Direct answer: Don't buy a "compliance package" first. China's revised Cybersecurity Law has been in force since 1 January 2026. Determine whether you are a network operator, a critical information infrastructure (CII) operator or a personal-information handler, then audit six areas: governance and owner, logs and monitoring, personal information, AI customer service, supplier contracts, and incident response. Not every violation attracts the maximum penalty, but legacy websites, forms and outsourcing contracts usually need work.
This report is for owners, IT/security, marketing, legal and procurement teams at companies with a corporate website, inquiry forms, mini-programs, customer data or AI customer service. It explains how to run a website and customer-data compliance check in 2026. Information is current to 30 October 2026. It is public-law research and project method, not legal advice, an MLPS assessment or a regulator's interpretation; role classification, filing, penalty application and cross-border paths are governed by the law, authorities and counsel.
The revised law took effect on 1 January 2026. AI is now in the law, but mainly as a "support development + safety supervision" framework. Existing network-operator duties on governance, logs, backups and incident response remain. Penalty ceilings are higher, but application depends on role, consequences and circumstances—not every violation is a CNY 10 million case.
What changed in China's Cybersecurity Law in 2026?
The amendment passed on 28 October 2025 and took effect on 1 January 2026. It adds AI provisions, links personal-information processing to the Civil Code and PIPL, and raises penalties for network operators and CII operators.
This is a targeted amendment, not a full rewrite. It adds Article 3 on the guiding principles of cybersecurity work; adds Article 20 on AI basic research, algorithms, training data, computing infrastructure, ethics, risk monitoring and safety supervision; renumbers Article 40 as Article 42 and adds a second paragraph requiring network operators processing personal information to comply with the Civil Code, the Personal Information Protection Law (PIPL) and other laws; and adjusts legal-liability provisions, raising some fines and adding measures such as ordering the closure of a website or application.
| Date | Event | What it means for companies |
|---|---|---|
| 7 Nov 2016 | Cybersecurity Law adopted at the 24th session of the 12th NPC Standing Committee | Effective 1 June 2017; established core cybersecurity rules |
| 28 Oct 2025 | Amendment adopted at the 18th session of the 14th NPC Standing Committee | Adds AI, personal-information linkage and stronger penalties |
| 29 Oct 2025 | Amendment published by gov.cn and CAC | Use the official text, not second-hand summaries |
| 29 Dec 2025 | CAC republishes the revised Cybersecurity Law | Article numbers have changed; cite the new text |
| 1 Jan 2026 | Amendment takes effect | Audit roles, logs, personal information and suppliers |
| 30 Oct 2026 | Information cutoff for this report | Check later rules, local enforcement and MLPS requirements separately |
Timeline based on the official amendment and revised law published by gov.cn and CAC; the latest official text governs.
Which role applies: network operator, CII operator or personal-information handler?
Most corporate website operators start as "network operators". Only entities designated as critical information infrastructure operators add CII duties. Any processing of personal information also triggers PIPL obligations.
"Network operator" does not mean only telecom carriers. A company that builds or operates a website, mini-program, app or customer system, or provides services through a network, may be a network operator. A CII operator is designated under the State Council's scope and protection rules—not self-declared by revenue or industry. A personal-information handler is a separate dimension: inquiry forms, CVs, phone numbers, cookie identifiers and AI customer-service conversations can all be personal information. The roles can overlap; choosing only one is a common mistake.
| Role | How to spot it | Main duties | Common misjudgement |
|---|---|---|---|
| Network operator | Operates a website, mini-program, app or customer system, or provides services through a network | MLPS, governance and owner, technical measures, network logs for at least six months, data classification/backup/encryption, incident plan and reporting | "The website is outsourced, so the vendor is responsible" |
| CII operator | Designated within critical information infrastructure sectors (public communications, energy, transport, finance, public services, e-government, etc.) | Adds a dedicated security organisation/owner, background checks, disaster recovery, regular drills, procurement security review and confidentiality agreements | Self-classifying by revenue, headcount or "important industry" |
| Personal-information handler | Collects inquiries, CVs, phone numbers, cookie/analytics identifiers or AI chat logs | Notice/consent, minimisation, retention, rights response, entrusted processing, cross-border path and security measures | "A checkbox on the form is enough" |
| Network product/service provider | Website vendor, SaaS, cloud, AI customer-service/model supplier | Security maintenance, vulnerability notice/report, notice and consent for data collection, entrusted-processing and incident cooperation | Buyer compares price and features only, not security duties |
| Overseas entity/individual | Conducts activities harming China's cybersecurity from abroad | Legal liability; serious cases may lead to asset freezing or other necessary sanctions | "Servers abroad mean Chinese law does not apply" |
Role classification is an editorial method, not a legal determination; CII scope, MLPS level and cross-border paths should be confirmed with authorities, sector rules and counsel.
