Provisions on the Security Assessment of Internet Information Services with Public-Opinion Attributes or Social-Mobilisation Capacity
English · 中文
具有舆论属性或社会动员能力的互联网信息服务安全评估规定 — issued jointly by the CAC and the Ministry of Public Security on 15 November 2018, in force 30 November 2018. Seventeen articles, no order number: the CAC's own account calls it 政策性文件 (a policy document), outside the administrative-permission system and setting no penalty of its own. Its importance in this repository is specific: Article 2 is the only official text that delimits the phrase "public-opinion attributes or social-mobilisation capacity", which is the trigger for filing under the algorithmic-recommendation provisions (Art. 24), for assessment under the deep-synthesis provisions (Arts. 19–20), Article 17 of the generative-AI measures and Article 22 of the anthropomorphic-services measures. The English rendering here is ours; no official English text was found. ⚠
In one line
If your service can shape public opinion or rally people — a forum, a blog, a Weibo, a chatroom, a group chat, an official account, short video, livestream, information sharing or a mini-program — you must assess your own security before launch, file the report with the cyberspace and public-security authorities through the national platform, and accept review; refuse, and the state publishes a risk warning about you rather than fining you.
The delimitation every other instrument defers to this one
- Article 2 — the definition. The services covered are (i) running, or adding the function of, 论坛、博客、微博客、聊天室、通讯群组、公众账号、短视频、网络直播、信息分享、小程序 — forums, blogs, microblogs, chatrooms, communications groups, public accounts, short video, livestream, information sharing and mini-programs; and (ii) any other internet information service that provides a channel for public opinion to be expressed, or has the capacity to mobilise the public to engage in a particular activity.
- Article 3 — the five occasions that oblige a self-assessment, for which the provider is responsible for the result: launching such a service or adding the relevant function; using new technology or a new application that materially changes the service's functional attributes, technical implementation or underlying resources so that its public-opinion or mobilisation capacity changes materially; a significant increase in user numbers with the same effect; spread of illegal or harmful information showing that existing measures cannot control the risk; and any other case notified in writing by a cyberspace or public-security authority at or above prefecture level.
- Note the internal inconsistency worth recording: the title uses 或 while the body of Articles 2 and 3 alternates between 或 and 或者. Nothing turns on it, but a citation should follow the text it quotes.
Key provisions
| Art. | What it requires |
|---|---|
| 1 | Purpose and legal basis: the Cybersecurity Law, the Measures for the Administration of Internet Information Services and the Measures for the Administration of Security Protection of Computer Information Networks with International Connections. |
| 2 | Defines the services with public-opinion attributes or social-mobilisation capacity — the ten named categories plus the two-limb catch-all above. |
| 3 | The five triggers for self-assessment; the provider is answerable for the assessment result. |
| 4 | The assessment may be done by the provider itself or entrusted to a third-party assessment institution. |
| 5 | What must be assessed: legality of the service and of the new technology or application, effectiveness of the security measures required by laws, regulations, rules and standards, and risk control — with eight named focal points: an adequate security manager, content-review staff or a security body; verification of users' real identity and retention of registration information; retention of logs — account, operation time, operation type, source and target network address, source port, client hardware characteristics — and of published-information records; measures against illegal or harmful information in account and group names, nicknames, profiles, notes and labels, in posting, reposting, commenting and group functions, with records kept; personal-information protection and the technical measures against spread of illegal or harmful information and against loss of control of the mobilisation function; a complaints and reports system with published channels and timely handling; a working mechanism to give technical and data support and assistance to the cyberspace authorities; and the same for public-security and state-security organs in maintaining national security and investigating crime. |
| 6 | Hazards found must be remedied until eliminated; a security assessment report conforming to laws, regulations, rules and standards must be produced, covering the service's function, scope, hardware and software, deployment location and licences obtained; the security management and technical measures implemented and their effect; the assessment conclusion; and anything else that should be stated. |
| 7 | Where and when to file. The report goes through the national internet security management service platform (全国互联网安全管理服务平台) to the cyberspace and public-security authorities at or above prefecture level where the provider is located. For the Article 3(i)–(ii) cases, before the service, new technology or application goes online or the function is added; for Article 3(iii)–(v), within 30 working days of the circumstance arising. |
| 8 | Prefecture-level and higher authorities conduct a written review; if the report is incomplete or the method plainly inappropriate they order a re-assessment within a set period, and if it is unclear they may order supplementary explanation. |
| 9 | On the strength of the written review, on-site inspection may follow; in principle the two authorities inspect jointly, and must not disturb normal business. |
| 10 | For services with material risk that may affect national security, public order or the public interest, provincial-level and higher authorities organise an expert review panel, and may inspect jointly with local departments. |
| 11–12 | Inspections follow the existing laws and regulations; the authorities run monitoring and management systems and, on finding an unassessed service, notify the provider to carry out the assessment. |
| 13 | The consequence of refusal. Where a provider refuses to assess, the authorities must use the national platform to warn the public that the service carries security risks, and inspect it under their respective duties, handling any illegal act according to law. |
| 14 | The cyberspace authority coordinates; the public-security authority reports its assessment work to the cyberspace authority periodically. |
| 15 | State secrets, trade secrets and personal information learned in this work must be kept strictly confidential — no disclosure, sale or unlawful provision. |
| 16 | For new technologies and applications in internet news information services, assessment follows the separate Provisions on the Administration of Security Assessment of New Technologies and Applications in Internet News Information Services. |
| 17 | In force from 30 November 2018. |
What it is not — and why that matters for the comparison
The CAC's own description of the instrument is explicit on three points: it is a policy document (政策性文件), it is not an administrative-permission matter (不属于行政许可事项), and it creates no administrative penalty (不设立行政处罚措施); for a service that goes online without assessment, the authorities publish a security risk warning on the national platform (CAC, 网络传播杂志). The mechanism is therefore registration-plus-exposure, not licensing: the state does not approve the service, it makes the provider write down how it discharges duties it already owes under the Cybersecurity Law, routes the report to two authorities, and names it publicly if it refuses. — A for the text, B for this characterisation (an official statement about the instrument, not the instrument itself)
Two consequences follow for the AI instruments that point here. First, the assessment these products must do is not the AI-specific security assessment the generative-AI measures' drafters were asked about — it is this 2018 obligation, keyed to the kind of service, and it predates all of them. Second, because this instrument sets no penalty, the enforcement teeth in the AI rules sit where the cards said they do: in the Cybersecurity Law's Chapter VI (Arts. 61–77) and in the operational sanctions of the newer measures, not in the assessment duty itself.
