Amended Cybersecurity Law raises maximum fines (effective 1 Jan 2026)

Presidential Order No. 61 on the National People’s Congress website, opened 20 September 2026, states that the NPC Standing Committee decision amending the Cybersecurity Law was adopted on 28 October 2025 and takes effect on 1 January 2026. The order itself is the promulgation stamp; it does not reprint the full amended article text.

A CAC / 中国网信网 expert commentary dated 2 January 2026 records that the amending decision began to apply on 1 January 2026 and summarises the liability redesign: a graduated penalty ladder; higher starting bands for critical-information-infrastructure operators; and an upper fine of CNY 10 million for particularly severe consequences such as loss of main functions of critical information infrastructure. The same page notes new penalties for selling or providing network critical equipment that has not passed required security certification or testing, and restates alignment with PIPL and the Data Security Law for personal-information processing.

What this is — and is not

For China UA stacks, the operative change is statutory cost of non-compliant network and data practices, not a new ad-auction rule. Pair this card with PIPL / SDK enforcement notices rather than treating the Order as a creative policy.

Download the fine-ladder card.

Research checked 20 September 2026. Local draft; human editorial review pending.