Law / China

Cybersecurity Law, Network Product and Service Security Duties

Cybersecurity Law of the People's Republic of China (as amended by the Decision of October 28, 2025, effective January 1, 2026), Art. 24

In force since 1 Jan 2026.

A product security requirements rule binding private bodies.

Obligation class: Security, Governance, Reporting

What it requires

This binds a provider of a network product or service; the Law's duties on network operators generally are filed as rows of their own.
Meet the mandatory requirements of the applicable national standard for your product or service, and do not embed a malicious program in it.NIST CSF 2.0GV.OC-03 NIST CSF 2.0PR.PS-06
On discovering a security defect, vulnerability, or other risk in your product or service, immediately take remedial measures, notify affected users as provided, and report the defect or vulnerability to the competent authority; the statute states no numeric clock for this notice, only immediacy.NIST CSF 2.0RS.CO-02 NIST CSF 2.0PR.PS-02
Provide continuous security maintenance for your product or service and do not terminate it within the period fixed by regulation or agreed with your user.NIST CSF 2.0PR.PS-02
Where your product or service collects user information, disclose that collection and obtain consent, and where personal information is involved, also follow this Law's and the Personal Information Protection Law's personal-information rules, already this jurisdiction's privacy row.no control in the NIST CSF 2.0

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework

PR.PO-P10A vulnerability management plan is developed and implemented.

NIST CSF 2.0

GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
PR.PS-02Software is maintained, replaced, and removed commensurate with risk
PR.PS-06Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle
RS.CO-02Internal and external stakeholders are notified of incidents

CIS Controls

3.2A maintained catalogue of the sensitive data the enterprise holds and where it sits.
3.10Encryption of sensitive data as it crosses networks.
3.11Encryption of sensitive data where it is stored on servers and applications.
6.8Access rights defined by job role, and kept up to date.
7.1A documented, reviewed approach to finding and handling weaknesses.
8.2Turning on and gathering logs from the enterprise's systems.

1 more

17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.

FINOS AIGF

AIR-PREV-005System Acceptance Testing
AIR-PREV-006Data Quality & Classification/Sensitivity
AIR-PREV-007Legal and Contractual Frameworks for AI Systems
AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
AIR-PREV-012Role-Based Access Control for AI Data
AIR-PREV-014Encryption of AI Data at Rest

7 more

AIR-PREV-017AI Firewall Implementation and Management
AIR-PREV-020MCP Server Security Governance
AIR-PREV-024Human-in-the-Loop Action Approval Gate
AIR-DET-001AI Data Leakage Prevention and Detection
AIR-DET-004AI System Observability
AIR-DET-011Human Feedback Loop for AI Systems
AIR-DET-021Agent Decision Audit and Explainability

ENISA NIS2 guidance

1.1Policy on the security of network and information systems
1.2Roles, responsibilities and authorities
2.1Risk management framework
2.2Compliance monitoring
3.1Incident handling policy
3.2Monitoring and logging

11 more

3.4Event assessment and classification
3.5Incident response
3.6Post-incident reviews
4.1Business continuity and disaster recovery plan
4.3Crisis management
6.2Secure development life cycle
6.5Security testing
6.10Vulnerability handling and disclosure
9.1Cryptography
11.2Management of access rights
12.4Asset inventory

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.

If you get it wrong

Criminal exposureNo

Criminal exposure note

Article 62 attaches only administrative fines, escalating on cross-reference to Article 61's third paragraph, to a violation of this duty; the Law's general residual clause, Article 76, reaches criminal liability only for conduct that independently constitutes a crime under other law, not for this duty by itself.

Penalty structure

Article 62's own ceiling for an ordinary violation (embedding a malicious program, failing to remediate and report a known defect or vulnerability, or prematurely ending security maintenance) is a fine of 50,000 to 500,000 yuan, plus 10,000 to 100,000 yuan against the directly responsible manager, once the provider refuses to correct the violation or the violation endangers network security; a first violation with no such aggravating fact draws only a corrective order and a warning. Article 62's second paragraph cross-references Article 61's third paragraph for a violation that causes a large-scale data leak or critical information infrastructure's loss of a local function (500,000 to 2,000,000 yuan) or loss of a primary function (2,000,000 to 10,000,000 yuan), which this structure does not carry a separate field for.

Rule: Fixed only
As of: 12 September 2026
Currency: CNY
Fixed cap: 500,000

Who enforces it

Enforcement body

The competent department with jurisdiction over the provider, acting within the national coordination the Cyberspace Administration of China exercises over network-security work under Article 9 of the Law.

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

A provider of a network product or service must ensure the product or service meets the mandatory requirements of the relevant national standard and must not embed a malicious program in it. On discovering that its product or service has a security defect, vulnerability, or other risk, the provider must immediately take remedial measures and, as provided, promptly notify users and report to the competent authority.

The provider must continuously maintain the product's or service's security and must not terminate that maintenance within the period fixed by regulation or agreed with the user. Where the product or service collects user information, the provider must disclose that collection and obtain consent, and, where personal information is involved, comply with this Law's and the Personal Information Protection Law's rules on personal information.

An ordinary violation draws a corrective order, a warning, and a fine of 50,000 to 500,000 yuan if the provider refuses to correct or the violation endangers network security, with a further escalation, cross-referenced from Article 61's third paragraph, of 500,000 to 2,000,000 yuan for causing a large-scale data leak or the loss of a local function of critical information infrastructure, and 2,000,000 to 10,000,000 yuan where critical information infrastructure loses a primary function.

When LexLint raises it

When your app profile says your app distributes a software product or ships a mobile app.

Back to the example · Lint your app

Page updated 12 September 2026.