Do Software Products Need Certification in China?
Whether software products need certification in China depends on the software’s function, application context, and regulatory category. Unlike hardware products, software is not subject to the China Compulsory Certification (CCC, 强制性产品认证, Qiángzhìxìng Chǎnpǐn Rènzhèng) framework in the same way — software itself is not a product category in the CCC catalogue. However, software products intersect with several certification and registration regimes that are essential for legal sale and use in China. This article explains when certification is required, what types of software certification exist, and how to determine which apply to your software product.
When Software Products Need Certification
Software products may require certification or registration under the following circumstances:
| Situation | Certification Required | Applies To |
|---|---|---|
| Software is part of a CCC-certified hardware product | CCC certification (indirect — the hardware system is certified, and the software must not introduce safety risks) | Embedded software in CCC-listed products: automotive ECUs (electronic control units), medical device software, industrial control systems |
| Software handles cryptography or encryption | Commercial Cryptography Product Certification (商用密码产品认证, Shāngyòng Mìmǎ Chǎnpǐn Rènzhèng) — mandated by the Cryptography Law of China (密码法, Mìmǎ Fǎ) | VPN software, encrypted messaging apps, digital signature tools, SSL/TLS libraries, disk encryption software |
| Software processes personal information | Personal Information Protection Certification (个人信息保护认证, Gèrén Xìnxī Bǎohù Rènzhèng) under the Personal Information Protection Law (个人信息保护法, PIPL) | Apps handling personal data of >100,000 users or sensitive personal information of any user |
| Software is sold as a commercial product to government or critical infrastructure entities | Information Security Product Certification (信息安全产品认证, Xìnxī Ānquán Chǎnpǐn Rènzhèng) — China Information Security Certification (CCRC, 中国网络安全审查认证, Zhōngguó Wǎngluò Ānquán Shěnchá Rènzhèng) | Firewall software, IDS/IPS, antivirus, access control systems, security audit tools |
| Software runs on an operating system sold in China | Operating system compatibility certification (操作系统兼容性认证, Cāozuò Xìtǒng Jiānróngxìng Rènzhèng) — required for pre-installed apps on certain devices | Apps pre-installed on Android devices sold in China (must be compatible with domestic Android forks without Google Play Services) |
| Software is a mobile app available in China app stores | App registration with the MIIT (工业和信息化部, Gōngyè Hé Xìnxīhuà Bù) — app filing (APP备案, APP bèi’àn) required since 2023 | All mobile apps distributed through Chinese app stores (Huawei, Xiaomi, OPPO, Tencent MyApp, etc.) |
| Software is used in financial services | Fintech product certification (金融科技产品认证, Jīnróng Kējì Chǎnpǐn Rènzhèng) — PBOC (People’s Bank of China, 中国人民银行, Zhōngguó Rénmín Yínháng) mandated | Payment apps, mobile banking SDKs, credit scoring software, anti-fraud systems |
CCC and Embedded Software
While pure software products are not in the CCC catalogue, embedded software (嵌入式软件, qiànrùshì ruǎnjiàn) within a CCC-scope hardware product has compliance implications. When a hardware product undergoes CCC certification, the certification body evaluates the complete system, including embedded firmware. Key considerations:
- Functional safety requirements — software in safety-critical CCC products (e.g., automotive brake control, medical infusion pumps, industrial safety relays) must meet specific functional safety criteria. Certification bodies may request a software functional safety assessment report
- Firmware version control — the certified firmware version is recorded in the CCC certificate. Any firmware update that changes safety-related functionality requires a new evaluation. Field-updatable firmware presents a compliance challenge — many manufacturers maintain a “certified” firmware branch alongside a “development” branch
- OTA updates — over-the-air (OTA) firmware updates for CCC-certified products must be managed through a change notification process with the certification body. Unilateral OTA updates that alter safety-critical parameters can invalidate the certificate
Commercial Cryptography Product Certification
The Cryptography Law of China (2020) requires that any product or service using commercial cryptography for encryption, decryption, authentication, or digital signatures must obtain Commercial Cryptography Product Certification (商密认证, Shāngmì Rènzhèng). This affects a broad range of software products:
| Software Type | Cryptography Certification Required? | Certification Body |
|---|---|---|
| SSL/TLS library used in a web application | Yes — if the library is imported or sold as a standalone product | OSCCA (国家密码管理局, Guójiā Mìmǎ Guǎnlǐ Jú) — Office of State Commercial Cryptography Administration |
| End-to-end encrypted messaging app | Yes — encryption algorithms must use OSCCA-approved SM series (SM2, SM3, SM4) | OSCCA |
| VPN client software | Yes — must undergo cryptographic algorithm testing and product certification | China Information Security Certification Center (CCRC) |
| Password manager | Yes — if it uses software-based encryption for data storage | OSCCA |
| Backup software using AES-256 | Yes — foreign encryption algorithms (AES) require OSCCA approval for import; alternatively, implement SM4 | OSCCA |
| Source code analysis tool (no encryption) | No — does not implement any cryptographic function | N/A |
The cryptography certification process involves: (1) algorithm testing — verify that the implementation of SM2/SM3/SM4/SM9 is correct per OSCCA standards, (2) product security evaluation — assess the product’s overall security architecture, (3) source code review — OSCCA may request source code inspection for critical cryptographic modules. The process takes 3–12 months and costs RMB 100,000–500,000 depending on complexity.
