Cybersecurity Law

Art. 23 enumerates five obligations: (1) adopt internal security management systems and operating procedures, name a cybersecurity officer and allocate protection responsibility; (2) deploy technical measures against computer viruses, network attacks and intrusions; (3) deploy technical measures to monitor and record network operating status and security events, and retain the relevant network logs for no less than six months; (4) apply data classification and backup and encryption of important data; and (5) perform any other duties set by law or administrative regulation. The aim is to keep the network free from interference, damage and unauthorised access, and to prevent network data from being leaked, stolen or tampered with. A CIIO carries the additional duties in Art. 36 on top of Art. 23.

Applies when

All network operators, including AI companies running inference services, internal R&D platforms and annotation platforms on domestic cloud.

Evidence to retain

• · MLPS grading report, expert review opinion and public-security filing certificate
• · MLPS assessment report and remediation closure records
• · Appointment letter for the cybersecurity officer
• · Security management policy and operating-procedure set
• · Backup and encryption policy for important data, with drill records

Estimated first-time effort: 20–50 person-days (estimate, not a commitment)

Deploy technical measures to monitor and record network operating status and security events, and retain the relevant network logs for no less than six months. For a model service this must cover authentication and login logs, API call logs, and audit logs of administrative operations and data exports, with integrity and tamper-resistance assured.

Applies when

All network operators. This can be designed jointly with the six-month log requirement in Art. 9 of the AI Content Labelling Measures for content supplied without an explicit label.

Deadline: No less than six months.

Evidence to retain

• · Log-collection scope note and field inventory
• · Screenshots of the retention policy configuration showing the retention period
• · Description of log integrity and tamper-resistance controls
• · Records of sample log retrievals

Estimated first-time effort: 5–15 person-days (estimate, not a commitment)

Network products and services must meet the mandatory requirements of the relevant national standards and must not contain malicious programs; on discovering a security defect or vulnerability the provider must take remedial action immediately, inform users as required and report to the competent authority. Providers must also maintain security support for their products and services and may not terminate it within the prescribed or agreed period. Where a product collects user information, the provider must disclose this and obtain consent.

Applies when

AI hardware and appliance vendors, robot and in-vehicle controller makers, and model vendors delivering software. Labelling of generated and synthetic content must conform to mandatory national standard GB 45438-2025.

Evidence to retain

• · List of applicable mandatory national standards and conformity evidence
• · Vulnerability management policy, SLA and remediation log
• · Records of user notifications and reports to the competent authority
• · Contract clauses on the security-maintenance period and the product lifecycle announcement

Estimated first-time effort: 10–30 person-days (estimate, not a commitment)

When arranging network access or domain registration, handling fixed-line or mobile subscriptions, or providing users with information-publishing or instant-messaging services, the operator must require real identity information when signing the agreement or confirming the service; where the user does not provide it, the service must not be supplied.

Applies when

AI products with publishing, community, sharing or group-chat features; deep synthesis services are separately covered by the authentication requirement in Art. 9 of the Deep Synthesis Provisions.

Evidence to retain

• · Design note for real-identity authentication, listing the factors used and the verification channel
• · Coverage statistics and product evidence showing feature restrictions for unauthenticated users
• · Identity-authentication clauses in the user agreement
• · Note on data minimisation and encrypted storage of authentication data

Estimated first-time effort: 8–20 person-days (estimate, not a commitment)

Maintain a cybersecurity incident response plan and promptly deal with system vulnerabilities, computer viruses, network attacks and intrusions; on an incident that endangers cybersecurity, activate the plan immediately, take remedial measures and report to the competent authority as required.

Applies when

All network operators. This should be designed jointly with the personal-data notification under PIPL Art. 57 and the 24-hour report under Art. 10 of the Network Data Security Management Regulations, to avoid inconsistent accounts to different regulators.

Evidence to retain

• · Cybersecurity incident response plan with severity criteria and reporting routes
• · Annual drill plan and drill report
• · Incident tickets and timeline records
• · Text of reports to the competent authority and the receipts

Estimated first-time effort: 8–20 person-days (estimate, not a commitment)