China: Adopted Regulations on the Administration of Commercial Encryption including operational license requirement

On 24 May 2023, China's State Council issued the Regulations on the Administration of Commercial Encryption, which will enter into force on 1 July 2023. The Regulations govern aspects of commercial cryptography, including research, production, sales, service, testing, certification and application. Commercial encryption refers to technologies, products, and services that encrypt and protect non-state-secret information. Under the adopted Regulations, organisations providing and engaging in commercial cryptography testing or electronic certification services must meet certain requirements to acquire the necessary certifications and licenses from the national encryption management department. The Regulations list the penalties for obstructing supervision and management violations, including for conducting password testing activities or selling or providing uncertified commercial encryption products and services.