Regulatory intelligence
Track 2025–2026 developments as effective rules, upcoming obligations, drafts, guidance, enforcement and operational notices.
CAC distinguishes certification as an export route from voluntary certification, and confirms that a required security assessment cannot be replaced by a certificate. The route guide explains the thresholds and practical consequences.
The implementation Q&A explains the encouraged certification route for assessment providers and the reporting authority for important-data annual assessments. Read these explanations alongside the operative measures, not as a new universal certification requirement.
The Q&A discusses reasonable reuse of public personal information and common security failures. Our accompanying guide provides purpose, scope and security checks with hypothetical recruitment and marketing examples.
The consultation closed on 7 September 2026. Closing the feedback window does not make the proposal effective. The research guide separates designation and proposed governance changes from current duties.
The Cybersecurity Review Office announced that it had opened a cybersecurity review of products sold in China by Palo Alto Networks. The short notice records the start of a review; it does not announce a final finding, a general prohibition, or a suspension applicable to every product user.
The joint CAC and Ministry of Public Security provisions define eligible small processors by a fewer-than-100,000-person threshold and establish proportionate compliance measures, including simplified audit, impact-assessment and selected cross-border data transfer arrangements. They take effect on 1 September 2026.
The official Q&A addresses notification and separate-consent duties, extension conditions for security assessments for cross-border data transfers, and necessity questions for recruitment-related transfers. It is implementation guidance rather than a new binding rule.
July filing publications report service and algorithm filing activity. They are grouped as operational updates and do not create a new generally binding rule.
A revised draft was released for public comment. It remains a consultation document and is not presented as current law.
The final measures replace the 2025 consultation proposal and introduce a 20-working-day reporting period for specified assessments. They take effect on 20 August 2026.
The CAC released a consultation draft for distributed digital identity services. It is tracked as a draft and does not yet impose effective obligations.
TC260 opened a draft revision related to GB/T 35273-2020 for public comment. The draft is not an effective national standard and should be monitored as a possible successor framework.
The joint provisions govern multi-channel distribution of internet information services and take effect on 1 September 2026.
The guideline is tracked as policy guidance for AI application governance, distinct from binding laws and departmental rules.
Five authorities issued policy guidance on the development and regulated application of intelligent agents. It is tracked as guidance rather than a binding departmental rule.
The official Q&A addresses implementation questions and is classified as guidance, not a new binding rule.
The interim measures establish governance requirements for anthropomorphic AI interaction services and took effect on 15 July 2026.
The measures establish a cybersecurity labeling framework and took effect on 1 July 2026. Product-catalog announcements are tracked separately as operational updates.
The draft addresses governance of digital virtual human services and is presented as a consultation document rather than current law.
The April consultation proposal was superseded by final joint CAC and Ministry of Public Security provisions published on 24 July 2026. It is retained only as version history.
The CAC announced a 2026 special enforcement campaign. This is classified as an enforcement update rather than a new source of generally binding rules.
The measures establish identification criteria for major platforms serving large numbers of minors and took effect on 1 April 2026.
The industry guideline explains security practices for automotive cross-border data transfers. It complements rather than replaces the 2021 automotive-data provisions.
The Q&A provides official implementation guidance for cross-border data transfer pathways and is classified separately from binding rules.
The measures establish a classification framework for online information affecting minors and took effect on 1 March 2026.
The consultation draft addresses app collection and use of personal information. It remains a draft and is not described as current law.
The official Q&A is tracked as interpretive guidance and is kept separate from binding laws and departmental rules.
GB/T 46901-2025 addresses transfer based on an individual's request and GB/T 46903-2025 addresses personal information protection compliance audits. The site tracks official metadata and does not reproduce the standards.
This consultation draft was superseded by the June 2026 final measures. The comparison record preserves the procedural changes between the two versions.
The proposal targets large online platforms and remains a consultation document pending a final rule.
The amendment decision updates liability and enforcement provisions while preserving the law's broader structure. The amended text is now in force.
The measures create the binding departmental-rule layer for the certification route and retain the three-year validity and renewal timing already present in the 2022 implementation rules.
The measures establish reporting requirements for network security incidents. Dates and scope are presented only as stated in the official source.
The announcement is tracked as an operational compliance update concerning officer-information reporting, not as a new law.
The six-authority measures governing the national network identity authentication public service took effect on 15 July 2025.
The joint CAC and Ministry of Public Security measures governing facial-recognition applications took effect on 1 June 2025.
The joint labeling measures and mandatory national standard GB 45438-2025 took effect together and now form a verified part of the generative-AI source chain.
CAC Order No. 18 establishes the administrative framework for personal information protection compliance audits and took effect on 1 May 2025.
No records in this category.