China cyber regulation outlook to 2027: one-hour reporting and annual data audits

The one thing a board should know about China right now: the incident-reporting clock is measured in hours, not days. Since 1 November 2025, operators of critical information infrastructure (CII) must report a serious cyber incident within 1 hour. Every other network operator in China has 4 hours [1][2]. The amended Cybersecurity Law, in force since 1 January 2026, raises the top fine to RMB 10 million [3]. And from 20 August 2026, firms holding "important data" must assess their data security risks every year and file the report [5].

At a glance

• Incident reports are due within 1 hour (CII), 2 hours (central state bodies) or 4 hours (everyone else), for incidents graded "relatively major" or above. A full review is due within 30 days of closing the incident [1][2].
• Cybersecurity Law fines now reach RMB 10 million for especially serious consequences, plus up to RMB 1 million for responsible managers [3].
• Important-data handlers must run a risk assessment every year from 20 August 2026 [5].
• The Cyberspace Administration of China (CAC) fined 521 websites and platforms in 2025 and took down 2,133 apps [13].
• A draft rule would require handlers of 10 million or more people's data to store it in China [19].

The rulebook now

The base layer is unchanged: the Cybersecurity Law (2017), the Data Security Law (2021) and the Personal Information Protection Law (PIPL, 2021). PIPL fines for serious breaches reach RMB 50 million or 5% of annual revenue [4]. The changes since September 2023 are in the detail.

Incident reporting. The National Cybersecurity Incident Reporting Measures took effect on 1 November 2025. They set the 1-, 2- and 4-hour deadlines above. Reports must cover the cause, impact and attack path, and the ransom demand in ransomware cases. Operators must also make their IT and security suppliers report incidents to them. Reports go through a national 12387 hotline and website. Late, missing or false reports that cause serious harm draw heavier penalties [1][2]. The central bank goes further for finance: PBOC (People's Bank of China) rules in force since 1 August 2025 require a first report within 1 hour and a fuller one within 24 hours [11].

Cybersecurity Law amendment. In force from 1 January 2026. It adds support for AI and raises fines. Where a breach of security duties causes large-scale data leaks or partial loss of CII functions, fines run from RMB 500,000 to 2 million. Where CII loses its main functions, they run from RMB 2 million to 10 million [3].

Data security. The Network Data Security Management Regulations took effect on 1 January 2025 [6]. Handlers of personal information on more than 10 million people must have a compliance audit at least every two years, from 1 May 2025 [7]. The Network Data Security Risk Assessment Measures took effect on 20 August 2026. Important-data handlers must assess risk every year and send the report to their regulator within 20 working days. The same assessor cannot do it three years running [5][8]. Smaller firms, those holding data on fewer than 100,000 people, got simplified duties from 1 September 2026 [12].

Cross-border data. Rules in force since 22 March 2024 narrowed the cases that need a CAC security assessment [9]. A third transfer route, certification, opened on 1 January 2026 for mid-volume transfers by non-CII firms [10].

AI. Labels on AI-generated content became mandatory on 1 September 2025 [14]. Rules on "human-like" AI companion services took effect on 15 July 2026 [15]. By 31 August 2026, 1,112 generative AI services had completed CAC filing [16].

The regulators and how they behave

The CAC leads. It writes most rules, often jointly with the Ministry of Industry and Information Technology (MIIT) and the Ministry of Public Security (MPS). In 2025 the CAC system summoned 5,811 platforms for talks, issued 1,646 warnings, fined 521 sites and platforms, and took down 2,133 apps [13]. Individual cases are usually published without names or fine amounts. A September 2026 bulletin listed fines for weak passwords that led to a defaced website, an open-source search tool with an access flaw that let 2,400 internal documents be stolen, and a hospital whose security tools had stopped working when their licences expired [17].

The posture is strict, high-volume and mostly aimed at domestic firms. It is also used on national-security grounds against foreign suppliers. The CAC summoned Nvidia over alleged security risks in its H20 chips on 31 July 2025 [18]. On 6 August 2026 its Cybersecurity Review Office opened a review of products Palo Alto Networks sells in China, citing the protection of CII and national security. No timetable was given [20].

The MPS polices the Multi-Level Protection Scheme (MLPS), the tiered security-grading system every network operator must follow, and it receives CII incident reports. Under its 2026 "Hu Wang" (Net Guard) campaign, MPS reports 38,000 administrative cases for failures in network, data and personal-information protection duties, and 652 apps publicly named [21]. New MPS inspection measures take effect on 1 October 2026 and cover data and personal-information handlers as well as network operators [22].

