办法》（发改委/商务部第37号令），当标的位于关键领域或掌握关键技术时适用。
2. 反垄断经营者集中审查：依据《反垄断法》，由市场监管总局主管，于营业额达标时适用。
3. 技术出口管制：依据《技术进出口管理条例》及《中国禁止出口限制出口技术目录》，规范底层技术诀窍能否合法移出中国控制。

第三套制度最常被只规划反垄断与安全审查的外资团队忽视。

技术出口目录

该目录由商务部主管，列明禁止或限制出口的技术。2020年修订大幅扩充了限制类条目——在民用无人机、人工智能、量子计算、激光及卫星技术等方面新增或收紧了项目。该目录在2023–2025年通过征求意见持续完善，截至2026年，限制清单已覆盖广泛的前沿与两用技术诀窍。当标的价值依赖某项受限技术时，买方须在交割前取得出口许可（或将技术留在中国境内并重组交易）。否则交易可能被认定无效或招致处罚。

科技标的的安全审查

依据第37号令，取得关键和新兴技术企业”控制权”将触发强制性安全审查。2026年的立场十分明确：半导体、先进封装、EDA工具及部分人工智能模型能力被视为核心国家安全资产。审查的两段式时限（30 + 60个工作日起）适用，而低于禁止水平的附条件措施——如研发境内留存、治理限制或数据本地化——是常见结果。

反垄断叠加

即便安全审查通过，市场监管总局的经营者集中审查仍可能独立介入。2022年修订的《反垄断法》强化了对”抢跑”行为的规制，并引入了针对瑕疵申报的”停钟”机制。对于科技交易，市场监管总局2021年《关于平台经济领域的反垄断指南》及后续指引表明， dominant 平台收购新生竞争对手的交易，将因可能消除未来竞争而受到密切审视。安全审查的通过并不能使交易豁免反垄断阻却。

“小院高墙”的实践

中国2024–2026年的技术管控态势常被概括为”小院高墙”：受限范围刻意收窄，但其中的管控强度很高。对市场准入者而言，这意味着多数普通技术交易可正常推进，但凡触及所列前沿项目——先进芯片、特定算法、密码学及两用传感器——的交易都将面临高墙。因此，对照目录与关键领域附件精确梳理标的，是交易规划中杠杆率最高的一步。

交易结构实务

• 尽早开展三制度筛查。 同步将标的映射至安全审查关键领域、并购门槛及出口目录。
• 统筹申报顺序。 出口许可申请与安全审查申报常相互影响，应在签约前同步启动。
• 在协议中设置审批先决条件，针对出口批准与安全审查设置反映特别审查时限的最晚截止日。
• 考虑境内分拆。 将受限技术与研发保留于中国子公司，由外国母公司收购非受限资产，可越过出口关口。
• 为行为性救济作准备。 应预判可能涉及研发地点、本地数据存储及董事会治理方面的承诺。

失误后果

技术出口违规不同于安全审查失败，且可能更为严重：受限技术诀窍无法合法转移，可能从根本上瓦解交易的价值逻辑。叠加可能的反垄断阻却与安全审查撤销令，累积风险相当可观。外资收购方应将技术目录视为首要审阅文件，而非事后补充。

Sources

• 商务部 (MOFCOM) — 《中国禁止出口限制出口技术目录》（2020年修订，并在2023–2025年持续完善）
• 国家发展和改革委员会、商务部 (NDRC & MOFCOM) — 《外商投资安全审查办法》（2020年第37号令）
• 国家市场监督管理总局 (SAMR) — 《关于平台经济领域的反垄断指南》及经营者集中审查相关规定
• 国务院 (State Council) — 《反垄断法》（2022年修订，2022年8月1日施行）

• China’s foreign investment security review is a mandatory, two-stage regime administered by MOFCOM and NDRC under the 2020 Measures (Order No. 37), in force since 18 January 2021.
  中国外商投资安全审查是由商务部与国家发展改革委依据2020年《外商投资安全审查办法》（第37号令，自2021年1月18日起施行）实施的强制性两段式审查制度。
• Acquiring “control” of a Chinese entity in defined key sectors—defence, technology, energy, transport, and data-intensive industries—triggers review even where merger-control thresholds are not met.
  在国防、科技、能源、交通及数据密集型等规定关键领域内取得中国实体”控制权”的交易，即便未达经营者集中申报标准亦触发审查。
• The general review runs 30 working days; a triggered special national security review lasts at least 60 working days and is extendable, materially affecting deal timelines.
  一般性审查时限为30个工作日；一旦启动特别审查，至少持续60个工作日且可延长，对交易时间表影响显著。
• Deals closed without clearance can be unwound, restructured, or subjected to divestment and penalties, so pre-closing analysis is essential for inbound investors.
  未经审查即完成的交易可能被责令恢复原状、变更或转让，并面临处罚，因此外资方在交割前开展分析至关重要。
• As of 2026, scrutiny has intensified around critical and emerging technologies, semiconductors, and data-rich targets, reflecting a broader whole-of-government national security posture.
  截至2026年，对关键及新兴技术、半导体以及数据富集型标的的审查明显趋严，反映出更广泛的整体政府国家安全立场。
• Foreign investors should map the key-sector catalogue, consider minority or non-control structures, and engage qualified PRC counsel early to avoid irreversible remediation.
  外资方应梳理关键领域目录，考虑少数股权或非控制型交易结构，并尽早聘请合格中国法律顾问，以避免不可逆的补救措施。