Personal Information Protection Certification (PIPL)
Under Article 38 of the Personal Information Protection Law (个人信息保护法, Gèrén Xìnxī Bǎohù Fǎ), software products that process personal information must undergo Personal Information Protection Certification if they meet any of the following thresholds:
- Process the personal information of more than 100,000 individuals
- Process sensitive personal information (biometric data, health records, financial data, location data, minor’s data) of any number of individuals
- Transfer personal information outside of China
The certification is conducted by approved certification bodies, including CCRC and CQC. The evaluation covers:
- Data collection transparency — is the user informed of what data is collected and for what purpose?
- Data minimization — is only the minimum necessary data collected?
- User consent mechanism — is consent obtained before collection? Can it be withdrawn?
- Data security measures — encryption of stored data, access controls, audit logging
- Cross-border data transfer compliance — does the software transfer personal data abroad? If so, does it have the required security assessment?
- Data breach notification procedures
Cost: RMB 50,000–200,000 depending on data processing scope. Timeline: 2–4 months.
MIIT App Filing (APP备案)
Since August 2023, all mobile apps distributed through Chinese app stores must complete MIIT app filing (APP备案, APP bèi’àn). This is not a certification per se but a registration requirement. The filing process requires:
- A Chinese legal entity — the app’s operator must hold a business license (营业执照, yíngyè zhízhào) issued by a Chinese market supervision authority
- An ICP filing (ICP备案, ICP bèi’àn) — the app’s server infrastructure must be registered with MIIT, with servers physically located in China or connected through a licensed CDN
- A privacy policy compliant with PIPL — submitted during the filing application
- A security assessment report — for apps in specific categories (finance, news, social media, gaming, e-commerce)
Foreign developers without a Chinese entity must partner with a Chinese company or establish a Wholly Foreign-Owned Enterprise (WFOE, 外商独资企业, wàishāng dúzī qǐyè) to apply. The filing typically takes 2–4 weeks for straightforward cases.
Software Product Registration (软件产品登记, Ruǎnjiàn Chǎnpǐn Dēngjì)
While not mandatory for all software, Software Product Registration under the Ministry of Industry and Information Technology (MIIT, 工业和信息化部, Gōngyè Hé Xìnxīhuà Bù) is highly recommended for:
- Selling software to Chinese government entities — requires registration in the government procurement catalogue
- Applying for tax benefits — registered software products are eligible for VAT refund and corporate income tax reduction (减按10%征收, jiǎn àn 10% zhēngshōu)
- Participating in software industry awards and tenders — many B2B procurement processes require registration
Registration requirements: the software must be developed by a registered software enterprise (软件企业, ruǎnjiàn qǐyè) and pass a functional test at an MIIT-designated testing laboratory. The process takes 30–45 days.
Pitfalls to Avoid
Frequently Asked Questions
Does open-source software need certification?
If you distribute open-source software as a commercial product in China, the same certification requirements apply as to proprietary software. Using open-source code does not exempt the product from cryptography certification, PIPL certification, or MIIT app filing.
Is AI software subject to special certification?
Yes. Generative AI software (大模型, dà móxíng) is subject to the Interim Measures for the Management of Generative AI Services (生成式人工智能服务管理暂行办法, effective August 2023), which requires algorithm filing (算法备案, suànfǎ bèi’àn) with the Cyberspace Administration of China (CAC, 国家互联网信息办公室, Guójiā Hùliánwǎng Xìnxī Bàngōngshì). The filing covers training data compliance, content safety mechanisms, and user identification.
How long is software certification valid?
MIIT app filing has no expiry but must be updated if the app’s functionality changes significantly. Cryptography certification is valid for 5 years. PIPL certification is valid for 3 years with annual surveillance. Embedded software certification validity matches the parent hardware product’s CCC validity period.
Can foreign software companies get certified without a Chinese entity?
PIPL certification and cryptography certification require a Chinese legal entity as the applicant. MIIT app filing also requires a Chinese entity. Foreign companies without a Chinese subsidiary must establish a WFOE (外商独资企业, wàishāng dúzī qǐyè) or partner with a Chinese distributor who acts as the applicant.
Does software used only for internal business operations need certification?
If the software is used internally by your Chinese subsidiary and does not process personal information of Chinese residents, neither PIPL certification nor app filing is required. Cryptography certification may still apply if the software uses encryption. Software sold or provided to third parties always requires applicable certification.
— China Gateway 360 —
Your Expert Bridge to China Market Access.