The MIIT covers telecoms, industrial data, product vulnerabilities and, with the CAC and MPS, a voluntary star-rated cybersecurity label for connected products. The label scheme started on 1 July 2026, beginning with consumer IP cameras [23][24]. A joint CAC, MIIT and MPS campaign on personal information had checked more than 20,000 apps and SDKs (software development kits) by August 2026 and taken action against more than 400 [25].

What's coming in the next 12 months

• 1 Oct 2026: MPS cyberspace inspection measures take effect [22].
• Late 2026 (expected; no date set): final Provisions on Personal Information Protection by Large Personal Information Handlers. Consultation closed on 7 September 2026. The draft is aimed at handlers of 10 million or more people's data and would require them to store personal information collected in China inside China [19]. A separate draft on app data collection (consultation closed 9 February 2026) is also pending [26].
• Outcome of the Palo Alto Networks review: no date announced [20].
• 1 Jan 2027: mandatory national standard on wiping data from second-hand phones and other electronics takes effect [27].
• By 31 Jan 2027: sector regulators send the CAC their annual inspection plans for data risk assessments [5].
• 2026–27 legislation (expected): the State Council's 2026 plan includes revising the Internet Information Services Measures (CAC, MIIT and MPS drafting) and work towards comprehensive AI legislation. It lists an MLPS Regulation, a Cybercrime Prevention Law and a Telecommunications Law as preparatory projects [28]. The NPC Standing Committee lists AI and online-violence laws as preparatory [29]. The CAC published a draft Anti-Online Violence Law for comment (closed 28 August 2026) [30].
• Standards: TC260, the national cybersecurity standards committee, released AI Safety Governance Framework 3.0 on 14 September 2026 [31]. It is forming a new committee with a five-year work plan [32].
• Around May 2027 (expected): 2027 legislative plans from the State Council and the NPC Standing Committee, following the May timing of the 2026 plans [28][29].

What it means for organisations

• Test whether your China incident process can classify an incident and report it within 1 or 4 hours. Make sure IT and security suppliers' contracts oblige them to tell you quickly [1].
• Check whether any data you hold in China counts as "important data". If it does, budget for an annual risk assessment and a filing deadline [5].
• If you process data on 10 million or more people in China, plan for possible localisation and extra governance duties under the large-handler draft [19].
• Map every cross-border transfer to one of the three routes (assessment, standard contract or certification) or to an exemption [9][10].
• Treat foreign security and network products used by Chinese CII customers as a supply-chain risk to monitor [20].
• For AI products, confirm filing status and content labelling [14][16].

This is a summary, not legal advice.

