- Critical Information Infrastructure (CII) protection is codified in the 2021 《关键信息基础设施安全保护条例》, effective 1 September 2021 and reinforced through 2026 implementing rules.
关键信息基础设施（CII）保护由2021年《关键信息基础设施安全保护条例》（2021年9月1日施行）确立，并通过2026年相关实施规则持续强化。- CII operators must pass CAC-led network security review before procuring network products or services that may affect national security—a direct gate on inbound technology supply.
关基运营者在采购可能影响国家安全的网络产品或服务前，须通过网信办主导的网络安全审查——这构成对境外技术供给的直接关口。- A multi-sector identification mechanism designates CII across telecommunications, energy, finance, transport, public services, and e-government.
跨行业认定机制在电信、能源、金融、交通、公共服务及电子政务等领域认定关基。- Foreign suppliers face “secure and controllable” expectations, localisation of core data, and ongoing compliance audits once inside a CII supply chain.
外国供应商一旦进入关基供应链，即面临”安全可控”要求、核心数据本地化及持续合规审计。- As of 2026, designations have broadened to cloud, data centres, and large platforms, raising diligence obligations for entrants selling into these sectors.
截至2026年，认定范围已扩展至云、数据中心及大型平台，提高了向这些行业销售的准入者尽调义务。- Missteps can exclude a vendor from CII procurement entirely, a commercial outcome more damaging than a single deal loss.
失误可能导致供应商被整体排除在关基采购之外，其商业后果甚于单一交易损失。
Critical Infrastructure Security Review in China: The CII Gate | 中国关键基础设施安全审查：CII关口
The Statutory Backbone
Critical Information Infrastructure protection in China is anchored by the 《关键信息基础设施安全保护条例》 (Regulations on the Security Protection of Critical Information Infrastructure), promulgated as State Council Order No. 745 on 30 July 2021 and effective from 1 September 2021. It sits beneath the 《网络安全法》 (2017) and works in tandem with the CAC’s 《网络安全审查办法》 (2022). Through 2026, implementing rules from the CAC and sector regulators have progressively sharpened the obligations on operators and their suppliers.
What Counts as CII?
CII means information infrastructure whose impairment or data leakage would gravely endanger national security, the national economy, or public welfare. Designation follows a multi-sector identification mechanism led by the CAC together with industry regulators. Sectors typically captured include:
- Telecommunications and broadcasting;
- Energy and power;
- Finance;
- Transport and logistics;
- Water, public-health, and other public services;
- E-government and national defence-adjacent systems.
By 2026, cloud computing platforms, large data centres, and systemically important internet platforms have been drawn into the CII perimeter, widening the population of operators—and their vendors—subject to review.
The Procurement Gate
The most consequential rule for foreign suppliers: a CII operator intending to procure network products or services that may affect national security must apply for a CAC-led network security review and may not proceed with the procurement until cleared. The review assesses:
- Risk of foreign-government control or coercion;
- Risk of tampering, surveillance, or data leakage;
- Supply-chain continuity and “secure and controllable” (安全可控) attributes.
This makes CII procurement a hard gate: a foreign technology vendor cannot close a sale into a CII operator without the operator first clearing review, often with the vendor’s own architecture and provenance under examination.
Supplier Obligations Once Designated
Suppliers that enter a CII supply chain assume durable duties:
- Secure-and-controllable commitments, including source transparency and remediation cooperation;
- Core-data localisation, keeping important and core data onshore;
- Ongoing audits, with the operator required to conduct annual self-assessments and report to the regulator;
- Incident response, with strict breach-notification timelines.
Foreign vendors should expect contractual clauses嵌入 (embedded) these obligations and should price the compliance burden accordingly.
2026 Trajectory
The 2024–2026 period has seen CII rules extended to emerging environments—edge computing, AI services, and cross-border cloud—and a tightening of the “secure and controllable” standard. For market entrants, the practical effect is that selling advanced IT, security, or cloud products into Chinese state-linked and platform customers now presupposes CII readiness. Early engagement with the operator’s regulatory channel is advisable before a bid is finalised.
Practical Guidance for Entrants
- Determine if your customer is a CII operator. If so, assume the procurement gate applies and plan for review lead time.
