Industrial Policy & Trade Monitor· 2662 actions· ✨ 89 recent

On June 8, 2026, the US Department of Defense published its annual update to the Section 1260H Chinese Military Companies (CMIC) list, adding 65 entities (17 new parent companies and 48 subsidiaries), bringing the total to approximately 188–200 designated entities. Major additions span EV and battery manufacturing (BYD, NIO, CATL), consumer internet (Alibaba, Baidu, Tencent), semiconductors (SMIC, YMTC, CXMT), solar (JA Solar, Trina Solar), biotech (BGI Genomics, WuXi AppTec), drones/robotics (DJI, Unitree, RoboSense), and telecoms (TP-Link). Effective June 30, 2026, DoD is prohibited from procuring goods, services, or technology directly from listed entities; effective June 30, 2027, the ban extends to indirect supply-chain procurement through prime contractors and all sub-tiers.

The US Bureau of Industry and Security issued a final rule (RIN 0694-AK43, 91 FR 1684, signed 13 January 2026, effective 15 January 2026) revising the EAR license-review policy for exports of certain advanced-computing integrated circuits to end-users in China and Macau from a presumption of denial to case-by-case review. Eligibility is limited to commodities controlled under ECCN 3A090.a and 3A090.b with a Total Processing Performance (TPP) below 21,000 and total DRAM bandwidth below 6,500 GB/s — the band that covers NVIDIA H200 and AMD MI325X-equivalents and below. To qualify, exporters must certify (i) sufficiency of US supply such that the export will not delay domestic orders or divert foundry capacity, (ii) that aggregate TPP of advanced-node ICs exported to China or Macau will not exceed 50% of domestic shipments, (iii) compliance with end-use and end-user prohibitions, and (iv) prior performance review by a qualified independent third-party testing lab headquartered in the United States. The rule is the first material rollback of the October 2022 / October 2023 / December 2024 advanced-computing export-control architecture and operationalises the Trump-administration policy of trading H200-class chip access against Chinese cooperation on critical minerals, fentanyl precursors and Taiwan-strait restraint.

On 30 December 2025 the General Office of the Shanghai Municipal People's Government issued Hufubangui [2025] No. 20, a three-year action plan (1 January 2026 - 31 December 2028) to support the transformation and upgrading of advanced manufacturing. The plan sets quantitative targets — 100 new manufacturing enterprises with annual output above CNY 1 billion by 2028 (cumulative 600+), 500 new above-designated-size supply-chain enterprises, 100+ new national-level green factories, a robot density of 600 units per 10,000 workers, and 70%+ digital-equipment penetration — across next-generation electronics, intelligent connected new-energy vehicles, high-end equipment, advanced materials, green low-carbon and fashion consumer-goods industries, plus emerging bets on the low-altitude economy, commercial aerospace, embodied intelligence (robotics) and biomanufacturing. It is funded through tiered direct subsidies rather than tax relief: one-off R&D subsidies up to CNY 10 million, equipment/new-materials cost-share up to 30% of contract value (capped at CNY 20 million), technical- transformation loan/leasing interest support up to CNY 20 million cumulative, and 0.8-1.3% interest subsidies on component/material backup-inventory financing.

On 24 December 2025 China's National Development and Reform Commission (NDRC) and Ministry of Commerce (MOFCOM) jointly issued Order No. 37, the Catalogue for Encouraging Foreign Investment in Industries (2025 Edition), effective 1 February 2026 and replacing the 2022 Edition (issued 26 October 2022). The revised catalogue expands to 1,679 total entries — a net increase of 205 and 303 modified relative to 2022 — split between a nationwide catalogue (619 entries, +100, 131 modified) and a regional catalogue for central/western China, the northeast, and Hainan (1,060 entries, +105, 172 modified). Foreign investors in listed sectors qualify for tariff and tax preferences on imported equipment and other incentives under China's foreign-investment regime. The revision prioritises advanced manufacturing and modern services and steers new entries toward inland and border provinces.

