AI Governance Compare

Cybersecurity Law (CSL)

CN·in-force·Grade A·checked 2026-10-11·source 1 ↗ source 2 ↗

authority
Standing Committee of the National People's Congress
published
2016-11-07
effective
2017-06-01
status
in-force

网络安全法. Effective 1 June 2017. Amended on 28 October 2025, in force 1 January 2026, and re-promulgated with its articles renumbered. The first of China's three data pillars, and the one that created the concepts everything else still uses: critical information infrastructure and network operator duties.

In one line

Whoever operates a network in China must secure it, register real identities, protect critical information infrastructure — and keep certain data inside the country.

Key concepts

Main obligations

Area Substance
Security management Internal security systems, responsible staff, technical measures, contingency plans, logs kept for at least six months.
Real-name registration Users must provide real identity information for network access and information publishing.
Product and service compliance Network products and services must meet mandatory national standards and not leave security defects; providers must remediate and report.
CII protection Dedicated security management bodies and background checks (Article 36), at least one annual detection-and-assessment cycle (Article 40), and storage of personal information and important data collected and generated in China within China (Article 39) — where a transfer abroad is genuinely needed, it requires a security assessment under the measures the national cyberspace administration sets with the relevant State Council departments.
Incident response Immediate remedial action and reporting to the authorities on an incident.
Legal liability Chapter VI, Articles 61–77 — see Penalties (Chapter VI, Articles 61–77) below: warnings, fines, suspension of business, closure of the website or application, licence revocation, separate personal fines on responsible individuals, an industry entry ban, and referral to other laws.

The 2025 amendment

Adopted by the Standing Committee on 28 October 2025 (14th NPC Standing Committee, 18th session), in force 1 January 2026. The law was re-promulgated with its article order adjusted, so the current text — not the 2016 numbering — is the authoritative one.

Change Substance
New Article 20 (AI) The state supports basic research on AI and key technologies such as algorithms; promotes training-data resources and computing infrastructure; improves AI ethics rules; strengthens risk monitoring, assessment and security regulation; and promotes the healthy development of AI applications. A second paragraph supports innovating network-security management by using AI to raise protection levels.
Political principle A new Article 3 states that cybersecurity work upholds Party leadership, the holistic national-security outlook, and the coordination of development and security.
Personal information Article 40 → 42, with a new paragraph requiring network operators processing personal information to comply with the Civil Code and PIPL as well as this law.
Penalties raised Article 59 → 61 now runs three paragraphs escalating across four bands. Ordinary network operators: a warning, or RMB 10,000–50,000, rising to RMB 50,000–500,000 for refusal to correct or harm. CII operators: RMB 50,000–100,000, rising to RMB 100,000–1,000,000. Serious harm (mass data leakage, partial loss of CII function): RMB 500,000–2,000,000; especially serious harm (loss of the CII's main function): RMB 2,000,000–10,000,000, with personal fines up to RMB 1,000,000 on responsible individuals. The rest of Chapter VI was rewritten around this ladder — see Penalties (Chapter VI, Articles 61–77) below.
New penalty articles New Article 63 penalises selling or supplying critical network equipment and specialised cybersecurity products without certification or testing; Article 62 → 65 covers certification, testing, risk assessment and the publication of vulnerability information.
Cross-statute coordination Articles 64, 66 and 70 are merged into Article 71, routing personal-information and cross-border violations to the relevant law; a new Article 73 applies the Administrative Penalties Law's rules on lighter, reduced or waived penalties.
Overseas reach Article 75 → 77 keeps the power to sanction overseas bodies, organisations and individuals whose acts endanger Chinese network security, including freezing property.

Penalties (Chapter VI, Articles 61–77)

Chapter VI is where the 2025 amendment did most of its work: seventeen articles, 61 through 77, transcribed from the re-promulgated text (checked 2026-10-10). Two conventions run through the chapter. Fines on the operator and fines on the directly responsible supervisor and other directly responsible staff (直接负责的主管人员和其他直接责任人员) are separate and additive. And the escalators are almost always the same two: refusal to correct, or the breach actually causing harm.

