On 31 January 2026 the Cybercrime Prevention Law (Draft for Comment) was released for public comment through the cybersecurity bureau of the Ministry of Public Security. As foundational legislation in the cyber field, the very act of soliciting comment sends a clear legislative signal.
Legislative background
The current legal framework in the cyber field is built on the Cybersecurity Law, the Data Security Law and the Personal Information Protection Law, supplemented by specialised legislation such as the Anti-Telecom and Online Fraud Law. But for “cybercrime” as a collective concept, there has been no unified prevention law. The drafting of the Cybercrime Prevention Law is intended to fill that gap.
From public information, the draft continues several recent priorities in cyber governance: strengthening research on and crackdowns against new types of cybercrime, reinforcing platform responsibility, and improving cross-border cooperation mechanisms.
Interface with AI governance
Although the draft’s direct subject is cybercrime, there are two clear points of overlap with AI governance.
First, AI-generated disinformation. The Central Political and Legal Work Conference has already called for cracking down on the use of AI to generate and publish disinformation; see our note on AI at the Central Political and Legal Work Conference. If the prevention law makes provision for “using technological means to commit cybercrime”, it may cover AI-generated disinformation.
Second, the contest between technology and regulation. The conference also called for guarding against the use of encryption to evade regulation. If this idea enters the statutory text, it may affect platforms’ duty to cooperate on technology.
Implications for companies
First, platform responsibility may grow further. If the law strengthens platforms’ duties at the discovery, handling and reporting stages, content platforms will need to upgrade technical and management measures accordingly. See reporting channels for AI misuse.
Second, AI service providers’ review duties may be refined. Labelling, traceability and interception of generated synthetic content may become concrete statutory forms. See enforcement of synthetic-content labelling.
Third, cross-border cooperation clauses deserve attention from companies going global. Where cross-border data and enforcement cooperation are involved, companies need to assess the layering of rules in two places; see our multi-jurisdiction service.
Recommendations
The comment stage is a window for companies to express concerns and adapt early. We suggest companies watch three questions: whether their business may fall within the scope of “cybercrime prevention”; whether existing content-review and data-retention mechanisms can meet a possible upgrade in duties; and whether cross-border business needs structural adjustment under cooperation clauses. See our data compliance service and our criminal compliance service.
The impact of foundational legislation often lies not in the text itself but in the regulatory direction it establishes. For AI companies, the earlier that direction is built into compliance planning, the less they will have to react passively once the law takes effect.
This article is based on public information on the Cybercrime Prevention Law (Draft for Comment). It is for general reference only and does not constitute legal advice.