Foreign Investment Security Review in China: A 2026 Market-Entry Guide | 中国外商投资安全审查：2026年市场准入指南

The Regulatory Anchor: Order No. 37

The foreign investment national security review of the People’s Republic of China is governed by the 《外商投资安全审查办法》 (Measures for the Security Review of Foreign Investment), jointly promulgated by the National Development and Reform Commission (NDRC) and the Ministry of Commerce (MOFCOM) as Order No. 37 on 19 December 2020. The Measures entered into force on 18 January 2021 and remain the operative rulebook for 2026. They sit alongside—but are legally distinct from—the Negative List for market access and the SAMR-led antimonopoly merger-control system. A transaction can be perfectly lawful under the Negative List yet still be unwound for failing security review, a point that surprises many first-time entrants.

When Does a Review Trigger?

The Measures cast a wide net. Two principal scenarios require mandatory review:

• Military and adjacent zones. Any foreign investment in enterprises engaged in military-industrial production or in scientific research and design units serving national defence, and any foreign investment within the prescribed perimeter around military facilities and military-use ports, airports, and border crossings.
• Control of key-sector enterprises. Where a foreign investor acquires “control” (控制权) of a domestic enterprise whose business falls within the key areas enumerated in the Measures’ annex. These cover national defence and the military; agriculture, energy and mineral resources; infrastructure, transport, and utilities; and critical and emerging technologies.

“Control” is defined functionally—holding 50% or more of voting rights, or otherwise being able to exert a decisive influence over the target’s resolutions, board, or operations. Importantly, the review can bite even where the deal is too small to meet SAMR’s merger-notification thresholds, making it a trap for unwary minority-led acquisitions structured as control.

The Two-Stage Adjudicative Process

The system is deliberately sequential:

If the general review finds no national security concern, the transaction clears. If concerns arise, it escalates to the special review, which may impose conditions, prohibit the deal, or—retrospectively—order restructuring or divestment. Parties may also file voluntarily where uncertain, buying certainty at the cost of timetable.

Interaction with the Negative List and Other Regimes

Security review operates in parallel with the foreign investment Negative List. The 2024 edition of the 《外商投资准入特别管理措施（负面清单）》 issued by NDRC and MOFCOM continues to restrict or prohibit foreign investment in a catalogue of sectors; a transaction permitted by the Negative List is not exempt from security review. The same deal can concurrently require SAMR merger clearance, a CAC data-security assessment, and MOFCOM/NDRC security review. Sequencing these workstreams deliberately is now standard deal hygiene for China inbound M&A.

The 2026 Enforcement Posture

Although Order No. 37 dates from 2020, its application has sharpened. Entering 2026, reviewing authorities have visibly prioritised:

• Critical and emerging technologies, especially semiconductors, advanced computing, and dual-use items;
• Data-rich targets, where control would concentrate sensitive personal or important data in foreign hands;
• Infrastructure and utilities with geopolitical sensitivity.

This intensification tracks the broader national-security framing of the 2021 《数据安全法》 (Data Security Law) and the 2022 revised 《反垄断法》 (Anti-Monopoly Law), and the steady refinement of the foreign investment Negative List’s restricted catalogues. Inbound investors should assume that any deal touching these sectors will receive heightened scrutiny and should budget for the full special-review clock.

Practical Steps for Market Entrants

1. Map the target against the key-sector annex before signing. A control transaction in a listed area is presumptively reviewable.
2. Model alternative structures. Minority stakes, golden-share arrangements held by domestic partners, or contractual (rather than equity) control may avoid a “control” finding—each carries its own legal nuance and must be assessed on the facts.
3. File early and voluntarily when in doubt. The 30-working-day general clock starts on acceptance; waiting until signing can compress the deal timeline dangerously.
4. Build remediation into the SPA. Include conditions precedent, long-stop dates, and reverse termination fees calibrated to a possible special review.
5. Coordinate with merger-control and cybersecurity reviews so that one clearance does not silently prejudice another.

Consequences of Getting It Wrong

Transactions completed without required clearance are vulnerable: the reviewing authority may order the foreign investor to dispose of the interest, transfer assets, change the structure, or restore the original state, and may impose penalties. Because unwinding a closed deal is costly and often practically impossible, the commercial risk is borne almost entirely by the buyer. For this reason, security-review analysis is now a standard workstream in any China inbound transaction involving sensitive sectors.

How This Compares Globally

The Chinese regime is frequently compared with the U.S. CFIUS process. Both are ex ante, national-security-oriented, and capable of blocking or conditioning foreign acquisitions. China’s system is distinctive in its explicit sector catalogue, its codified two-stage timeline, and its tight coupling with the Negative List and the data-security regime. Investors familiar with CFIUS will recognise the logic but should not assume the timelines or sector scope translate directly.

