Industrial Policy & Trade Monitor· 2666 actions· ✨ 90 recent

On June 8, 2026, the US Department of Defense published its annual update to the Section 1260H Chinese Military Companies (CMIC) list, adding 65 entities (17 new parent companies and 48 subsidiaries), bringing the total to approximately 188–200 designated entities. Major additions span EV and battery manufacturing (BYD, NIO, CATL), consumer internet (Alibaba, Baidu, Tencent), semiconductors (SMIC, YMTC, CXMT), solar (JA Solar, Trina Solar), biotech (BGI Genomics, WuXi AppTec), drones/robotics (DJI, Unitree, RoboSense), and telecoms (TP-Link). Effective June 30, 2026, DoD is prohibited from procuring goods, services, or technology directly from listed entities; effective June 30, 2027, the ban extends to indirect supply-chain procurement through prime contractors and all sub-tiers.

Mexico's tax authority (SAT), acting under SHCP, published the Cuarta Resolución de Modificaciones a las Reglas Generales de Comercio Exterior para 2025 in the Diario Oficial de la Federación on 28 July 2025, raising the flat tax rate applied under the simplified customs regime for low-value courier and parcel shipments (goods valued at USD 2,500 or less) from 19% to 33.5%, effective 15 August 2025. The increase applies to shipments from countries without a free trade agreement with Mexico — in practice overwhelmingly China-origin goods — and is aimed at cross-border e-commerce platforms (Shein, Temu, AliExpress) as well as triangulated goods routed through courier channels by other importers including large retailers. The measure is framed by SHCP as combating under-invoicing and non-tariff-preference triangulation via the courier de minimis channel.

On 10–11 May 2025 in Geneva, US Treasury Secretary Scott Bessent and USTR Jamieson Greer met with PRC Vice Premier He Lifeng and on 12 May 2025 issued the "Joint Statement on US-China Economic and Trade Meeting in Geneva," producing the first bilateral de-escalation of the post-2 April 2025 reciprocal-tariff stand-off. The agreement was implemented on the US side via Executive Order 14298 of 12 May 2025 ("Modifying Reciprocal Tariff Rates To Reflect Discussions With the People's Republic of China," published in the Federal Register 21 May 2025 as 90 FR 21831 / 2025-09297) and on the Chinese side via State Council Tariff Commission Announcement No. 4 of 2025. Effective 12:01 a.m. EDT on 14 May 2025, both sides suspended for 90 days (through 12 August 2025) the 24 percentage points of additional ad valorem duty layered on top of the prior 10% reciprocal rate, while the 10% reciprocal rate itself was retained. On the US side this reduced the headline reciprocal-tariff burden on PRC-origin goods from a 125% scheduled rate (under EOs 14259 and 14266) to 10%; combined with the still-in-force 20% IEEPA-fentanyl tariff under Executive Order 14195 (separately filed: `2025-02-01-us-trump-fentanyl-tariffs-canada-mexico-china`), the effective additional rate on most Chinese imports came down to ~30%. China made a parallel 24pp suspension on US-origin goods (from a 125% retaliatory rate to 10%) and additionally suspended non-tariff countermeasures imposed since 2 April 2025 (export controls, unreliable-entity designations, MOFCOM probes). The truce is structurally a calibrated freeze of the reciprocal-tariff ladder under the April 2025 regime, not a repeal: the underlying EO 14257 / IEEPA framework remains intact and was scheduled to re-engage at the 24pp escalated rate on 12 August 2025 absent further extension. The Geneva agreement is the precursor to the August 2025 Stockholm extension and the October 2025 Busan Economic and Trade Arrangement (separately filed: `2025-10-30-us-china-busan-economic-trade-arrangement`).

Indonesia's Ministry of Communications and Digital Affairs (Kemkomdigi) promulgated Permenkomdigi No. 5/2025 on 25 March 2025 as the implementing regulation under Government Regulation PP 71/2019 governing Public-Scope Electronic System Operators (PSE Lingkup Publik), defined as operators running electronic systems for government institutions or critical public services. The regulation mandates registration, data classification by risk level (low/medium/ high/strategic) with corresponding domestic storage and processing requirements, content- moderation governance, and access-blocking mechanisms for prohibited electronic information. All public-scope PSEs must achieve compliance by 25 March 2026, with non-compliant operators subject to progressive administrative sanctions under Articles 100-series ranging from written warnings to access disconnection (pemutusan akses) and removal from official registries.

Regulation (EU) 2025/40, published in the Official Journal on 22 January 2025 and entering into force on 11 February 2025, replaces the 1994 Packaging and Packaging Waste Directive 94/62/EC with a directly-applicable Regulation. It mandates binding recycled-content targets for plastic packaging (by polymer and format, reaching 30–65% by 2030 with higher targets by 2040), minimum reusable-packaging shares for beverages and transport, recyclability standards for all packaging placed on the EU market from 2030, deposit-return-scheme obligations for beverage containers from 2029, and bans on specified single-use plastic packaging formats. General application begins 12 August 2026, with staggered compliance windows extending to 2030 and beyond, affecting all non-EU exporters shipping consumer goods, beverages, or e-commerce fulfilment into the EU single market.