Taiwan's Legislative Yuan passed the Artificial Intelligence Basic Act (人工智慧基本法) on third reading on 23 December 2025, and President Lai Ching-te promulgated the 20-article statute on 14 January 2026, bringing it into force immediately. The Act designates the National Science and Technology Council (NSTC) as the central AI-policy competent authority and codifies seven governance principles — sustainability and well-being, human autonomy, privacy protection and data governance, cybersecurity and safety, transparency and explainability, fairness and non-discrimination, and accountability — that apply to all public-sector AI procurement and high-risk sectoral applications. The statute establishes a statutory foundation for the Taiwan AI Action Plan 2.0, mandates an Executive Yuan National AI Strategy Committee, and provides authority for sector-specific implementing regulations by FSC, NCC, MOHW, and MOTC across finance, telecoms, medical, and autonomous-vehicle AI within a two-year window. As the first national AI governance statute in the Greater China region and the third globally after the EU AI Act and South Korea's AI Basic Act, it frames regulatory expectations for the companies at the heart of the global AI hardware supply chain — TSMC, NVIDIA ODM partners, and advanced-packaging incumbents — that are headquartered or operate substantially in Taiwan.

At the APEC Busan summit on 30 October 2025, Presidents Trump and Xi reached the "Economic and Trade Arrangement Between the United States and the People's Republic of China," subsequently implemented on the US side by the executive order "Modifying Reciprocal Tariff Rates Consistent with the Economic and Trade Arrangement" (issued 4 November 2025; effective 12:01 am EST on 10 November 2025; published in the Federal Register on 7 November 2025 as 90 FR 50729 / 2025-19826) and on the Chinese side by a series of MOFCOM and State Council Tariff Commission announcements (notably MOFCOM 2025 No. 90 of 8–9 November 2025). The arrangement is structurally parallel to the already-filed US-Japan, US-Korea and US-Taiwan framework deals but uniquely material because it freezes the highest-stakes bilateral tariff and export-control confrontation of the post-2024 reset. Core US commitments: (i) reciprocal-tariff "additional ad valorem rate of duty" on PRC-origin goods reduced from a prior 20% IEEPA-fentanyl + 10% IEEPA-reciprocal stack to a 10% rate (i.e., the prior 24% / 34% scheduled escalation is suspended), extended through 10 November 2026; (ii) US BIS suspends the so-called "affiliates rule" expanding entity-list controls to majority-owned subsidiaries of listed Chinese firms; (iii) USTR pauses Section 301 maritime / shipbuilding / logistics countermeasures against Chinese vessels for one year. Core PRC commitments: (i) MOFCOM suspends for one year (until 10 November 2026) the 9 October 2025 extraterritorial rare-earth export-control package — including controls on REE processing equipment, lithium-battery manufacturing equipment, and superhard materials; (ii) PRC suspends retaliatory tariffs on a broad swath of US agricultural products through 31 December 2026; (iii) commitment to purchase ≥25 million metric tonnes of US soybeans annually in 2026-2028 and to resume sorghum and log imports; (iv) suspension of MOFCOM antitrust and "unreliable-entity" probes against named US semiconductor and chip-equipment companies; (v) cooperation on fentanyl precursor enforcement. The arrangement does not repeal underlying authorities (IEEPA tariffs, MOFCOM export-control list, Entity List) — it is a calibrated mutual freeze with a one-year sunset and quarterly review checkpoints.

President Trump signed Executive Order "Saving TikTok While Protecting National Security" on September 25, 2025, certifying a restructuring plan as a "qualified divestiture" under the 2024 PAFACA law and directing the Attorney General not to enforce the Act for 120 days while the transaction closes. The plan creates TikTok USDS Joint Venture LLC, valued at roughly $14 billion, with a new US-investor consortium (Oracle, Silver Lake and MGX at 15% each, plus other investors, totaling 50%), affiliates of existing ByteDance investors holding 30.1%, and ByteDance itself retaining 19.9%. Oracle will run US data storage and algorithm retraining/oversight; the deal closed January 22, 2026.

On 17 September 2025 the General Office of the Shanghai Municipal People's Government issued Hufubangui [2025] No. 8, a five-year (26 September 2025 - 25 September 2030) state-aid framework to accelerate frontier-technology innovation and cultivate "future industries" across six domains — future manufacturing, future information, future materials, future energy, future space and future health. Targeted technology areas include cell and gene therapy, brain-computer interfaces, biomanufacturing, embodied intelligence (humanoid robotics/AI hardware), fourth-generation semiconductors, silicon photonics, 6G, neuromorphic computing, quantum technology, controlled nuclear fusion and regenerative medicine. Support is disbursed as tiered direct subsidies rather than tax relief, with named ceilings up to CNY 30 million per proof-of-concept/R&D platform and CNY 20 million per high-quality incubator or first-product/batch innovation award.

