Beijing has moved its data governance regime into a more procedural phase with the finalization of the Measures for Network Data Security Risk Assessment. Issued jointly by the Cyberspace Administration of China (CAC), the Ministry of Industry and Information Technology (MIIT), and the Ministry of Public Security (MPS) as Order No. 24, the new rules will take effect on August 20, 2026. The regulations convert abstract duties into a concrete rulebook with specific deadlines, retention periods, and compliance boundaries.
The final text represents a significant pivot from earlier drafts, generally easing the compliance burden on businesses while simultaneously strengthening the cross-agency supervisory framework. The rules implement provisions from the 2025 Regulations on Network Data Security Management, requiring important data handlers to conduct annual risk assessments, according to analysis by Geopolitechs.
AI-Specific Compliance Hooks
For technology companies operating in China, the most critical aspect of the new Measures is their explicit inclusion of artificial intelligence. The assessment scope is designed to cover new risks introduced by AI systems, including excessive bulk data collection, data poisoning, and model memorization that could leak training data or personal information. For companies deploying large language models in the Chinese market, this annual assessment represents one of the first hard compliance hooks tying AI data practices to a named regulatory duty.
The assessment is not a static conformity test like China’s Multi-Level Protection Scheme (MLPS). Instead, it is a dynamic risk-evaluation activity that targets data processing activities in motion. It requires organizations to evaluate every system that holds a copy of the data, assess data-leakage risks arising from network weaknesses, and define responsibility boundaries when data is entrusted to or jointly processed with third parties.
(Related: Beijing Moves To Regulate AI Chatbots With New Draft Rules On Interactive Services)
The practical implication for foreign companies operating in China is significant. Multinationals that process Chinese user data through AI systems, whether for recommendation engines, customer service chatbots, or internal analytics, will need to build an annual compliance cycle around these assessments. The three-year document retention requirement means that audit trails must be maintained across multiple assessment cycles, creating a longitudinal record of data handling practices that regulators can inspect. For companies that have historically treated China’s data rules as a checkbox exercise, Order No. 24 introduces procedural specificity that makes that approach untenable.
Easing the Burden on Business
While the scope is comprehensive, the final rules offer several concessions to industry compared to the December draft. The reporting deadline for important data handlers has been extended from 10 to 20 working days after the annual assessment is completed, providing more time for internal review. Furthermore, the mandatory reporting template has been dropped entirely, allowing companies to prepare reports in accordance with their sector regulator’s rules or relevant national standards.
The compulsion to use third-party auditors has also been lowered. Where the draft stated regulators “shall” require a certified third-party body in qualifying cases, the final text says they “may” do so. If a company chooses to commission a third-party body, those auditors face strict limits: they cannot sub-delegate the work, they cannot conduct more than three consecutive annual assessments for the same client, and they must maintain strict confidentiality over the data and trade secrets they access. The reports must be filed with the relevant sector regulator or cyberspace authority and retained for at least three years.
The overall direction of travel in China’s data governance regime is toward greater specificity and enforceability, even as individual rules are softened at the margins. The joint issuance by three agencies (CAC, MIIT, and MPS) signals that data security is now treated as a cross-cutting concern that spans cybersecurity, industrial policy, and public order. Companies that have built compliance programs around any single agency’s rules will need to broaden their frameworks to account for this multi-regulator reality.
For the AI industry specifically, Order No. 24 represents the beginning of a compliance cycle that will become more demanding over time, not less. The August 20 effective date gives companies roughly two months to prepare their first assessment frameworks. Organizations that treat this deadline seriously, building internal data mapping processes, identifying which systems qualify as important data handlers, and establishing relationships with approved third-party auditors, will be better positioned when regulators begin enforcement actions. Those who wait for the first enforcement case to clarify what compliance actually requires may find themselves scrambling to catch up in a regulatory environment that has historically moved from guidance to enforcement faster than foreign companies expect.
The rules also have implications for cross-border data flows. Companies that transfer data out of China as part of their AI workflows, for model training, cloud processing, or international product development, will need to ensure that their outbound transfer mechanisms are consistent with the risk assessment findings. Order No. 24 does not operate in isolation: it sits alongside the Data Security Law, the Personal Information Protection Law, and the existing cross-border data transfer rules, creating a layered compliance architecture that requires legal, technical, and operational teams to work in close coordination.