Sources

1. CAC, National Cybersecurity Incident Reporting Management Measures (11 Sep 2025): https://www.cac.gov.cn/2025-09/15/c_1759583017717009.htm. Unofficial English (China Law Translate): https://www.chinalawtranslate.com/en/%e5%9b%bd%e5%ae%b6%e7%bd%91%e7%bb%9c%e5%ae%89%e5%85%a8%e4%ba%8b%e4%bb%b6%e6%8a%a5%e5%91%8a%e7%ae%a1%e7%90%86%e5%8a%9e%e6%b3%95/
2. CAC, Q&A on the incident reporting measures (15 Sep 2025): https://www.cac.gov.cn/2025-09/15/c_1759583021718167.htm
3. NPC Standing Committee decision amending the Cybersecurity Law (28 Oct 2025), via Xinhua: https://www.news.cn/20251029/bc3a57483dbf4b748c9626c0097ff3b4/c.html. Unofficial English (Georgetown CSET): https://cset.georgetown.edu/publication/china-cybersecurity-law-2025/
4. PIPL, Article 66, unofficial English (Stanford DigiChina): https://digichina.stanford.edu/work/translation-personal-information-protection-law-of-the-peoples-republic-of-china-effective-nov-1-2021/
5. CAC, MIIT, MPS, Network Data Security Risk Assessment Measures (Order No. 24, 18 Jun 2026): https://www.cac.gov.cn/2026-06/18/c_1783525609815499.htm
6. State Council, Network Data Security Management Regulations (English summary, gov.cn): https://english.www.gov.cn/policies/latestreleases/202409/30/content_WS66fab6c8c6d0868f4e8eb720.html
7. CAC, Personal Information Protection Compliance Audit Measures (Order No. 18): https://www.cac.gov.cn/2025-02/14/c_1741233507681519.htm
8. CAC, Q&A on implementing the risk assessment measures (20 Aug 2026): https://www.cac.gov.cn/2026-08/20/c_1788889498173657.htm
9. CAC, Provisions on Promoting and Regulating Cross-Border Data Flows (Order No. 16): https://www.cac.gov.cn/2024-03/22/c_1712776611775634.htm
10. CAC and SAMR, Personal Information Outbound Transfer Certification Measures (Order No. 20): https://www.cac.gov.cn/2025-10/17/c_1762449728720008.htm
11. PBOC, Business-Area Cybersecurity Incident Reporting Measures (Order 2025 No. 4): https://www.pbc.gov.cn/zhengwugongkai/4081330/4406346/4406348/2025092319185580693/index.html
12. CAC and MPS, Provisions on Simplified Personal Information Protection Measures for Small Handlers (Order No. 25): https://www.cac.gov.cn/2026-07/24/c_1786638889704872.htm
13. CAC, 2025 national cyberspace law enforcement summary (14 Feb 2026): https://www.cac.gov.cn/2026-02/14/c_1772800146205770.htm
14. CAC and others, Measures for Labelling AI-Generated Synthetic Content: https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm
15. CAC and others, Interim Measures on Anthropomorphic AI Interactive Services (Order No. 21): https://www.cac.gov.cn/2026-04/10/c_1777558395078289.htm. Unofficial English (China Law Translate): https://www.chinalawtranslate.com/en/%E4%BA%BA%E5%B7%A5%E6%99%BA%E8%83%BD%E6%8B%9F%E4%BA%BA%E5%8C%96%E4%BA%92%E5%8A%A8%E6%9C%8D%E5%8A%A1%E7%AE%A1%E7%90%86%E6%9A%82%E8%A1%8C%E5%8A%9E%E6%B3%95/
16. CAC, generative AI filing notice, Jul–Aug 2026 (14 Sep 2026): https://www.cac.gov.cn/2026-09/14/c_1791136833136332.htm
17. CAC typical enforcement cases (15 Sep 2026), via Xinhua: https://www.news.cn/legal/20260915/3f7196f558fd45cc9165cd1cafa9246b/c.html
18. CAC, summons of Nvidia over H20 chip security risks (31 Jul 2025): https://www.cac.gov.cn/2025-07/31/c_1755675743897163.htm
19. CAC, draft Provisions on Personal Information Protection by Large Personal Information Handlers (7 Aug 2026): https://www.cac.gov.cn/2026-08/07/c_1787851071612596.htm
20. Cybersecurity Review Office, notice on reviewing Palo Alto Networks products sold in China (6 Aug 2026): https://www.cac.gov.cn/2026-08/06/c_1787764332950791.htm
21. MPS, "Hu Wang 2026" results and 10 typical cases (17 Sep 2026), via Xinhua: https://www.news.cn/legal/20260917/bc033b5f64144c9ea939cb836c3d4dc0/c.html
22. MPS cyberspace security supervision and inspection measures (7 Aug 2026), via CCTV/Guangming: https://m.gmw.cn/2026-08/07/content_1304544745.htm
23. CAC, MIIT, MPS, Cybersecurity Label Management Measures (in force 1 Jul 2026): https://www.cac.gov.cn/2026-04/10/c_1777558393316312.htm
24. MIIT, first product catalogue for cybersecurity labels (18 Jun 2026): https://www.miit.gov.cn/jgsj/waj/wjfb/art/2026/art_560972d39feb447e9187b9ee11b0654e.html
25. CAC, interim results of the 2026 personal information protection campaign (19 Aug 2026): https://www.cac.gov.cn/2026-08/19/c_1788889479389148.htm
26. CAC, draft App Personal Information Collection and Use Provisions (10 Jan 2026): https://www.cac.gov.cn/2026-01/10/c_1769603446094128.htm
27. CAC, mandatory standard on wiping data from electronic products (13 Dec 2025): https://www.cac.gov.cn/2025-12/13/c_1767269721368254.htm
28. State Council 2026 legislative work plan (11 May 2026): https://www.gov.cn/zhengce/content/202605/content_7068345.htm
29. NPC Standing Committee 2026 legislative work plan (copy hosted by NPC Observer): https://npcobserver.com/wp-content/uploads/2026/05/2026-NPCSC-Legislative-Plan.pdf
30. CAC, draft Anti-Online Violence Law for comment (29 Jul 2026): https://www.cac.gov.cn/2026-07/29/c_1787072711938509.htm
31. CAC, release of AI Safety Governance Framework 3.0 (14 Sep 2026): https://www.cac.gov.cn/2026-09/14/c_1791137092283345.htm
32. CAC, notice on TC260 renewal and call for members (3 Sep 2026): https://www.cac.gov.cn/2026-09/03/c_1790185079976128.htm