Which scenario should you start with?
A brochure website starts with logs, forms and backups. Add supplier and conversation data for AI customer service. Add specialist review if designated as CII or involved in cross-border data.
A compliance check fails when it tries to do everything at once. The table below splits common scenarios into five starting points. There is no one template for every company, but the evidence logic is shared: who owns the system, where the data sits, who can access it, and how incidents are reported.
| Scenario | Start with | Evidence to keep |
|---|---|---|
| Brochure website + inquiry form | Confirm website owner, log retention, form fields and privacy notice | Policy/appointment, log console screenshot, field list, privacy-policy version |
| Website hosted/maintained by a vendor | Add contract roles, log ownership, vulnerability/incident notice and exit handover | Contract/annex, tickets, log-export sample, deletion/handover record |
| Cloud server/WAF/CDN | Check default log retention, backup recovery, permissions and encryption | Cloud configuration, recovery drill, permission list, encryption note |
| AI customer service/LLM | Check whether conversations contain personal information, whether the vendor trains on it, human takeover and deletion | Data-flow diagram, vendor terms, redaction/training-off setting, takeover record |
| CII-designated or cross-border | Follow CII/cross-border review, assessment and contract requirements | Designation/filing, security review, assessment/contract, drill record |
Scenario split is an editorial suggestion; whether you are CII, whether a cross-border assessment is triggered and whether MLPS filing applies should be confirmed with authorities and counsel.
Website, forms and logs: what legacy settings need fixing first?
Check five things first: who owns the site, whether logs last six months, whether form fields are minimised, whether backups and encryption are recoverable, and whether the incident contact works. These matter more than a "compliance certificate".
Article 23 of the revised Cybersecurity Law still requires network operators to follow the cybersecurity classified protection system and fulfil duties including internal security rules and procedures, a designated cybersecurity owner, technical measures against viruses/attacks/intrusions, monitoring and recording of network operation and security events with network logs retained for at least six months, and data classification/important-data backup and encryption. Article 27 requires an incident response plan, immediate activation and remedial action, and reporting under applicable rules. Many corporate websites still run on seven-day default logs, keep backups in the same cloud account, collect ID numbers and drawings in inquiry forms, and list a departed employee as the incident contact.
| Check | Legal anchor | Minimum evidence | Common trap |
|---|---|---|---|
| Security policy and owner | Article 23(1) | Policy, appointment/duties, training or meeting record | "The vendor is responsible" written only in the website contract |
| Technical measures | Article 23(2) | WAF/patch/permission/alert configuration and handling records | Plugin installed but never updated; shared admin account |
| Logs and monitoring | Article 23(3) | Logs enabled, at least six months, time sync, sample query | Cloud default of 7/30 days, or access logs only |
| Data classification/backup/encryption | Article 23(4) | Data inventory, recovery drill, encryption configuration | Backup in the same account/region as the website |
| Incident plan and reporting | Article 27 | Plan, contact list, drill record, report template | Only "call the vendor"; no internal escalation |
| MLPS level/filing/assessment | Article 23 | Classification/filing/assessment materials (if applicable) | Treating MLPS as a one-off certificate without remediation |
The table is an editorial minimum-evidence list, not a substitute for MLPS assessment, penetration testing or legal advice; log retention, filing and assessment requirements depend on role, location and sector rules.
Personal information and AI customer service: where does "technology neutral" stop working?
Inquiry forms, CVs, cookie analytics and AI chat can all be personal information. Processing must satisfy the Cybersecurity Law, Civil Code and PIPL; an AI vendor does not replace the company's notice, consent and deletion duties.
