- Previous rule summary
- No equivalent standalone article.
- Compared rule summary
- Adds a provision on leadership, overall national security, development and security.
Practical impact: Keep this national-policy provision separate from specific operational duties.
Amendment decision item 1. Original editorial summary; the official text controls.
− deletedFormer Article 18 → Article 19
- Previous rule summary
- Article 18 had two paragraphs; the second supported innovative cybersecurity management using new network technologies.
- Compared rule summary
- Renumbers the article as 19 and removes its second paragraph.
Practical impact: Update clause maps; this is distinct from the separately added AI article.
Amendment decision item 2. Original editorial summary; the official text controls.
- Previous rule summary
- No equivalent standalone AI article; former Article 18(2) had general technology language.
- Compared rule summary
- Adds AI research, infrastructure, ethics, risk monitoring and security oversight; also supports AI-enabled cybersecurity management.
Practical impact: Policy recognition of AI does not replace applicable AI-service or personal-information rules.
Amendment decision item 3. Original editorial summary; the official text controls.
i clarifiedFormer Article 40 → Article 42
- Previous rule summary
- Required confidentiality and a protection system for collected user information.
- Compared rule summary
- Adds an express Civil Code and PIPL cross-reference for personal-information processing.
Practical impact: Cross-reference the specialised personal-information regime rather than treating CSL controls as exhaustive.
Amendment decision item 4. Original editorial summary; the official text controls.
~ modifiedFormer Article 59 → Article 61: network operators
- Previous rule summary
- For specified protection-duty failures: correction and warning; refusal or harmful consequences triggered RMB 10,000–100,000, with RMB 5,000–50,000 for directly responsible managers.
- Compared rule summary
- Initial failure can additionally attract RMB 10,000–50,000. Refusal or harmful consequences: RMB 50,000–500,000; RMB 10,000–100,000 for directly responsible managers and other directly responsible persons.
Practical impact: Both the sanction stage and the personal-liability scope change. The referenced duties are now Articles 23 and 27.
Amendment decision item 5. Original editorial summary; the official text controls.
~ modifiedArticle 61: critical information infrastructure operators
- Previous rule summary
- Correction and warning; refusal or harmful consequences: RMB 100,000–1,000,000; managers RMB 10,000–100,000.
- Compared rule summary
- Initial failure can additionally attract RMB 50,000–100,000. The ordinary refusal/consequence entity band stays RMB 100,000–1,000,000; the personal band now also covers other directly responsible persons.
Practical impact: Do not say every existing CII penalty band increased. Separate new initial fines, personal scope and aggravated consequences.
Amendment decision item 5. Original editorial summary; the official text controls.
+ addedArticle 61(3): aggravated consequences
- Previous rule summary
- Former Article 59 had no equivalent express two-tier consequence band.
- Compared rule summary
- For the preceding duty failures causing serious consequences, such as large-scale leakage or partial CII loss of function: RMB 500,000–2,000,000; individuals RMB 50,000–200,000. Particularly serious consequences, such as loss of main CII functions: RMB 2,000,000–10,000,000; individuals RMB 200,000–1,000,000.
Practical impact: The RMB 10 million ceiling is not a flat fine for every security incident. Identify duty, responsible entity, causation and consequence tier.
Amendment decision item 5. Original editorial summary; the official text controls.
~ modifiedFormer Article 60 → Article 62
- Previous rule summary
- Covered malicious programs, failures to remedy/report security defects, and premature termination of maintenance.
- Compared rule summary
- Adds the Article 61(3) consequence bands for the first two categories when the specified consequences occur.
Practical impact: Do not apply the added cross-reference indiscriminately to all three categories.
Amendment decision item 6. Original editorial summary; the official text controls.
+ addedNew Article 63: regulated products
- Previous rule summary
- Article 23 imposed certification/testing requirements, but there was no corresponding standalone liability article.