On 25 October 2023 the Bureau of Industry and Security published an interim final rule (88 FR 73424; FR Doc 2023-23055) making substantive revisions to the October 7 2022 advanced-computing IFR, incorporating 43 public comments covering 78 topics. The rule replaced the prior TOPS-based performance metric with a new "Total Processing Performance" (TPP) / performance-density dual-threshold structure for ECCN 3A090, splitting the control into tiers 3A090.a (full licence requirement for highest-capability datacenter AI chips) and 3A090.b (new License Exception NAC with 25-day prior notification for the intermediate tier). Geographic scope was expanded from China-and-Macau to Country Groups D:1/D:4/D:5 to block diversion via third-country intermediaries and offshore datacenters.

President Biden signed Executive Order 14105 on 9 August 2023, "Addressing United States Investments in Certain National Security Technologies and Products in Countries of Concern", establishing the first dedicated US outbound-investment screening regime. The EO directs Treasury to prohibit or require notification of US investments in Chinese (and Hong Kong, Macau) entities engaged in three categories of technology: (1) semiconductors and microelectronics, (2) quantum information technologies, (3) artificial intelligence systems. After a public-comment process, Treasury issued the final rule (31 CFR Part 850) on 28 October 2024, effective 2 January 2025.

Regulation (EU) 2022/2065 on a Single Market For Digital Services (Digital Services Act, DSA) was adopted by the European Parliament and Council on 19 October 2022, published in OJ L 277 on 27 October 2022, entered into force on 16 November 2022, and applied in full from 17 February 2024 (with VLOP/VLOSE obligations applying from 25 August 2023 following the Commission's initial designation letters of February 2023). The DSA establishes a graduated intermediary-liability and platform-safety framework covering all online intermediaries serving EU users, with the heaviest obligations falling on designated Very Large Online Platforms (VLOPs, ≥45m monthly active EU users) and Very Large Online Search Engines (VLOSEs): systemic-risk assessments, annual independent audits, vetted-researcher data access, recommender-system transparency, online-advertising transparency, and crisis-response cooperation mechanisms under Commission coordination. The European Commission holds exclusive enforcement authority over VLOPs and VLOSEs, with fines up to 6% of global turnover. The DSA is the structural twin-pillar to the Digital Markets Act (Reg (EU) 2022/1925): the DMA governs ex-ante competition obligations on designated gatekeepers; the DSA governs ex-post intermediary-liability, content-moderation, and platform-safety obligations across all online intermediaries.

The Personal Information Protection Law of the People's Republic of China (中华人民共和国个人信息保护法 — PIPL) was adopted at the 30th meeting of the 13th NPC Standing Committee on 20 August 2021 and entered into force on 1 November 2021, constituting the third and final pillar of China's cybersecurity and data-governance regulatory trinity alongside the Cybersecurity Law (2016) and the Data Security Law (2021). The PIPL is China's comprehensive personal-information statute establishing consent-based and necessity-based legal bases for PI processing, a tiered cross-border personal-data transfer regime (CAC security assessment / PI protection certification / Standard Contractual Clauses), extraterritorial application (Art. 3) to non-Chinese controllers offering services to or analysing the behaviour of PRC residents, and a heightened protection regime for sensitive personal information and data of minors under 14. It mandates data-protection impact assessments, personal-information-protection-officer obligations at designated handlers, breach notification, and a full suite of data-subject rights including access, rectification, deletion, portability, objection, and automated- decision-making opt-out. Article 53 requires overseas controllers to establish a domestic representative or designated entity in China, providing a domestic enforcement counterparty.

The Data Security Law of the People's Republic of China (中华人民共和国数据安全法) was adopted at the 29th meeting of the 13th NPC Standing Committee on 10 June 2021 and entered into force on 1 September 2021, constituting the second pillar of China's cybersecurity and data-governance regulatory trinity alongside the Cybersecurity Law (2016) and the Personal Information Protection Law (2021). The DSL establishes a tiered data-classification regime — "important data" and "national core data" — with escalating security obligations including risk assessment, risk monitoring, breach reporting, and classified-protection requirements for data handlers. It introduces a data-export security review for "important data" generated or collected within China, the statutory parent authority operationalised by the 2024 CAC Cross-Border Data Flow Provisions, and enacts a §36 blocking statute prohibiting Chinese organisations and individuals from transferring data stored in China to foreign judicial or law-enforcement authorities without prior PRC government approval.

The Cybersecurity Law of the People's Republic of China (中华人民共和国网络安全法) was adopted at the 24th meeting of the 12th NPC Standing Committee on 7 November 2016 and entered into force on 1 June 2017, establishing the foundational legal framework for network security governance across all sectors. The law creates the Critical Information Infrastructure Operator (CIIO) designation and protection regime administered by the Cyberspace Administration of China (CAC), mandates data localisation for personal information and important data collected or generated by CIIOs in China, and establishes cross-border data-transfer security assessment requirements under Article 37 — the provision later operationalised by DSL 2021, PIPL 2021, and the 2024 CAC Cross-Border Data Flow Provisions. The CSL introduced multi-level protection scheme (等级保护制度 / MLPS) obligations for all network operators and network-product/service security-review procedures, under which CAC triggered the cybersecurity review of Didi Global in 2021 and the exclusion of Micron's products from Chinese critical-infrastructure projects in 2023.