On 6 December 2025 the Cyberspace Administration of China opened public consultation on the draft Measures for the Administration of Network Data Security Risk Assessment, with comments due by 5 January 2026.
What the Measures would solve
The Data Security Law and the Network Data Security Management Regulations already establish the requirement for data security risk assessment, but there has long been no unified operational rule on what to assess, how often, and how the result is used. The draft’s role is to convert the parent-law principles into an executable assessment regime.
From the published content, the draft defines network data security risk assessment as “activities such as risk identification, risk analysis and risk evaluation carried out on the security of network data and network data processing activities” — a definition that extends the assessment object from “data” to “processing activities”, meaning assessment looks not only at the data but at how it is processed.
Two tiers of duty
Important data processors: annual assessment is mandatory. Network data processors handling “important data” must conduct a risk assessment of their processing activities every year. This is compulsory.
General data processors: encouraged. For processors of ordinary data, the draft takes an encouraging approach, setting no mandatory frequency.
This tiering connects with existing regimes such as the personal information protection impact assessment and the important data processor concept. See our note on major personal information processor obligations.
Practical significance for AI companies
AI companies are often closer to “important data” than they realise.
First, training corpora may constitute important data. Where a corpus involves industry operating data, geographic information or group behaviour data, it may be classified as important data. Once in scope, the company becomes an important data processor subject to the annual assessment duty.
Second, model training and inference are themselves assessed “processing activities”. By bringing “processing activities” into the assessment object, the draft makes the whole chain — collection, annotation, training, inference, storage and deletion — potentially assessable.
Third, the assessment report may become a regulatory verification tool. The draft sets up a mechanism for submitting and verifying assessment reports and requires independence of third-party assessors. Assessment is therefore not merely an internal self-check but a formal document that may be externally verified.
What companies can prepare
First, classify and grade data first. Determining whether you process important data is the precondition for all downstream duties. Without classification and grading, duty intensity cannot be determined.
Second, put the assessment cycle into the annual compliance calendar. For companies that may be important data processors, establish the timetable, owners and archive mechanism for annual assessment in advance. See our data compliance service.
Third, distinguish data security risk assessment from other assessments. Cross-border data security assessment, personal information protection impact assessment and network data security risk assessment are three different regimes with different triggers and content, and are not interchangeable.
Connection to the final Measures
After the consultation period, the Measures were finalised and took effect, establishing the annual assessment duty for important data processors, the mechanism for submitting and verifying reports, and independence requirements for third-party assessors. See our note on the Measures for the Administration of Network Data Security Risk Assessment.
From consultation to entry into force, the direction is clear: data security risk assessment is moving from a “principle” to a “periodic action”. For AI companies handling important data, building assessment capability early is the best way to avoid being on the back foot in a regulatory review.
This article is based on the Cyberspace Administration of China’s draft Measures for the Administration of Network Data Security Risk Assessment and public information. It is for general reference only and does not constitute legal advice.