On 20 August 2026, the Measures for Network Data Security Risk Assessment (Order No. 24 of three departments), jointly issued by the Cyberspace Administration of China, the Ministry of Industry and Information Technology and the Ministry of Public Security, took effect. Adopted at the executive meeting of the Cyberspace Administration of China on 1 June 2026 and published on 18 June, the Measures provide unified procedural rules for network data security risk assessment. On the day they took effect, a responsible official of the Ministry of Public Security answered reporters’ questions on their application.
For companies processing important data, the Measures turn assessment requirements previously scattered across the Data Security Law and the Network Data Security Management Regulations into an operable annual mechanism.
Who must assess, and how often
Article 5 distinguishes assessment frequency by data importance:
Important data processors must carry out a risk assessment each year. In addition, where the security status of important data undergoes a major change that may adversely affect data security, the changed part and its impact must be assessed promptly, without waiting for the annual milestone.
For network data processors handling ordinary data, the Measures adopt an encouraging stance, recommending assessment at least every three years. This means ordinary data processors are not subject to a mandatory duty, but once they take on business involving important data, the assessment duty is triggered accordingly.
Self-assessment or commissioned assessment
Article 7 offers two paths: a network data processor may carry out the assessment itself or commission a third-party assessment institution. Where it self-assesses, it must designate a person in charge; where it commissions, the rights and obligations of both parties must be defined through a contract or other legally effective document.
Article 8 encourages assessment institutions to obtain certification, which follows the Certification and Accreditation Regulations. The practical takeaway for companies is: if commissioning, check first whether the institution is certified and retain the engagement documents for verification.
Preparing and submitting the assessment report
This is the most operational part. Article 15 requires important data processors to prepare a risk assessment report lawfully, kept for at least three years. Where the competent authorities have not prescribed a format, the relevant national standards on data security risk assessment may be followed.
Article 16 establishes the reporting chain: an important data processor must submit the report to the relevant competent authority within 20 working days after completing the annual assessment; where the competent authority is unclear, to the provincial or national cyberspace authority. On receiving the report, the competent authority must notify the cyberspace authority at the same level within 10 working days, and the national cyberspace authority then consolidates and shares it with the State Council departments for telecommunications, public security and state security.
At the same time, cyberspace authorities at or above the provincial level, telecommunications authorities, public security organs and state security organs may inspect and verify the truthfulness and accuracy of reports, and important data processors must cooperate.
Constraints on third-party assessment institutions
A set of provisions delineates the independence of assessment institutions — equally important for companies procuring third-party services:
Assessment institutions may not sub-delegate the assessment to other institutions; the same institution and its affiliates may not carry out annual risk assessments for the same network data processor more than three times consecutively. This means the practice of having one institution “take charge” of assessments over the long term is no longer viable after the Measures take effect.
Where an assessment institution discovers a major data security risk during assessment, it must promptly notify the network data processor; it has a confidentiality duty over data, trade secrets and other information obtained during assessment, and must delete it promptly after assessment or dispose of it properly under contract. The institution is also responsible for the truthfulness, validity and completeness of the reports it issues.
When a commissioned assessment is mandated
Article 17 lists two situations in which a regulator may require a company to commission a certified institution:
First, where network data processing activities pose a relatively large security risk that may harm national security or public interests; second, where a network data security incident has led to the leakage or theft of important data or large-scale personal information.
A company may not be required to commission an assessment more than once for the same incident or risk. After commissioning an assessment at the regulator’s request, a company must cooperate with access to facilities, data and logs, complete the assessment within the deadline and submit a signed and sealed report; after rectifying issues found in the assessment, it must submit a rectification report within 15 working days. Companies may not in any way require or hint that an assessment institution issue a false or improper report.
What this means for AI companies
The Measures do not distinguish by industry, but the data forms of AI companies make it easy for them to fall within scope.
Training corpora, user-interaction data and model-output logs: as long as part of this data is identified as important data, the company must carry out an annual assessment and submit a report. Whether data constitutes “important data” depends on the important-data catalogue and identification rules of the competent industry authority, not the company’s own judgement — and this is the first thing many AI companies need to clarify.
The assessment cycle and reporting deadline (20 working days) should enter the annual compliance calendar to avoid procedural violations through omission. For important data processors that refuse to rectify or fail to meet rectification requirements, regulators may require them to stop processing important data — a direct impact for data-driven AI businesses.
Where important data is exported, the process must connect with existing export-assessment procedures; the conclusions of the two assessments can support each other, but the materials and standards must be consistent. For related discussion, see our Data Compliance service page and the Large Personal Information Processor obligations.
For support on identifying important data, organising annual risk assessments and preparing reports, see our Data Compliance service; on algorithm and model-side filing arrangements, see our Algorithm Filing service.
This article is based on the Measures for Network Data Security Risk Assessment (Order No. 24) published on 18 June 2026 by the Cyberspace Administration of China, the Ministry of Industry and Information Technology and the Ministry of Public Security. It is for reference only and does not constitute legal advice. Specific compliance judgements should be based on the official text and applicable law.