Relationship to other instruments
- Named in the referral chains of three AI instruments. The Deep Synthesis Provisions Article 20 (new products, applications and functions "according to relevant national regulations"), the Generative AI Services Measures Article 17, and the Anthropomorphic Interaction Services Measures Article 22 all condition their obligations on services with public-opinion attributes or social-mobilisation capacity; Article 2 of this instrument is where that phrase is defined. The same phrase drives filing under Article 24 of the Algorithmic Recommendation Provisions.
- Legal basis (Article 1) — the Cybersecurity Law (real-identity, logs and incident duties the assessment checks against), plus the two administrative regulations named there.
- Article 16 carves out internet news information services, which follow their own new-technology assessment rules instead.
- Against the EU: there is no EU counterpart to a pre-launch self-assessment filing keyed to a service's capacity to move public opinion. The AI Act's conformity assessment is keyed to risk classification of the system and, for GPAI models, to technical documentation — see
../eu/ai-act.md. The nearest structural analogy in EU data law is the GDPR's DPIA (Art. 35), which is internal, not filed, and triggered by high-risk processing rather than by audience reach. This comparison is this repository's reading. — C
Official sources
- Full text, CAC (posted 2018-11-15, 来源：中国网信网): https://www.cac.gov.cn/2018-11/15/c_1123716072.htm
- Joint issuance and full text republished, CAC (2019-03-20, 来源：网络传播杂志; carries the 政策性文件／不属于行政许可事项／不设立行政处罚措施 characterisation): https://www.cac.gov.cn/2019-03/20/c_1124259405.htm
Source quotes
Every sentence below is copied from the official text and pinned to the snapshot in snapshots/ that this card was written against. node scripts/check-quotes.mjs re-checks them offline, so a quote that stops matching the source fails a check instead of quietly becoming the record. The prose above is a rendering; these are the anchors.
开办论坛、博客、微博客、聊天室、通讯群组、公众账号、短视频、网络直播、信息分享、小程序等信息服务或者附设相应功能— Article 2(i) — the ten named service types (snapshot:snapshots/cn/social-mobilisation-security-assessment-provisions.txt)开办提供公众舆论表达渠道或者具有发动社会公众从事特定活动能力的其他互联网信息服务— Article 2(ii) — the two-limb catch-all (snapshot:snapshots/cn/social-mobilisation-security-assessment-provisions.txt)地市级以上网信部门或者公安机关书面通知需要进行安全评估的其他情形— Article 3(v) (snapshot:snapshots/cn/social-mobilisation-security-assessment-provisions.txt)应当自相关情形发生之日起30个工作日内提交安全评估报告— Article 7 — 30 working days (snapshot:snapshots/cn/social-mobilisation-security-assessment-provisions.txt)责令互联网信息服务提供者限期重新评估— Article 8 — order to re-assess (snapshot:snapshots/cn/social-mobilisation-security-assessment-provisions.txt)应当通过全国互联网安全管理服务平台向公众提示该互联网信息服务存在安全风险— Article 13 — the consequence of refusal (snapshot:snapshots/cn/social-mobilisation-security-assessment-provisions.txt)本规定自2018年11月30日起施行— Article 17 (snapshot:snapshots/cn/social-mobilisation-security-assessment-provisions.txt)国家互联网信息办公室和公安部11月15日发布— joint issuance (snapshot:snapshots/cn/social-mobilisation-security-assessment-provisions-announce.txt)不属于行政许可事项— not an administrative-permission matter (snapshot:snapshots/cn/social-mobilisation-security-assessment-provisions-announce.txt)不设立行政处罚措施— sets no administrative penalty (snapshot:snapshots/cn/social-mobilisation-security-assessment-provisions-announce.txt)
Unverified / TODO
- The English title, and every article name and term in this card, is this repository's own translation — no official English text was found. ⚠ [gap:no_official_translation]
- Whether the 2018 provisions have been amended or superseded since — in particular by the Network Data Security Management Regulations (in force 2025-01-01) and by the algorithm-recommendation and deep-synthesis filing routes. Not checked against a consolidated source. ⚠
- The security assessment template (安全评估模板) the authorities issued for use under this instrument, and the submission flow on the national internet security management service platform, are not carded; the template is the practical answer to what Article 5 and Article 6 require in the regulator's own format. ⚠ [gap:not_located]
- Whether an AI product's algorithm filing under the Algorithmic Recommendation Provisions and its assessment under these provisions are handled as one procedure or two in practice. ⚠