- Compared rule summary
- Adds liability for selling/providing listed non-compliant equipment/products: warning, cessation, confiscation and RMB 20,000–100,000 where illegal gains are below RMB 100,000 or absent; otherwise 1–5 times illegal gains. Serious cases can attract business/licence measures.
Practical impact: Distinguish product eligibility evidence from the buyer's separate security-review obligations.
Amendment decision item 7. Original editorial summary; the official text controls.
~ modifiedFormer Article 61 → Article 64
- Previous rule summary
- Real-identity failures could lead to website closure and specified business/licence measures.
- Compared rule summary
- Adds application closure to the listed measures.
Practical impact: Review website and app remediation together; this item does not rewrite the entire monetary band.
Amendment decision item 8. Original editorial summary; the official text controls.
~ modifiedFormer Article 62 → Article 65
- Previous rule summary
- For specified certification/testing/risk-assessment or security-information publication violations: warning; refusal/serious cases RMB 10,000–100,000, individuals RMB 5,000–50,000.
- Compared rule summary
- Adds an initial discretionary RMB 10,000–100,000 fine. Refusal/serious cases: RMB 100,000–1,000,000; individuals RMB 10,000–100,000, plus specified business measures. Article 61(3) applies to the stated aggravated consequences.
Practical impact: Assess the regulated activity and disclosure workflow; do not treat this as a general fine for all security research.
Amendment decision item 9. Original editorial summary; the official text controls.
~ modifiedFormer Article 65 → Article 67
- Previous rule summary
- CII use of products/services without required security-review clearance: stop use; fine of 1–10 times purchase value and individuals RMB 10,000–100,000.
- Compared rule summary
- Keeps those monetary bands and adds time-limited correction and elimination of national-security effects.
Practical impact: Changes remediation obligations, not the stated purchase-value multiplier.
Amendment decision item 10. Original editorial summary; the official text controls.
~ modifiedFormer Article 68 and Article 69(1) → Article 69
- Previous rule summary
- Prohibited-information handling and compliance with takedown directions were in separate provisions.
- Compared rule summary
- Combines the duties and introduces initial RMB 50,000–500,000 fines; refusal/serious cases RMB 500,000–2,000,000 and individuals RMB 50,000–200,000. Particularly serious effects/consequences: RMB 2,000,000–10,000,000 and individuals RMB 200,000–1,000,000, with the specified business/licence measures.
Practical impact: Map stopping transmission, removal, record retention and reporting separately. The second paragraph has its own consequence trigger.
Amendment decision item 11. Original editorial summary; the official text controls.
↔ proceduralFormer Articles 64, 66 and 70 → Article 71
- Previous rule summary
- PI infringement, CII overseas storage/transfer and prohibited information had separate liability provisions.
- Compared rule summary
- Consolidates cross-references to applicable laws and administrative regulations, with a separate police-penalty provision for specified unlawful acquisition/supply of PI short of crime.
Practical impact: A cross-reference is not removal of liability. Identify the specialised legal basis rather than reusing a repealed fine.
Amendment decision item 12. Original editorial summary; the official text controls.
- Previous rule summary
- No equivalent express CSL article referring to mitigation under the Administrative Penalty Law.
- Compared rule summary
- Expressly applies the statutory circumstances for lighter, reduced or no punishment.
Practical impact: Preserve factual remediation evidence; the provision does not promise automatic leniency.
Amendment decision item 13. Original editorial summary; the official text controls.
~ modifiedFormer Article 75 → Article 77
- Previous rule summary
- Focused on overseas attacks or related activities against PRC CII causing serious consequences.
- Compared rule summary
- Uses broader conduct endangering PRC cybersecurity, with property freezing or other necessary sanctions possible for serious consequences.
Practical impact: Do not limit the revised wording to CII attacks; distinguish basic liability wording from the serious-consequence sanctions trigger.
Amendment decision item 14. Original editorial summary; the official text controls.