China: technology regulation at a glance

Framework: PBOC-led Notice No. 42 [2026] (Yin Fa [2026] No. 42) — Notice on Further Preventing and Handling the Risks of Virtual Currency Trading and Real-World Asset Tokenization Speculation, jointly issued 6 Feb 2026 by the People's Bank of China, NDRC, MIIT, MPS, SAMR, NFRA, CSRC and SAFE — superseding the 24 Sep 2021 ten-agency notice. The Renminbi Law and the e-CNY regime designate the digital yuan as the sole legal digital currency on the mainland.

Mainland China imposes a comprehensive prohibition on virtually all cryptocurrency and digital-asset activity. The 2021 PBOC ten-agency notice declared all crypto-related business (trading, brokerage, ICOs, derivatives, matching, mining and services by offshore exchanges to Chinese residents) 'illegal financial activities'; in February 2026 the PBOC-led Notice No. 42 extended the ban to stablecoins and real-world-asset tokenization. Personal holding of crypto is treated by courts as a form of 'virtual property' entitled to civil protection, but any commercial exploitation is unlawful. Hong Kong SAR operates a separate, permissive regime (Stablecoins Ordinance in force 1 Aug 2025) that does not apply to the mainland.

Framework: A layered regime of vertical rules issued mainly by the Cyberspace Administration of China (CAC) with other agencies: Interim Measures for the Management of Generative AI Services (2023), Provisions on the Administration of Deep Synthesis of Internet-based Information Services (2023), Provisions on the Administration of Algorithmic Recommendations (2022), Measures for Labeling AI-Generated Synthetic Content (2025), and the Interim Measures on Anthropomorphic Interactive AI Services (2026). A single comprehensive AI Law is drafted but not yet enacted.

China does not yet have a single, horizontal AI statute in force; instead it regulates AI through a tightly coordinated set of sectoral CAC-led rules covering generative AI, deep synthesis, recommender algorithms, and content labeling, backed by pre-launch algorithm filings and security assessments. A comprehensive AI Law has been on the NPC/State Council agenda since 2023 and is expressly listed again in the State Council's 2026 Legislative Work Plan (12 May 2026), but remains at drafting stage. Non-binding instruments — the 2017 New Generation AI Development Plan and TC260's AI Safety Governance Framework (v1.0 2024, v2.0 2025) — set the broader policy and technical direction.

Framework: Personal Information Protection Law (PIPL, effective 1 November 2021), operating alongside the Cybersecurity Law (CSL, 2017; first amendment effective 1 January 2026) and the Data Security Law (DSL, 2021), with the Cyberspace Administration of China (CAC) as lead regulator.

China has an in-force, GDPR-style omnibus personal-data regime centered on the PIPL, complemented by the DSL (data classification, national/important data) and the CSL (network security, cross-border rules). The CAC leads enforcement and rulemaking, and the cross-border transfer framework was finalized on 1 January 2026 with the Measures for Certification of Cross-Border Personal Information Transfer, completing the three legal pathways (security assessment, standard contract, certification). Enforcement in 2026 has been active, with a January 2026 CAC Q&A tightening operational expectations and joint CAC/MIIT/MPS campaigns targeting non-compliant apps.

Framework: Regulations on the Supervision and Administration of Non-bank Payment Institutions (State Council Decree No. 768, effective 1 May 2024) plus PBOC Implementation Rules (July 2024). Primary regulator: People's Bank of China (PBOC); consumer finance / BNPL-adjacent lending supervised by the National Financial Regulatory Administration (NFRA).

China operates one of the world's most mature and prescriptive licensing regimes for non-bank digital payments. State Council Decree No. 768, in force since 1 May 2024, together with PBOC's July 2024 Implementation Rules, sets uniform authorization, capital, governance and consumer-protection requirements for payment institutions (which were consolidated into two license types: 'stored-value account operations' and 'payment transaction processing'). PBOC also runs the retail instant-payment rail (IBPS via CNCC), the CIPS cross-border RMB system, and directly operates the e-CNY (digital yuan), whose upgraded framework took effect 1 January 2026.