Article 42(2) of the revised Cybersecurity Law states that a network operator processing personal information must comply with the Cybersecurity Law, the Civil Code, PIPL and other laws and administrative regulations. The new Article 20 brings AI into the cybersecurity legal framework, supporting basic research, algorithms, training data and computing infrastructure while requiring ethical norms, risk monitoring/assessment and safety supervision. For companies, this is not "use AI and you are compliant"; AI customer service, AI content and AI quality inspection still need answers on data source, personal information, content labelling, supplier responsibility and human takeover.
| Scenario | Questions to ask | Acceptable evidence | High-risk practice |
|---|---|---|---|
| Inquiry form | Are fields minimised? Is purpose/retention stated? Where is consent logged? | Field list, privacy-policy version, consent log, deletion process | Collecting phone, ID, drawings and contracts in one form |
| CVs/recruitment | How long are candidate data kept? Shared with third parties? | Retention period, access control, deletion record | Indefinite retention; forwarding to unrelated parties |
| Cookies/analytics | Is notice/consent given? Is the third-party script list available? | Consent-management configuration, script list, withdrawal record | Marketing cookies on by default before consent |
| AI customer service | Does the chat contain personal information? Is the vendor training on it? Can a human take over/delete? | Data-flow diagram, vendor terms, redaction/training-off setting, takeover record | Sending customer drawings, contracts or quotes to a public model |
| AI content publishing | Is it synthetic content? Are facts, copyright and customer authorisation checked? | Labelling record, fact-check, licence/authorisation | AI-generated customer cases, certificates or "real photos" |
| Cross-border data | What is the outbound path, recipient, contract/assessment? | Data map, contract, assessment/filing materials | Overseas CRM syncing all inquiries and attachments by default |
Personal-information and AI scenarios also involve PIPL and synthetic-content labelling rules; this table is a starting point for website checks, and the path depends on data type, volume and recipient.
Penalties are higher: which risks should come first?
The revised law tiers penalties for ordinary network operators, CII operators and especially serious consequences. Fix the items that can cause data breach, website closure and personal liability—not the headline number.
The revised liability provisions raise some fine ranges and add measures such as ordering the closure of a website or application. Fines are not automatically imposed at the ceiling: role, conduct, consequences, circumstances and mitigation all matter. The priority is not "what is the maximum fine" but the items that can simultaneously trigger customer loss, business interruption and personal liability: missing logs that make an incident impossible to investigate, excessive form data, unrecoverable backups, AI customer service leaking data, and supplier contracts with no notification duty.
| Situation | Article | Statutory range | What to do first |
|---|---|---|---|
| Ordinary network operator fails security duties | Article 61 | Warning + CNY 10k–50k; refusal/consequences CNY 50k–500k; responsible persons CNY 10k–100k | Fix policy, owner, logs, backup and incident plan |
| CII operator fails security duties | Article 61 | Warning + CNY 50k–100k; refusal/consequences CNY 100k–1m; responsible persons CNY 10k–100k | Add CII organisation, review and drills |
| Massive data breach / partial loss of CII function | Article 61 | CNY 500k–2m; responsible persons CNY 50k–200k | Data map, breach handling and notification |
| Loss of main CII function / especially serious consequences | Article 61 | CNY 2m–10m; responsible persons CNY 200k–1m | Disaster recovery, drills and business continuity |
| Selling/providing uncertified network critical equipment or specialised cybersecurity products | Article 63 | Stop sale/warning/confiscation; CNY 20k–100k or 1–5× illegal gains; serious cases may lead to licence revocation | Check certification/testing before purchase; keep contract evidence |
| Failure to stop transmission/remove/keep records/report prohibited content | Article 69 | CNY 50k–500k; serious CNY 500k–2m; especially serious CNY 2m–10m; website/app closure possible | Content review, logs, reporting and handling process |
Fine ranges come from the amendment text; actual penalties depend on facts, consequences, circumstances and administrative discretion. This table is not a penalty prediction or legal advice.
Website vendors, cloud and AI suppliers: what should contracts add?
Outsourcing does not outsource responsibility. Contracts should specify roles, log ownership and retention, personal-information processing, vulnerability/incident notice, deletion and exit handover—otherwise the company cannot produce evidence.
A corporate website usually involves a website vendor, cloud provider, CDN/WAF, analytics tools and an AI customer-service supplier. When a regulator or customer asks, "the supplier's problem" is not an answer. Contracts should translate security duties into verifiable actions: who enables logs, how long they last, who can export them, how fast notice is given, how incidents are supported, and how data is deleted and handed over at exit.