On 10–11 May 2025 in Geneva, US Treasury Secretary Scott Bessent and USTR Jamieson Greer met with PRC Vice Premier He Lifeng and on 12 May 2025 issued the "Joint Statement on US-China Economic and Trade Meeting in Geneva," producing the first bilateral de-escalation of the post-2 April 2025 reciprocal-tariff stand-off. The agreement was implemented on the US side via Executive Order 14298 of 12 May 2025 ("Modifying Reciprocal Tariff Rates To Reflect Discussions With the People's Republic of China," published in the Federal Register 21 May 2025 as 90 FR 21831 / 2025-09297) and on the Chinese side via State Council Tariff Commission Announcement No. 4 of 2025. Effective 12:01 a.m. EDT on 14 May 2025, both sides suspended for 90 days (through 12 August 2025) the 24 percentage points of additional ad valorem duty layered on top of the prior 10% reciprocal rate, while the 10% reciprocal rate itself was retained. On the US side this reduced the headline reciprocal-tariff burden on PRC-origin goods from a 125% scheduled rate (under EOs 14259 and 14266) to 10%; combined with the still-in-force 20% IEEPA-fentanyl tariff under Executive Order 14195 (separately filed: `2025-02-01-us-trump-fentanyl-tariffs-canada-mexico-china`), the effective additional rate on most Chinese imports came down to ~30%. China made a parallel 24pp suspension on US-origin goods (from a 125% retaliatory rate to 10%) and additionally suspended non-tariff countermeasures imposed since 2 April 2025 (export controls, unreliable-entity designations, MOFCOM probes). The truce is structurally a calibrated freeze of the reciprocal-tariff ladder under the April 2025 regime, not a repeal: the underlying EO 14257 / IEEPA framework remains intact and was scheduled to re-engage at the 24pp escalated rate on 12 August 2025 absent further extension. The Geneva agreement is the precursor to the August 2025 Stockholm extension and the October 2025 Busan Economic and Trade Arrangement (separately filed: `2025-10-30-us-china-busan-economic-trade-arrangement`).

The US Bureau of Industry and Security amended the Export Administration Regulations to add 12 entities to the Entity List under the destinations of China (11) and Taiwan (1) via Final Rule 2025-05427 (90 FR 14046), companion to the larger 70-entity rule (2025-05426) published the same day. Targets fall in three clusters: (i) Beijing Academy of Artificial Intelligence and Beijing Innovation Wisdom Technology — added for acquiring US-origin items in support of China's military modernization, specifically developing large AI models and advanced computing chips for defense; (ii) the Inspur group — Inspur (Beijing) Electronic Information Industry, Inspur Electronic Information Industry, Inspur Electronic Information (Hong Kong), Inspur (HK) Electronics, Inspur Software, and Inspur Taiwan — added as subsidiaries contributing to supercomputers for military end use; and (iii) Henan Dingxin, Nettrix Information Industry, Suma Technology, and Suma-USI Electronics — added for involvement in the development of Chinese exascale supercomputers. License requirements are for all items subject to the EAR; review policy is presumption of denial for the AI cluster and policy of denial for the supercomputer clusters.

The US Bureau of Industry and Security issued its largest single export-control package targeting China's semiconductor industry on 2 December 2024, with three layered measures (final rules published in the Federal Register 5 December 2024). First, controls on high-bandwidth memory (HBM) above set performance thresholds — blocking the memory architecture that is foundational to AI training. Second, additions of 24 semiconductor manufacturing equipment item types to the Commerce Control List, covering deposition, etch, ion- implant, advanced packaging, and metrology categories. Third, Entity List designations for 140+ entities, the bulk Chinese semiconductor companies + equipment makers + investment vehicles, including major Chinese fab tooling firms. The package triggered MOFCOM's same-day-following retaliation (filed: 2024-12-03-china-mofcom-ge-ga-sb-export-ban-us).

On 6 September 2024 China's National Development and Reform Commission (NDRC) and Ministry of Commerce (MOFCOM) jointly issued Order No. 23, the Special Administrative Measures (Negative List) for Foreign Investment Access (2024 Edition), effective 1 November 2024. The 2024 list reduces nationwide restrictions from 31 to 29 entries, removing the last two manufacturing- sector restrictions (publication printing must be Chinese-controlled; investment in TCM-decoction steaming/roasting/calcination processes and confidential-formula proprietary Chinese-medicine production prohibited). Restrictions remain in services (telecommunications value-added, healthcare, education) and in 21 prohibited categories (news publishing, postal monopoly, fishing, gene therapy, tobacco). The 2021 edition is repealed on the same date.

