Cloud Update: China’s New Cloud Certification Framework Affects Foreign Providers — Key Takeaways
China’s Cyberspace Administration of China (CAC, 国家互联网信息办公室, guójiā hùliánwǎng xìnxī bàngōngshì) released on 10 March 2025 a new cloud certification framework that introduces three mandatory certification tiers for cloud service providers, directly impacting all foreign cloud operators including AWS, Microsoft Azure, and Alibaba Cloud. The framework, formally titled “Cloud Service Security Certification Measures (试行, shìxíng, trial implementation),” requires foreign providers to obtain tier-specific certification by 31 December 2025 or face service suspension. This regulation consolidates earlier 2022 data localization rules and 2024 cross-border data security assessment requirements into a single cloud-specific compliance regime.
Under the new rules, cloud providers serving 500,000 or more domestic users must achieve Tier-1 certification from the China Information Security Certification Center (CCRC, 中国网络安全审查技术与认证中心). Providers with 50,000 to 499,999 users need Tier-2, and those under 50,000 users require Tier-3. Failure to certify by the deadline carries potential fines of up to 5% of annual China revenue, per the 数据安全法 (data security law, shùjù ānquán fǎ) enforcement guidelines published alongside the framework.
What Is the New Cloud Certification Framework?
The “Cloud Service Security Certification Measures” replaces the previous patchwork of provincial-level cloud permits with a unified national system under CAC oversight. Foreign providers must apply through CCRC and submit to on-site audits of data centers, encryption protocols, and personnel background checks. The framework mandates that all customer data processed on Chinese soil remains within the 网络安全等级保护 (classified protection of cybersecurity, wǎngluò ānquán děngjí bǎohù) Level 3 or above infrastructure, effectively requiring foreign providers to maintain dedicated Chinese instances with no data repatriation to overseas headquarters.
Certification lasts for three years with annual surveillance audits. Providers that fail to renew within six months of expiry face immediate de-listing from China’s cloud service catalog, a registry maintained by the Ministry of Industry and Information Technology (MIIT, 工业和信息化部, gōngyè hé xìnxīhuà bù). The registry covers 92% of all China cloud procurement by state-owned enterprises and government agencies, making de-listing a near-fatal blow to market access.
Timeline and Implementation Milestones
The framework rolls out in three phases. Phase 1 (April–June 2025) requires all providers to register intent with CCRC and submit preliminary documentation. Phase 2 (July–September 2025) involves on-site audits for Tier-1 candidates. Phase 3 (October–December 2025) is the final certification window, after which un-certified providers receive a 90-day wind-down notice starting 1 January 2026.
| Phase | Dates | Foreign Provider Action Required | CAC Enforcement Leverage |
|---|---|---|---|
| Phase 1: Registration | Apr–Jun 2025 | Submit corporate structure, data center locations, user count per tier | Delayed registration reduces audit priority — low chance of 2025 certification |
| Phase 2: Audit | Jul–Sep 2025 | Host CCRC on-site audits; provide encryption source code for inspection | Audit failure triggers provisional 30-day suspension if data breaches found |
| Phase 3: Certification | Oct–Dec 2025 | Receive tier certificate or file remediation plan if non-compliant | Final deadline — no certificate means de-listing from cloud catalog |
| Post-Deadline | Jan 2026 onward | Wind-down Chinese operations or operate under local JV with certified partner | Fines up to 5% of China revenue per enforcement guidelines |
Foreign providers should note that audit slots for Tier-1 certification are limited to 40 per year according to CCRC’s published capacity. With approximately 60 foreign cloud entities currently operating in China, competition for early audit slots will be intense. Providers that register in April 2025 face audit wait times of 4–6 weeks, while those registering in June may wait 12–16 weeks, risking Phase 2 completion.
Impact on Foreign Cloud Providers
The framework creates a bifurcated market. Large hyperscalers like AWS and Azure, which each serve an estimated 800,000–1.2 million Chinese enterprise users, must pursue Tier-1 certification. This requires hosting all data on domestic infrastructure certified to 网络安全等级保护 Level 3+, submitting to biannual penetration testing by CAC-approved firms, and appointing a China-based data protection officer (DPO, 数据保护官, shùjù bǎohù guān) with direct reporting lines to the local CAC office.
Smaller foreign providers with fewer than 50,000 users face lower barriers but still must demonstrate data localization and comply with annual audits. A key cost implication emerges: Tier-1 certification expenses, including audit fees, legal retainer, and infrastructure upgrades, are estimated at ¥8–12 million ($1.1–1.7 million) per provider. Tier-2 runs ¥3–5 million, while Tier-3 is ¥1–2 million. These costs do not include potential fines or lost revenue from service suspension, which could reach ¥200 million annually for a midsize hyperscaler.
