In May 2024 the Cyberspace Administration of China and other departments issued the Provisions on the Security Management of Internet Government Applications, effective 1 July 2024. The provisions address government applications, data security, supply chains, classified protection and operations management. For companies delivering government IT and government AI projects, they change the compliance baseline and what a bid document must be able to prove.
Determining the scope
The provisions target internet government applications. The key questions are whether an application serves a government function, whether it is provided over the internet and whether it processes government data. Intelligent question-answering, approval assistance and data-analysis tools built for government departments usually fall within scope; purely commercial products need separate analysis. Where the boundary is unclear, preparing to the stricter standard is safer, because acceptance and inspection of government projects tend to follow the most conservative reading.
Classified protection and supply-chain security
Government applications must meet cybersecurity classified-protection requirements, and supply-chain security is emphasised separately. Outsourced development, cloud services, model services and maintenance providers all come under review; a company is not responsible only for its own code. The more subcontracting layers, the more the supply-chain description and responsibility allocation need to be settled in advance. Supplier lists, component provenance and update mechanisms belong in delivery documents, which reduces repeated queries at acceptance.
Data classification and personal information
Government data often involves large volumes of personal information and public data, so classification, access control, log retention and sharing approval are baseline requirements. Where a government AI application uses an external model service, the contract must state clearly whether training and inference data leave the environment and whether they are used for model improvement. Personal-information protection applies in parallel with the data-security regime; the government context does not lower the processing standard.
The supplier’s delivery list
From a supplier’s perspective, deliverables include not only functionality but also security management rules, cooperation with classified-protection assessment, a supply-chain list, a data-processing description and an incident-response plan. Writing these into bid and contract documents reduces rework at acceptance. At project close, data deletion, account recovery and model retirement also need records; otherwise responsibility carries into the next phase.
Operations and incident response
The provisions impose operations-management requirements. Log retention, vulnerability management, emergency plans and drills are routine work. A security incident in a government application has a wider impact and draws more public attention than in an ordinary commercial system. Suppliers need an executable incident-reporting process with clear recipients, deadlines and forms of cooperation. Naming emergency contacts, backup and recovery arrangements in a contract annex prevents ambiguity when an incident occurs. Drill records are themselves inspection material and cannot be produced at short notice. Companies serving several government clients should keep a separate security file for each project so that material is not mixed up.
For security and data arrangements in government projects, see our cybersecurity compliance service and data compliance service; for project access, see business licensing.
This article is based on the Provisions on the Security Management of Internet Government Applications issued by the Cyberspace Administration of China and other departments in May 2024 and effective 1 July 2024, and on public information. It is for reference only and does not constitute legal advice.