On 1 January 2026 China’s revised Cybersecurity Law took effect. It is the first amendment to the law since it was enacted in 2016; the amendment decision was adopted by the Standing Committee of the 14th National People’s Congress on 28 October 2025.
The core change: AI enters the statute
The most closely watched change is the new Article 20, which makes dedicated provision for the safety and development of artificial intelligence. The state supports basic theoretical research and key technology development in AI, advances the construction of training-data resources and computing infrastructure, improves AI ethics norms, strengthens risk monitoring, assessment and safety supervision, and promotes the sound application and development of AI.
The article also states that the state supports the use of AI to improve the level of cybersecurity protection. This “two-way” formulation — using law to promote AI development, and AI to strengthen cybersecurity — continues the “development and security in step” approach seen in recent years.
Beyond the new article, the amendment also adjusted certain legal liabilities, increased penalties for violations, and renumbered the provisions on re-publication.
Why this is a lift in legal hierarchy
Until now, the main instruments for AI governance were departmental rules and normative documents, such as the Interim Measures for the Management of Generative AI Services, the Provisions on the Administration of Deep Synthesis of Internet Information Services and the Measures for Labelling AI-Generated Synthetic Content. These are relatively low in the hierarchy and mostly address the service side.
Writing AI into the Cybersecurity Law — a foundational statute — changes three things. First, AI governance gains an upper-law basis, opening space for future supporting legislation. Second, the institutional interface between cybersecurity and AI governance is opened up, so data, computing power and algorithms are no longer isolated compliance topics. Third, companies’ sources of obligation expand from “complying with departmental rules” to “complying with the law.”
Three implications for AI companies
First, the compliance checklist needs to be re-aligned. Companies used to manage filing, labelling and assessment as three separate tracks. With the upper law giving equal weight to training-data resources, computing infrastructure, ethics norms and risk monitoring, these matters now need to be coordinated within one governance framework. See our notes on the transparency rules taking effect and our algorithm filing service.
Second, security spending moves from a cost item to a compliance item. The statutory language of “safety supervision” makes risk monitoring and assessment no longer optional. See our note on AI application ethics and security guidelines.
Third, companies going global must re-assess overlapping rules. As domestic upper-law requirements tighten, the EU AI Act’s transparency obligations are already in force, raising the complexity of dual-track compliance. See our data compliance service.
Three things companies can start on now
First, put “training-data sources” and “computing procurement” into a single compliance ledger, clarifying the data authorisation chain and the boundaries of computing use. Second, self-assess existing systems against the four dimensions of Article 20 — technology development, data and computing, ethics norms, and risk monitoring — to identify gaps. Third, track the supporting legislation that follows, in particular the dedicated AI law process.
A higher legal hierarchy does not necessarily mean obligations increase immediately, but it changes the anchor of supervision. For AI companies, the earlier governance moves from “responding to inspections” to being built in, the lower the cost of later adjustment.
This article is based on China’s revised Cybersecurity Law and related decisions of the NPC Standing Committee and public information. It is for general reference only and does not constitute legal advice.