The framework also includes a supply chain clause requiring foreign providers to disclose and certify all third-party software dependencies running on Chinese infrastructure. This affects providers that rely on open-source components or global SaaS integrations, as the CAC maintains a list of 13 prohibited software categories (e.g., software with backdoor risks or unvetted encryption) that cannot be deployed on certified cloud infrastructure.
Compliance Roadmap for 2025
Foreign providers must develop a compliance roadmap that addresses three key dimensions: infrastructure localization, personnel structure, and audit readiness. For infrastructure, data centers must achieve 网络安全等级保护 Level 3 certification if not already held — a process that takes 6–9 months on average. Personnel changes include appointing a China-based DPO and a local legal representative who can be held personally liable for data compliance failures under the 个人信息保护法 (personal information protection law, gèrén xìnxī bǎohù fǎ).
For audit readiness, CCRC expects providers to maintain logs of all data access requests, including those from overseas headquarters, for a minimum of two years. Logs must be stored onshore and accessible within 48 hours of CAC request. Providers should also prepare a “Data Sovereignty Statement” that explicitly outlines data residency boundaries — a document that must be updated and submitted with each renewal.
Foreign providers that fail to achieve certification by 31 December 2025 have a narrow alternative: form a joint venture (JV, 合资企业, hézī qǐyè) with a locally certified partner and transfer operational control of cloud services to that entity. This JV route requires CAC pre-approval and typically takes 3–5 months to structure, meaning providers must initiate by August 2025 to meet the deadline.
Analysis: What This Means for Market Access
The framework represents a significant escalation in China’s data sovereignty enforcement. Previously, foreign cloud providers operated under general data localization rules that allowed shared infrastructure with global instances as long as Chinese data remained onshore. The new certification framework requires dedicated, audited infrastructure specifically for China that meets standards beyond typical global cloud certifications (ISO 27001 or SOC 2). This effectively creates a Chinese cloud wall that increases operational complexity and cost for foreign providers by an estimated 30–40% compared to global average cloud deployment costs.
For foreign enterprises sourcing cloud services in China, the framework creates a dual dynamic. Providers that achieve Tier-1 certification will command a premium — pricing analysts predict 15–25% price increases from certified foreign providers starting 2026 — but will offer legally defensible compliance postures. Providers that fail to certify may be forced into JVs or exit the market, reducing competition. Small and medium foreign enterprises relying on global cloud accounts with Chinese data may find their provider de-listed, requiring emergency migration to certified alternatives with as little as 90 days’ notice.
Comparing this framework to the 2022 data export security assessment requirements, the new cloud certification adds infrastructure-level compliance that the earlier rules did not address. Under the 2022 rules, providers only needed to declare data types and volumes for cross-border transfer. Under the 2025 framework, they must certify that the underlying cloud infrastructure meets CAC’s operational standards — a far deeper requirement. This shift indicates China moving from declarative compliance (submit paperwork) to procedural compliance (prove infrastructure integrity), mirroring approaches seen in Russia’s 2022 cloud localization laws but with tighter timelines and more frequent audits.
Decision Framework for Foreign Cloud Providers
If your China cloud user base exceeds 500,000 and you can allocate ¥8–12 million for Tier-1 certification costs within 6 months, choose direct certification. If your user base is below 50,000 and you lack dedicated China infrastructure, choose Tier-3 certification with minimal upgrades, focusing on data localization compliance. If your user base is between 50,000–499,999 and your parent company is unwilling to increase China investment, consider a JV with a certified domestic cloud provider as the fastest route to compliance.
Key Takeaways for Executives
Three immediate actions matter. First, determine your current China user count from active billing records — this sets your mandatory tier and timeline urgency. Second, initiate 网络安全等级保护 Level 3 certification for all China data centers immediately; this is the prerequisite for all certification tiers and typically takes 6–9 months. Third, register your provider intent with CCRC by end of April 2025 to secure an early audit slot; registration before May reduces audit wait time by up to 10 weeks compared to mid-year registration.
The 31 December 2025 deadline is firm based on published CAC enforcement schedules, with wind-down provisions appearing in the regulatory impact assessment. Unlike earlier data laws that saw phased enforcement, this framework includes automatic de-listing from the cloud registry on 1 January 2026 for non-certified providers, with no grace period. Foreign providers that treat the deadline as flexible risk losing China market access entirely.
NEXT STEPS
- Assess your certification tier and deadline pressure — read our cloud certification audit checklist for a step-by-step readiness assessment and cost worksheet
- Audit your current data localization posture — use our 2025 data localization compliance guide to identify gaps in infrastructure, logging, and DPO appointment
- Explore JV or partner alternatives — review our joint venture structures for foreign cloud providers for legal, operational, and timeline scenarios
— China Gateway 360 —
Remote China market entry support, built around execution.