- Pre-position compliance artefacts: source provenance, security certifications, data-handling statements, and a local support entity.
- Avoid sole-source foreign dependencies where a domestic alternative can be paired, easing the “secure and controllable” assessment.
- Negotiate allocation of review risk in the contract—who bears delay, cost, and disqualification.
- Localise core data and operations to reduce the surface area of review.
Commercial Stakes
Exclusion from CII procurement is not a one-deal loss; it can be an industry-wide disqualification. Because CII operators span the backbone of the economy, a vendor barred on security grounds loses access to the most strategic and durable customer base in China. Treating CII readiness as a market-entry prerequisite—rather than a reactive clearance—is the disciplined approach for 2026.
中国关键基础设施安全审查：CII关口
法律主干
中国关键信息基础设施保护由《关键信息基础设施安全保护条例》确立。该条例于2021年7月30日以国务院第745号令公布，自2021年9月1日起施行。它位于《网络安全法》（2017年）之下，并与网信办《网络安全审查办法》（2022年）协同运作。2026年，网信办及各行业主管部门的实施规则持续细化运营者及其供应商的义务。
何为CII？
CII 指一旦遭到破坏、丧失功能或数据泄露，可能严重危害国家安全、国计民生或公共利益的网络基础设施。认定遵循由网信办会同行业主管部门主导的跨部门认定机制。通常被纳入的行业包括：
- 电信与广播电视；
- 能源与电力；
- 金融；
- 交通运输与物流；
- 水利、公共卫生及其他公共服务；
- 电子政务及国防相关系统。
至2026年，云计算平台、大型数据中心及具有系统重要性的互联网平台已被纳入 CII 范围，扩大了须接受审查的运营者及其供应商群体。
采购关口
对外国供应商最具约束力的规则是：关基运营者采购可能影响国家安全的网络产品或服务，须申报网信办主导的网络安全审查，且未获通过前不得采购。审查评估以下方面：
- 受外国政府控制或胁迫的风险；
- 被篡改、监视或数据泄露的风险；
- 供应链连续性及”安全可控”属性。
这使关基采购成为一道硬关口：外国技术供应商若未先由运营者通过审查（往往需审查供应商自身的架构与来源），便无法向关基运营者完成销售。
认定后的供应商义务
进入关基供应链的供应商须承担持续性义务：
- 安全可控承诺，包括来源透明与配合整改；
- 核心数据本地化，将重要数据与核心数据留存境内；
- 持续审计，运营者须开展年度自评估并向监管报告；
- 事件响应，须遵守严格的泄露通报时限。
外国供应商应预期合同中嵌入上述义务条款，并据此核算合规成本。
2026年走向
2024–2026年间，CII 规则已扩展至新兴场景——边缘计算、人工智能服务及跨境云——并收紧了”安全可控”标准。对市场准入者而言，其实质影响是：向中国的国资关联及平台客户销售先进 IT、安全或云产品，如今须以 CII 就绪为前提。在投标最终确定前，宜尽早与运营者的监管渠道沟通。
市场准入实务指引
- 判定客户是否为 CII 运营者。 若是，应假定适用采购关口，并为审查预留前置时间。
- 预先备妥合规材料：来源溯源、安全认证、数据处理说明及本地支持实体。
- 避免 sole-source 外国依赖，在可搭配境内替代方案处采用，以缓解”安全可控”评估。
- 在合同中约定审查风险分配——由谁承担延误、成本与失格。
- 将核心数据与运营本地化，以缩减受审查的暴露面。
商业利害关系
被排除于关基采购之外，并非单一交易损失，而可能构成全行业失格。由于关基运营者横跨经济骨干，因安全原因被禁入的供应商将失去中国最具战略性与最稳定的客户群。将 CII 就绪作为市场准入前提——而非被动应对的审批——是2026年应有的纪律化做法。
Sources
- 国务院 (State Council) — 《关键信息基础设施安全保护条例》（2021年第745号令，2021年9月1日施行）
- 国家互联网信息办公室 (CAC) — 《网络安全审查办法》（2022年第8号令）
- 全国人民代表大会常务委员会 — 《网络安全法》（2017年6月1日施行）
- 国家互联网信息办公室 (CAC) — 关键信息基础设施安全保护相关实施规则及认定指南