The amended law took effect on 1 January 2026 and strengthened responsibility; confirm the current renumbered text.
Skip to guide content
CSLCurrent Cybersecurity Law DataNetwork-data controls CIICritical information infrastructure
Cybersecurity · 02 Editorial guide
Cybersecurity and MLPS beside AI Systems
MLPS is a graded network-security system, not a personal-information export clearance. Scope the protection object, determine and file the level where required, implement controls, test them and retain remediation evidence.
First job Separate cybersecurity grading from personal-information export questions.
Decision railnetwork → grade → controls → incident L4
See routing factsStart here
Key considerations
The first questions are about urgency, governance and preservation — before collection expands or interviews begin.
- Is the question about networks and grading, or about personal information leaving China?
- What network, platform, cloud tenant or industrial system is the protection object?
- Has the level been determined, filed, built, assessed and re-tested after material change?
Direct answer
What this page decides
Owner
02
02
This page owns cybersecurity grading. An AI system on a China network can still be an MLPS object. Do not collapse MLPS into algorithm filing.
At a glance
Which fact changes the next route
Use the fact that changes ownership or urgency to decide the next move.
| Question | Why it matters | Next route |
|---|---|---|
| Breach? | Incident L4. |
Scope
What this page owns — and what it does not
MLPS/CSL.
AI filing is Programme L4.
Practical workflow
Action, evidence, legal gate, output
| Action | Documents / evidence | Legal gate | Output |
|---|---|---|---|
| Identify the network/system | Inventory | Grade separately from PIPL | MLPS hypothesis |
Documents
What to gather before the next call
These items help clarify the file; they are not a legal requirement list.
| Item | Why needed | Who holds it | Risk if missing |
|---|---|---|---|
| System inventory including models | Grade | Security | Ungraded production model |
Common failure points
Where files usually break
Treating CAC algorithm filing as a substitute for MLPS.
FAQ
Narrow follow-ups owned by this page
Does genAI skip MLPS?
No automatic skip.
Decision map
Keep the question bounded.
- Separate the filesInventory network operators, systems, deployment, data, users and business impact before grading.
- Determine and fileUse the current classification guide, expert input and competent-authority process; do not self-award a convenient level.
- Build, assess and remediateTranslate the level into management and technical controls, assessment, findings, corrections and change control.
Regulatory gates
Approvals that can hold signing or closing.
This map does not decide whether a filing is required on your facts.
Layer classification, access, encryption, backup and incident duties under the Network Data Security Management Regulation.
CII status introduces a distinct protection and localisation file; do not infer it from company size alone.
Quick answers
Need the short version? Start with one narrow question.
These explainers answer one question. They do not replace this topic route or a deep guide.
Quick AnswerChina Cybersecurity Law and Multi-Level ProtectionChina’s Cybersecurity Law is the network-security statute; MLPS 2.0 is the grading system. This page orients both without a second CSL URL. Reviewed 6 Sep 2026.Quick AnswerMLPS in ChinaMLPS 2.0 is China’s multi-level protection scheme: classify the system, file when required (often class 3+), test, and remediate. ISO 27001 is not a filing. Reviewed 6 Sep 2026.
Curated resources
Open the asset that matches this job.
01
Guide
02China data compliance decision guide
National PIPL, transfer and cybersecurity decision desk — not a substitute for a filing pack.
Guide
03Cybersecurity law and MLPS
Multi-level protection as a network-security file beside PIPL.
Guide
042026 Cybersecurity Law amendments
NPC decision effective 1 January 2026, including strengthened legal responsibility and current statutory structure.
Guide
GB/T 22240-2020 MLPS Classification Guide
Official national-standard record for identifying graded-protection objects and determining security protection levels.
Helpful to prepare
Facts that make the next conversation clearer.
These items are orientation aids, not a legal requirement list.
System boundary and proposed or filed MLPS levelSecurity versus privacy ownerAssessment findings, remediation and material-change triggers
Evidence file
Preserve the record before the forum is chosen.
This is a preparation prompt, not a finding that any item is admissible or required.
- Protection-object inventory and architecture boundary
- Level determination, filing and competent-authority record
- Control mapping, assessment report and remediation closure
- Supplier, cloud, log, vulnerability and incident records
Counsel hand-off
What to bring when you instruct
Instruct cyber counsel. Bring: network map and where the model is hosted.
Local context
Add the city when regulator practice changes.
CAC and industry-regulator practice can differ after the national transfer or cybersecurity question is identified.
Open city and province guidesCounsel hand-off
Need data-privacy counsel?
This hub organises PIPL, cybersecurity and export questions. It does not decide whether a transfer is lawful or whether notice is required on your facts.
Find data-privacy counselLegal review
Who reviewed this guide
Need qualified counsel?
Move carefully. Move with a record.
Use the portal to identify counsel for this practice and related China-side issues.