China registered the National Integrated Circuit Industry Investment Fund III Co., Ltd. ("Big Fund III") in Beijing on 24 May 2024 with RMB 344 billion (~USD 47.5 billion) of registered capital — the largest single capital raise of the three Big Fund phases (Phase I 2014: RMB 138.7bn; Phase II 2019: RMB 204bn). Nineteen state-owned investors contribute, led by the Ministry of Finance (17% / RMB 60bn) and the six largest state-owned commercial banks (ICBC, ABC, BoC, CCB ~6.25% each at RMB 21.5bn; BoCom RMB 20bn; PSBC RMB 8bn). Duration 15 years (24 May 2024 → 23 May 2039). The fund explicitly targets the chokepoints exposed by US BIS October 2022/2023/2024 controls — semiconductor manufacturing equipment, advanced memory (HBM/DRAM), AI accelerators, and third-generation compound semiconductors (SiC, GaN).

The Protecting Americans from Foreign Adversary Controlled Applications Act (PAFACA), enacted as Division H of P.L. 118-50 (21st Century Peace through Strength Act), prohibits app stores and internet hosting services from distributing, maintaining, or updating "foreign adversary controlled applications" — defined explicitly to include ByteDance Ltd and its subsidiaries (TikTok). ByteDance was given 270 days from enactment (until January 19, 2025) to execute a "qualified divestiture" — selling TikTok to an owner with no operational relationship with a foreign adversary — or face a nationwide distribution ban. The Supreme Court unanimously upheld the law's constitutionality in TikTok, Inc. v. Garland (January 17, 2025), rejecting First Amendment challenges and affirming the national-security rationale grounded in data-collection concerns.

The Cyberspace Administration of China (CAC) issued the Provisions on Promoting and Regulating Cross-Border Data Flows (《促进和规范数据跨境流动规定》) on 22 March 2024, effective immediately. The rules substantially raise the thresholds at which CAC security assessment, Standard Contractual Clauses (SCC), or Personal Information Protection Certification are required for outbound data transfers, and create categorical exemptions for contract performance, HR management, intra-group transfers below a volume threshold, and transit data processed in China with no domestic personal information introduced. A Free Trade Zone pilot mechanism allows designated FTZs (Shanghai Lingang, Tianjin, Beijing) to publish their own negative lists defining which data categories still require prior approval, easing conditions for multinationals with operations in those zones.

On 13 March 2024 the State Council issued the Action Plan on Promoting Large-Scale Equipment Renewal and Consumer Goods Trade-In as Guo Fa [2024] No. 7, distributed by NDRC alongside ten implementing ministries. Branded the "Two New" (两新) initiative, it is the flagship Xi/Li-era domestic-demand industrial-policy instrument structured around four action lines (equipment renewal, consumer-goods trade-in, recycling and circular utilisation, standards uplift) with twenty specific tasks and 2027 quantitative targets including ≥25% increase in equipment investment vs 2023 across industry, agriculture, construction, transport, education and healthcare. Funded by CNY 150bn of ultra-long-term special treasury bonds in 2024, expanded to CNY 300bn earmarked in 2025, the programme drove >CNY 1.3 trillion of consumer-goods trade-in transactions (autos, appliances, home furnishings, e-bikes) in its first year and is the central pillar of Beijing's response to the property-sector slowdown.

The US Bureau of Industry and Security (BIS) final rule (89 FR 14385; FR Doc 2024-03969; Docket 240215-0050; RIN 0694-AJ54) added 93 entities under 95 entries to the Entity List, effective 23 February 2024, with destinations Russia (63), Turkey (16), China (8), UAE (4), Kyrgyzstan (2), India (1), and South Korea (1). The dominant rationale is enforcement of Russia-diversion controls: 46 Russian defense manufacturers are designated as military end users acquiring US-origin items for Russia's armed forces, five Chinese entities (including Dennex Enterprises Limited and Shenzhen Speed Industrial Materials Co.) are cited for facilitating diversion of controlled microelectronics to Russia, and 16 Turkish firms are cited as procurement hubs obtaining US-origin items of importance to Russia's war effort. Four UAE entities are designated for transshipment networks serving both Russia and Iran. All entities are subject to a presumption of denial for EAR-controlled items; Russian military end users are additionally subject to the Russia/Belarus FDP rule (15 CFR 734.9(g)).

