The Evolution and Regulation of Commercial Cryptography

Summary

---

|

• China's regulations for commercial cryptography are out of date and out of sync with the government's current regulatory approach
• Imminent amended regulations will expand the scope of commercial cryptography while at the same time strengthening state security requirements
• The amended regulations also set up testing and certification mechanisms and make use of certified products mandatory in some cases
• However certain critical issues remain unclear, including whether use of China's cryptography algorithms will also be mandatory in some cases
• Regulators are expected to issue clarifications in due course

On May 24, 2023, after review at an executive meeting in April, China's State Council published the Amended Regulations for the Administration of Commercial Cryptography（商用密码管理条例, the "Amended Regulations"). The Amended Regulations will take effect on July 1, 2023.

In the context of the rapid development of cryptographic technology over the past 20 years, the Regulations for the Administration of Commercial Cryptography adopted in 1999 (the "1999 Regulations") no longer reflect the latest technological features in this field and the new regulatory thinking of the Chinese government.  A project to revise the 1999 Regulations began in 2019, when the PRC Cryptography Law（密码法）took effect , a change which was deemed as a "structural reshaping of China's administration system of commercial cryptography". In August 2020, the draft amendment to the 1999 Regulations ("2020 Draft") was published by the State Cryptographic Administration (SCA) in order to gather comments but no other progress was disclosed until the adoption of the amendment in April 2023. Some significant changes were made, as compared to the 1999 Regulations, and there are also a number of important differences between the Amended Regulations and 2020 Draft. Examining these changes helps reveal the regulatory trends in commercial cryptography in China.