Art. Conduct Consequence
61 Network operator fails the tiered-protection duties (Article 23) or the incident-response duties (Article 27); CII operator fails Articles 35, 36, 38 or 40 The ladder below — up to RMB 10,000,000
62 A product or service provider plants a malicious program, fails to remedy a known defect or vulnerability and to notify users and regulators, or terminates security maintenance early (Article 24, paragraphs 1 and 2); likewise the Article 50, paragraph 1 bar on malicious programs and prohibited content in transmitted information and software Warning; on refusal or harm RMB 50,000–500,000, plus RMB 10,000–100,000 on the supervisor alone. Planting malicious programs or leaving defects unremedied, where that produces the harms in Article 61's third paragraph, is punished at those higher bands
63 Selling or supplying critical network equipment or dedicated cybersecurity products without having passed certification or testing (Article 25) Sales and supply stopped, gains confiscated; RMB 20,000–100,000 where there are no gains or they are under RMB 100,000, otherwise 1–5× the gains; in serious cases business may be suspended, operations closed down for rectification, or the permit or business licence revoked
64 Failing to require real identity information, or serving users who have not provided it (Article 26, paragraph 1) On refusal or serious cases: RMB 50,000–500,000 and RMB 10,000–100,000 on individuals, and the regulator may add suspension, rectification, closure of the website or application, or revocation
65 Carrying out certification, testing or risk-assessment work, or publishing vulnerability, malware, attack or intrusion information, contrary to national rules (Article 28) Warning, optionally RMB 10,000–100,000; on refusal or serious cases RMB 100,000–1,000,000 plus the same optional closure and revocation powers and RMB 10,000–100,000 on individuals. Conduct producing the harms in Article 61's third paragraph is punished at those bands
66 Intruding on others' networks, disrupting their functions, stealing data, supplying purpose-built attack tools, or knowingly giving technical support, advertising placement or payment settlement for such acts — short of a crime (Article 29) The public security organ confiscates gains: up to 5 days' detention with optional RMB 50,000–500,000, or 5–15 days with optional RMB 100,000–1,000,000 for heavier cases; units face RMB 100,000–1,000,000 plus the individual penalties. Anyone punished under public-security rules is barred for five years from network-security management and key network-operations posts, and for life after a criminal penalty
67 A CII operator using network products or services that were not submitted to, or failed, the national-security review (Article 37) Use stopped and the impact on national security eliminated, plus 1–10× the procurement amount — the chapter's only transaction-linked base — and RMB 10,000–100,000 on individuals
68 Setting up a website or communications group to commit fraud, teach criminal methods, or make or sell contraband or controlled goods, or publishing information about such crimes (Article 48) Up to 5 days' detention with optional RMB 10,000–100,000, or 5–15 days with optional RMB 50,000–500,000; the site or group is closed; units face RMB 100,000–500,000 plus the individual penalties
69 Failing to stop transmission of, delete, record or report information prohibited by law (Article 49), or ignoring a regulator's instruction to do so (Article 52); the same two paragraphs bind electronic-information sending and app-download providers that skip the duties in Article 50, paragraph 2 Order to correct, warning and notification of the violation (通报), optionally RMB 50,000–500,000; on refusal or serious cases RMB 500,000–2,000,000 plus discretionary closure or revocation and RMB 50,000–200,000 on individuals. Especially serious impact or consequences: RMB 2,000,000–10,000,000, RMB 200,000–1,000,000 on individuals, and suspension, rectification, closure and revocation become mandatory
70 Refusing or obstructing a lawful inspection, or withholding technical support and assistance from the public security or state security organs On refusal or serious cases: RMB 50,000–500,000 and RMB 10,000–100,000 on individuals
71 Publishing or transmitting information barred by Article 13, paragraph 2 or other law; infringing personal-information rights under Article 24, paragraph 3 or Articles 43–45; a CII operator storing personal information or important data abroad, or exporting personal information, against Article 39; or stealing, unlawfully obtaining, selling or supplying personal information (Article 46) No fine is set here. The first three are handled and punished under the other applicable laws and administrative regulations — in practice PIPL and the Data Security Law — and the last goes to the public security organ under those same rules
72 Any unlawful act under this law Entered in the credit file and publicised under the applicable rules
73 Any unlawful act with mitigating grounds Lighter, reduced or no penalty per the Administrative Penalties Law
74 A state organ's government-affairs network operator failing its protection duties Its superior or the relevant organ orders correction and disciplines the responsible people
75 Regulators reusing information gathered in their duties for other purposes, or neglecting or abusing their office Disciplinary action against the responsible people where the conduct does not amount to a crime
76 Causing damage to others Civil liability; public-security punishment for administrative violations; criminal liability for offences
77 Overseas institutions, organisations or individuals endangering China's network security Liability pursued; where consequences are severe, the State Council's public security department and the relevant organs may freeze the actor's property or apply other necessary sanctions

Article 61 is the ladder that outside citations to the CSL are usually quoting, and it turns on who the operator is and how much damage followed:

Tier Ordinary network operator CII operator
Breach found Warning, optionally RMB 10,000–50,000 Warning, optionally RMB 50,000–100,000
Refusal to correct, or harm results RMB 50,000–500,000; individuals RMB 10,000–100,000 RMB 100,000–1,000,000; individuals RMB 10,000–100,000
Serious harm — mass data leakage, partial loss of CII function RMB 500,000–2,000,000; individuals RMB 50,000–200,000 The third paragraph covers conduct under either of the first two and does not split the two classes
Especially serious — loss of a CII's main function RMB 2,000,000–10,000,000; individuals RMB 200,000–1,000,000 As above

Two roads reach the RMB 10,000,000 ceiling, not one. Article 61 gets there on security-management failure — the operator skipped its duties and the incident cost a CII its main function. Article 69 gets there on content grounds: refusing to act on prohibited information, or ignoring a regulator's instruction, where the impact is especially serious. A service whose exposure is what its users publish therefore sits in Article 69, not Article 61 — the same ceiling, a different trigger.

Article 69's top tier is the harshest sentence in the chapter, and it is not a fine. At RMB 2,000,000–10,000,000 the suspension, rectification, closure of the website or application and licence revocation are written without the "may" that qualifies them at every other point in the chapter. Closure and revocation follow automatically, and they are the only such mandatory measures in Chapter VI.

The largest fines are the ones with no number attached. Article 63 scales with illegal gains (1–5×) and Article 67 with the procurement amount (1–10×), so a CII operator that bought an unreviewed product at scale can exceed any fixed band in the chapter. And two articles stop being about money at all: Article 66 adds detention plus a five-year or lifetime bar from network-security and key operations posts, and Article 77 lets the State Council freeze the property of an overseas actor.

Where the CSL is not the ceiling. Article 71 removes personal-information breaches, cross-border storage or transfer by CII operators, and prohibited-information cases from this chapter entirely and hands them to the other statutes — so for those three the applicable maximum is PIPL's RMB 50 million or 5% of turnover, not anything in the table above. Article 73 then re-opens every penalty in the chapter to the mitigation rules of the Administrative Penalties Law.

Relationship to other instruments

Source quotes

Every sentence below is copied from the official text and pinned to the snapshot in snapshots/ that this card was written against. node scripts/check-quotes.mjs re-checks them offline, so a quote that stops matching the source fails a check instead of quietly becoming the record. The prose above is a rendering; these are the anchors.

Unverified / TODO