On 25 October 2023 the Bureau of Industry and Security published an interim final rule (88 FR 73424; FR Doc 2023-23055) making substantive revisions to the October 7 2022 advanced-computing IFR, incorporating 43 public comments covering 78 topics. The rule replaced the prior TOPS-based performance metric with a new "Total Processing Performance" (TPP) / performance-density dual-threshold structure for ECCN 3A090, splitting the control into tiers 3A090.a (full licence requirement for highest-capability datacenter AI chips) and 3A090.b (new License Exception NAC with 25-day prior notification for the intermediate tier). Geographic scope was expanded from China-and-Macau to Country Groups D:1/D:4/D:5 to block diversion via third-country intermediaries and offshore datacenters.

The US Bureau of Industry and Security issued an interim final rule on 17 October 2023 that substantially expanded the advanced-computing and semiconductor manufacturing controls first imposed in October 2022. The rule closed the performance-threshold workaround that NVIDIA had used to ship China-specific A800/H800 GPUs, replacing it with a "performance density" metric and adding a new "Notified Advanced Computing" licence category. It expanded controls on chipmaking equipment (additional ECCNs covering deposition, etch, metrology), pulled 21 additional countries (mostly Middle East / Central Asia) into a regional licensing scheme to prevent transshipment, and added 13 Chinese entities to the Entity List including AI-chip designers.

President Biden signed Executive Order 14105 on 9 August 2023, "Addressing United States Investments in Certain National Security Technologies and Products in Countries of Concern", establishing the first dedicated US outbound-investment screening regime. The EO directs Treasury to prohibit or require notification of US investments in Chinese (and Hong Kong, Macau) entities engaged in three categories of technology: (1) semiconductors and microelectronics, (2) quantum information technologies, (3) artificial intelligence systems. After a public-comment process, Treasury issued the final rule (31 CFR Part 850) on 28 October 2024, effective 2 January 2025.

The Bureau of Industry and Security (BIS) added 37 entities under 38 entries to the Entity List, effective March 2, 2023, spanning six destinations: China (28), Pakistan (4), Burma (3), Russia (1), Belarus (1), and Taiwan (1). The China tranche — the largest — targets entities supporting the People's Liberation Army's military modernization, including BGI Research and Forensic Genomics International (genomic surveillance/data risk), Inspur Group Co. Ltd. (cloud servers supplied to Chinese military), and Loongson Technology (domestic CPU developer). Three Burmese entities, including the Ministry of Transport and Communications, are designated for providing surveillance equipment enabling the military junta's tracking and targeting of civilians. Pakistani entities Abdul Razaq Asim, Add-On Technology, and Dynamic Engineers are added for contributing to Pakistan's ballistic missile programs; Russian DMT Electronics and Belarusian DMT Trading LLC for export-control evasion. All listed entities are subject to a license requirement for all items subject to the EAR, with the review policy being presumption of denial for the majority of Chinese entries.

The Bureau of Industry and Security (BIS) added 10 entities under 13 destination entries to the Entity List, effective February 24, 2023. The additions span three groups: (1) five Chinese entities operating in the commercial satellite and dual-use space sector — most notably Spacety Co., Ltd. and China HEAD Aerospace Technology Co., both suspected of supplying satellite imagery and space technology in support of the Russian military in Ukraine; (2) two Canadian procurement intermediaries (CPUNTO Inc. and Electronic Network Inc.) facilitating illicit acquisition of US-origin controlled items; and (3) three Russian defense-industrial procurement companies supplying the Russian military. All listed entities are subject to a license requirement for all EAR-subject items with a policy of denial, except EAR99 food and medicine which receive case-by-case review.

The US Bureau of Industry and Security imposed broad new controls on the export of advanced computing chips, chipmaking equipment, and US-person services supporting Chinese semiconductor fabrication. The October 7 2022 rule blocked supply of GPUs above set performance thresholds (initially 600 GB/s interconnect / 4800 TOPS) to China and added end-use restrictions on manufacturing tools used in advanced (≤14/16 nm logic, ≤18 nm DRAM, ≤128-layer NAND) facilities, with a foreign direct product rule extending coverage globally.