中国外商投资安全审查：2026年市场准入指南

制度基石：第37号令

中国的外商投资国家安全审查由《外商投资安全审查办法》规范。该办法由国家发展改革委与商务部于2020年12月19日联合发布（第37号令），自2021年1月18日起施行，并仍是2026年适用的规则基础。它与市场准入负面清单以及国家市场监管总局主导的经营者集中反垄断审查在法律上相互独立。实践中，一项交易即便完全符合负面清单规定，仍可能因未通过安全审查而被否决或撤销，这一点常令初次进入中国市场的投资者感到意外。

哪些交易触发审查？

《办法》的适用范围相当广泛，主要存在两类强制审查情形：

• 军工及邻近区域。 外国投资者对军工生产企业和军工科研设计单位，以及对军工设施、军用港口、机场、边境口岸周边划定区域内的投资。
• 关键领域企业控制权。 外国投资者取得境内企业”控制权”（控制权），且该企业经营业务落入《办法》附件所列关键领域，包括国防军工、农业、能源与矿产资源、基础设施、交通运输，以及关键和新兴技术。

“控制权”采功能化定义——持有50%以上表决权，或能够对被审查企业决议、董事会或经营施加决定性影响。值得注意的是，即便交易规模过小而未达市场监管总局的经营者集中申报标准，仍可能触发安全审查，这对以控制为目的、却采用少数股权安排的收购构成潜在陷阱。

两段式审查程序

该制度在程序设计上呈顺序递进：

若一般性审查未发现国家安全风险，交易即获通过。若存在风险，则进入特别审查，审查机关可附加条件、禁止交易，或在事后责令变更或剥离。当事人亦可在不确定时主动申报，以时间换取确定性。

与负面清单及其他制度的衔接

安全审查与外商投资负面清单并行。国家发展改革委、商务部发布的《外商投资准入特别管理措施（负面清单）》2024年版继续在目录中对部分领域采取限制或禁止。符合负面清单的交易并不豁免安全审查。同一项交易可能同时需要市场监管总局的经营者集中审批、网信办的数据安全评估，以及发改委/商务部的安全审查。审慎地统筹这些工作流，已成为中国 inbound 并购的标准操作。

2026年执法态势

尽管第37号令颁布于2020年，但其适用在近年明显趋严。进入2026年，审查机关明显优先关注以下领域：

• 关键和新兴技术，特别是半导体、先进计算与两用物项；
• 数据富集型标的，控制此类标的将使敏感个人信息或重要数据集中于外资之手；
• 具有地缘政治敏感性的基础设施与公用事业。

这一趋严态势与2021年《数据安全法》及2022年修订《反垄断法》所确立的广义国家安全框架一脉相承，也与外商投资负面清单受限目录的持续完善相呼应。外资方应预判：任何涉及上述领域的交易都将受到更高强度审查，并应为完整的特别审查时限预留预算。

市场准入实务步骤

1. 签约前对照关键领域附件梳理标的。 在列明领域内取得控制权的交易，原则上具有可审查性。
2. 设计替代交易结构。 少数股权、由境内合作方持有的”金股”安排，或合同控制（而非股权控制）可能避免构成”控制权”认定——但每种安排均有其法律细微差别，须依事实评估。
3. 存疑时尽早主动申报。 30个工作日的一般性审查时限自受理起算；等到签约后再申报会严重压缩交易时间表。
4. 在股权转让协议中嵌入补救机制。 设置先决条件、最晚截止日，以及针对可能出现的特别审查的反向终止费。
5. 统筹经营者集中与网络安全审查，避免一项审批在无意中损及另一项。

违规后果

未经审查即完成的交易面临风险：审查机关可责令外国投资者转让股权、转移资产、变更结构或恢复原状，并可能处以处罚。由于已交割交易的撤销成本高昂且往往在实操中难以实现，商业风险几乎完全由买方承担。正因如此，安全审查分析已成为任何涉及敏感领域的中国 inbound 交易的标准工作流。

国际比较

中国的审查制度常被与美国 CFIUS 程序比较。二者均属事前、以国家安全为导向、并可禁止或附加条件于外资收购。中国的制度特点在于其明确的行业目录、成文的二段式时限，以及与负面清单及数据安全制度紧密耦合。熟悉 CFIUS 的投资者可识别其逻辑，但不应想当然地认为时限或行业范围可直接对应。

Sources

• 国家发展和改革委员会、商务部 (NDRC & MOFCOM) — 《外商投资安全审查办法》（2020年12月19日第37号令，2021年1月18日施行）
• 国家发展和改革委员会、商务部 (NDRC & MOFCOM) — 《外商投资准入特别管理措施（负面清单）》（2024年版）
• 商务部 (MOFCOM) — 外商投资安全审查申报工作指引及相关实施口径
• 国务院 (State Council) — 《国家安全战略》框架下外商投资国家安全审查相关部署