| Clause | What to write | Acceptance evidence |
|---|---|---|
| Role and scope | Is the supplier an entrusted processor, independent controller or pure technical service provider? Which systems/data? | Contract/DPA, system list, data-flow diagram |
| Logs and monitoring | Log types, retention of at least six months, export format, time sync, alert contact | Log console screenshot, export sample, alert record |
| Personal information | Purpose, fields, retention, deletion/correction/rights response, whether data is used for training | DPA, field list, deletion record, training-off screenshot |
| Vulnerability/incident notice | How fast to notify, who reports, how to cooperate with investigation | Notice template, ticket, drill/post-mortem record |
| Data location and cross-border | Storage/backup location, outbound transfer, subprocessor list, cross-border path | Architecture diagram, subprocessor list, contract/assessment |
| Backup and recovery | Frequency, retention, recovery-time objective, drill responsibility | Backup policy, recovery drill report |
| Exit and handover | Deletion after termination, log handover, account/domain/certificate transition | Deletion proof, handover list, access-revocation record |
| Equipment and certification | For network critical equipment/specialised cybersecurity products: certification/testing and ongoing maintenance | Certificate/test report, maintenance record |
Contract clauses are editorial suggestions, not a substitute for legal review; personal-information, cross-border and equipment-certification requirements depend on the specific role, data and service.
How should a 90-day remediation plan be sequenced?
Weeks 1–2 define roles and evidence; weeks 3–6 fix logs, forms and contracts; weeks 7–12 drill and review. Sequence by evidence, not by buying the most expensive package first.
If the company is starting now, use an evidence-first, then tools, then drill sequence. Tools can be bought, but roles, data maps, contracts and drills cannot be fully outsourced. The table can be shared by the owner, IT, marketing, legal and procurement.
| Phase | Actions | Outputs | Owner |
|---|---|---|---|
| Weeks 0–2 | Role assessment, data map, supplier list, current log/backup/form inventory | Role sheet, data list, contract list, gap sheet | Owner/security |
| Weeks 3–4 | Fix log retention, backup recovery, permissions, patching and alerts | Log-retention screenshot, recovery drill, permission list | IT/ops |
| Weeks 5–6 | Minimise forms, privacy notice/consent, AI chat data flow, cross-border check | Notice text, field list, DPA, deletion/takeover record | Marketing/legal/IT |
| Weeks 7–8 | Incident plan, contacts, report template, one tabletop drill | Plan, contact list, drill record, report template | Security/owner |
| Weeks 9–10 | MLPS/certification/equipment procurement check (if applicable) | Filing/assessment, certificate/test, procurement review | Security/procurement |
| Weeks 11–12 | Sample review, close gaps, residual-risk list | Acceptance report, issue list, next-year plan | Owner/internal audit |
The 90-day plan is an editorial suggestion; MLPS filing, CII designation, cross-border assessment and remediation priorities depend on the company, authorities and counsel.
Pre-launch/annual acceptance checklist
Acceptance is not "do we have a certificate". It is whether role, logs, forms, AI, contracts and incident evidence can be produced and reconciled within 30 minutes, with an owner for each item.
The checklist can be shared by the owner, IT, marketing, legal, procurement and the website vendor. The pass standard is not "the supplier says it is done"; it is that the company can produce evidence, explain the data flow, name the owner and act on the plan when an incident occurs.
| Check | Pass standard | Evidence | If failed |
|---|---|---|---|
| Role | Network operator/CII/personal-information handler classification is documented | Role sheet, designation/filing | Reassess/counsel |
| Policy and owner | Policy effective, owner named, duties traceable | Policy, appointment, training record | Add document/appointment |
| Logs | Key logs retained at least six months; searchable/exportable | Config screenshot, export sample, time sync | Change retention/enable logs |
| Backup and encryption | Backup restorable; keys/permissions separated | Recovery drill, encryption config, permission list | Redo backup/isolate access |
| Forms and personal information | Fields minimised; notice/consent/deletion operable | Field list, privacy policy, consent log | Remove fields/add notice |
| AI customer service | Data flow clear; training/takeover/deletion agreed | DPA, data-flow diagram, takeover record | Turn off training/change vendor/redact |
| Contracts | Logs, notice, deletion and handover clauses complete | Contract/annex, tickets | Amend/replace vendor |
| Incident response | Plan, contacts and report template usable; drilled | Plan, drill record, report template | Drill/update contacts |
The checklist is an editorial suggestion, not a substitute for MLPS assessment, penetration testing, audit or legal advice; pass standards depend on role, sector and authority requirements.
Who should read this, who should not, and what decision does it support?
It fits companies with websites, forms or AI customer service that are selecting vendors or preparing for export. It does not fit teams wanting legal advice or unwilling to assign an owner and evidence.