The U.S. Bureau of Industry and Security (BIS) added seven Chinese entities — under seven entries — to the Entity List, effective August 24, 2022, for acquiring or attempting to acquire U.S.-origin items in support of China's military modernization efforts. The entities span China's state-owned aerospace, space-technology, electronics, and control-systems research institutes. All seven entries carry a license requirement covering all items subject to the EAR, with a presumption-of-denial review policy.

OFAC codified the Chinese Military-Industrial Complex Sanctions Regulations at 31 CFR Part 586, implementing Executive Order 13959 (November 12, 2020) as amended by Executive Order 14032 (June 3, 2021). The regulations prohibit US persons from purchasing or selling publicly traded securities of entities designated on OFAC's Non-SDN Chinese Military-Industrial Complex Companies (NS-CMIC) List, which identifies firms determined to support the People's Liberation Army or Chinese surveillance-technology programs. A divestment deadline of June 3, 2022 applied to entities named in the original EO 13959 annexes; future additions carry a one-year divestment window from the date of designation.

The Personal Information Protection Law of the People's Republic of China (中华人民共和国个人信息保护法 — PIPL) was adopted at the 30th meeting of the 13th NPC Standing Committee on 20 August 2021 and entered into force on 1 November 2021, constituting the third and final pillar of China's cybersecurity and data-governance regulatory trinity alongside the Cybersecurity Law (2016) and the Data Security Law (2021). The PIPL is China's comprehensive personal-information statute establishing consent-based and necessity-based legal bases for PI processing, a tiered cross-border personal-data transfer regime (CAC security assessment / PI protection certification / Standard Contractual Clauses), extraterritorial application (Art. 3) to non-Chinese controllers offering services to or analysing the behaviour of PRC residents, and a heightened protection regime for sensitive personal information and data of minors under 14. It mandates data-protection impact assessments, personal-information-protection-officer obligations at designated handlers, breach notification, and a full suite of data-subject rights including access, rectification, deletion, portability, objection, and automated- decision-making opt-out. Article 53 requires overseas controllers to establish a domestic representative or designated entity in China, providing a domestic enforcement counterparty.

The Data Security Law of the People's Republic of China (中华人民共和国数据安全法) was adopted at the 29th meeting of the 13th NPC Standing Committee on 10 June 2021 and entered into force on 1 September 2021, constituting the second pillar of China's cybersecurity and data-governance regulatory trinity alongside the Cybersecurity Law (2016) and the Personal Information Protection Law (2021). The DSL establishes a tiered data-classification regime — "important data" and "national core data" — with escalating security obligations including risk assessment, risk monitoring, breach reporting, and classified-protection requirements for data handlers. It introduces a data-export security review for "important data" generated or collected within China, the statutory parent authority operationalised by the 2024 CAC Cross-Border Data Flow Provisions, and enacts a §36 blocking statute prohibiting Chinese organisations and individuals from transferring data stored in China to foreign judicial or law-enforcement authorities without prior PRC government approval.

The Bureau of Industry and Security added 77 entities (under 78 entries) to the Entity List via a December 22, 2020 final rule (FR Doc 2020-28031). The headline designation is Semiconductor Manufacturing International Corporation (SMIC) — China's largest contract chipmaker — for activities related to military-civil fusion (MCF), with a presumption of denial applied to all items uniquely required to produce chips at advanced nodes of 10 nanometers or below. The batch also covers entities that supported PRC militarisation of artificial islands in the South China Sea and entities implicated in human rights abuses against Uyghurs and other minorities in Xinjiang.

The Cybersecurity Law of the People's Republic of China (中华人民共和国网络安全法) was adopted at the 24th meeting of the 12th NPC Standing Committee on 7 November 2016 and entered into force on 1 June 2017, establishing the foundational legal framework for network security governance across all sectors. The law creates the Critical Information Infrastructure Operator (CIIO) designation and protection regime administered by the Cyberspace Administration of China (CAC), mandates data localisation for personal information and important data collected or generated by CIIOs in China, and establishes cross-border data-transfer security assessment requirements under Article 37 — the provision later operationalised by DSL 2021, PIPL 2021, and the 2024 CAC Cross-Border Data Flow Provisions. The CSL introduced multi-level protection scheme (等级保护制度 / MLPS) obligations for all network operators and network-product/service security-review procedures, under which CAC triggered the cybersecurity review of Didi Global in 2021 and the exclusion of Micron's products from Chinese critical-infrastructure projects in 2023.