Framework: PRC Exit and Entry Administration Law (2013) and Regulations on Administration of the Employment of Foreigners; administered by the National Immigration Administration (NIA), Ministry of Public Security, Ministry of Foreign Affairs, and MoHRSS. No dedicated digital-nomad regime exists.

China has no dedicated digital-nomad or remote-work visa and none is on any announced roadmap as of August 2026. Foreigners intending to live and work in China must fit an existing category — most commonly the Z (work) visa, which requires a Chinese employer/entity sponsor, or the R (high-level talent) visa for elite talent; short-term stays are possible under expanded visa-free entry and 240-hour transit rules but paid work of any kind is prohibited on those. Permanent residence ('Five-Star Card') is available via talent, family, or long-term investor routes but is not a nomad pathway.

Framework: Cybersecurity Law (2017; amended effective 1 Jan 2026) plus a dense body of CAC regulations — including the Administrative Measures for Internet Information Services, Regulations on Ecological Governance of Network Information Content, Algorithmic Recommendation Provisions, Deep Synthesis Provisions, AI-Generated Content Labeling Measures, and Regulations on the Protection of Minors Online — enforced by the Cyberspace Administration of China (CAC) alongside MIIT, MPS and NRTA, and reinforced by the 'Great Firewall' technical censorship system.

China operates the world's most extensive state-run online-content control regime. The Cyberspace Administration of China (CAC) sits at the center of a layered legal framework — the Cybersecurity Law (whose most significant amendment since 2017 takes effect 1 January 2026), sector-specific CAC measures on algorithms, deep synthesis, AI-generated content and minors, and a technical censorship apparatus (the 'Great Firewall') that blocks most major foreign platforms (Google, Facebook, YouTube, X, most Western news sites) and criminalizes unauthorized VPN use. Platforms bear strict primary liability to actively police, filter, real-name-verify users and remove prohibited content.

Framework: Cybersecurity Law (CSL, 2017; amended effective 1 Jan 2026), Data Security Law (DSL, 2021) and Personal Information Protection Law (PIPL, 2021), administered principally by the Cyberspace Administration of China (CAC), with supporting rules on CII protection, MLPS 2.0, cross-border data flows and incident reporting.

China operates one of the world's most comprehensive and prescriptive cybersecurity regimes, built on the CSL, DSL and PIPL trilogy and enforced by the CAC together with the Ministry of Public Security and sector regulators. The CSL was substantively amended in October 2025 (in force 1 January 2026) to sharpen penalties, expand extra-territorial enforcement, and add an AI-governance track; a unified national cybersecurity incident-reporting regime took effect on 1 November 2025 with strict short-window reporting timelines. Operators of Critical Information Infrastructure (CIIOs), network operators graded under the Multi-Level Protection Scheme (MLPS 2.0), and personal-information processors face layered obligations including localization, security assessments, and cross-border transfer controls.

Framework: Foreign Investment Law (2020) + revised PRC Company Law (effective 1 July 2024) + 2025 Special Administrative Measures (Negative List) for Foreign Investment Access, administered by NDRC, MOFCOM and SAMR

China permits 100% foreign ownership through a Wholly Foreign-Owned Enterprise (WFOE) or other FIE forms in any sector not appearing on the Foreign Investment Negative List, which was cut to 29 restricted/prohibited items in the 2025 update and now fully opens manufacturing to foreign capital. Company formation is governed by the 2020 Foreign Investment Law and the revised 2024 Company Law, with registration handled by the State Administration for Market Regulation (SAMR); end-to-end setup typically takes 8–14 weeks (roughly 1.5–3 months) and involves multiple regulators (SAMR, MOFCOM record-filing, tax bureau, banks, foreign-exchange). It is workable and increasingly liberalized, but paperwork legalization, sectoral licensing, the 5-year paid-in capital rule and city-by-city practice keep the process moderately complex rather than easy.