Who should read: owners, IT/security, marketing, legal and procurement at companies with a corporate website, inquiry forms, mini-programs, customer data or AI customer service; teams selecting a website vendor, cloud service or AI supplier, or preparing for MLPS, cross-border review or customer audits; projects that need to translate compliance requirements into contract clauses and acceptance evidence. Who should not: teams expecting one article to replace legal advice, MLPS assessment or regulator communication; companies without a website owner or data list and unwilling to allocate remediation resources; projects that treat "buying a certificate" as the end of compliance. Decisions supported: classify roles and priorities, fix logs/forms/backups/incident response, review AI customer service and supplier contracts, plan 90 days of remediation, and prepare launch/annual acceptance.
FAQ
China's revised Cybersecurity Law took effect on 1 January 2026. What should companies fix first?
Start with evidence-based basics: security policy and owner, network logs retained for at least six months, recoverable backups, minimised form fields, and an incident plan with contacts. Then add MLPS, CII, cross-border or equipment certification according to role; do not buy a tool before you have an owner and a data list.
Must every company retain network logs for six months?
Article 23 of the revised law requires network operators to monitor and record network operation and security events and retain relevant network logs for at least six months. Whether a company falls within the provision and which logs count as "relevant" depends on the business and authority requirements. A cloud default of 7/30 days is usually insufficient; configure and verify retention actively.
If we use a cloud service or website vendor, is responsibility transferred?
Not simply. A cloud provider or website vendor may be an entrusted processor or technical service provider, but the company as network operator/personal-information handler still has duties. Contracts should specify roles, logs, notice, deletion, handover and incident cooperation; the company must be able to produce evidence, not just a vendor promise.
Does the new law cover AI customer service or LLM conversations?
Article 20 brings AI into the cybersecurity legal framework, emphasising support for development, ethical norms, risk monitoring/assessment and safety supervision. Whether an AI customer-service deployment is compliant also depends on personal information, synthetic-content labelling, whether the vendor trains on the data, cross-border transfer and human takeover. "The law mentions AI" does not make a deployment compliant, and "it is just a technical tool" does not remove personal-information duties.
The maximum fine is CNY 10 million. Does every data breach get that?
No. The CNY 10 million ceiling corresponds to statutory situations such as loss of main CII function and especially serious consequences. Ordinary network operators, CII operators, consequences and circumstances fall into different ranges. Actual penalties depend on facts, consequences, circumstances and discretion; companies should not treat the ceiling as a prediction, and should not focus only on fines while ignoring suspension, website/app closure and personal liability.
Does a corporate website need MLPS?
Article 23 establishes the cybersecurity classified protection system, and network operators should fulfil its requirements. Whether a particular website needs classification, filing or assessment depends on the system level, local police and sector requirements; it cannot be generalised. Start with system inventory and classification, then follow authority requirements. Buying an "MLPS package" is not a substitute for remediation.
Bottom line
China's revised Cybersecurity Law is in force in 2026: classify the role first, then fix policy/owner, logs of at least six months, backup and encryption, form and personal-information practices, AI customer service and supplier contracts, and incident response. Penalty ceilings are higher, but not every violation is a maximum case; acceptance is about evidence, not certificates.
Method and limits
This article is public legal text, CAC interpretation and editorial method, not legal advice, an MLPS assessment, penetration test or regulatory determination for any company, website, system, data set or project. It uses no unpublished client data, logs, contracts or penalty cases. The role table, scenario table, contract checklist, 90-day plan and acceptance checklist are editorial suggestions; specific duties, filing, CII designation, cross-border paths and penalty application are governed by the law, authorities, contracts and counsel. Laws and implementing rules change; the latest official text governs.
Sources
Information is current to 30 October 2026; each official/primary page governs its own scope and version.
- Decision of the NPC Standing Committee on Amending the Cybersecurity Law of the People's Republic of China (adopted 28 October 2025, effective 1 January 2026): gov.cn. Adds Article 3, Article 20 on AI, Article 42(2) on personal information, and Article 61 penalties.
- CAC publication of the same decision: cac.gov.cn. Used to cross-check the full text and article numbering.
- Revised Cybersecurity Law of the People's Republic of China: cac.gov.cn. Article 23 network-operator duties, Article 27 incident plan/reporting, Article 42 personal information.
- CAC expert interpretation on the amendment and AI governance: cac.gov.cn. Explains the "support development + safety supervision" positioning of Article 20.
- CAC expert interpretation on stronger legal protection for a cyber power: cac.gov.cn. Explains tiered penalties, equipment-security rules and mitigated enforcement.
For logs, forms, cookie and cross-border evidence in a PIPL audit, see China's PIPL Compliance Audit in 2026.