On November 21, 2025, the Cyberspace Administration of China (CAC) and the Ministry of Industry and Information Technology (MIIT) jointly released the draft of the Cybersecurity Labeling Management Measures (hereinafter referred to as “the Draft Measures”) open for public comments until December 6, 2025. This is a voluntary labeling scheme that aims to improve the cybersecurity resilience of internet-connected products, strengthen consumer protection, and safeguard public interest. 

The China Cybersecurity Label (CCL) will apply to products with internet connectivity under a catalog-based management system. The label reflects three tiers of cybersecurity capability: basic (one star), enhanced (two stars), and leading (three stars). Each label must contain the producer’s name, product model, cybersecurity level, validity period, testing laboratory name, referenced standards or technical documents, and a QR code linking to test reports and compliance statements.  Manufacturers intending to use the label must first conduct cybersecurity capability testing in accordance with product-specific implementation rules. For Basic and Enhanced levels, testing may be performed either in-house or by an accredited third-party lab. Products seeking the leading level must additionally undergo penetration testing by a qualified third-party agency.  Upon completion of testing, manufacturers must submit a filing through the online platform operated by the China Electronics Standardization Institute (CESI). Required documentation includes a completed filing form, the cybersecurity test report, the proposed label design, a compliance declaration, business license, and proof of testing capability or third-party accreditation. The filing will typically be processed within 10 working days. Once filed, the label may be used in accordance with the implementation rules. It is valid for a specified period, after which re-filing is required. Any significant changes to product parameters affecting cybersecurity also necessitate re-filing.

The draft Measures prohibit the forgery, misuse, or false advertising using the CCL. Test reports must be accurate and impartial. Regulatory oversight will be conducted by CAC and MIIT, with support from local authorities. Violations—such as misleading claims, label misuse, or submission of falsified test reports—may result in label revocation, public disclosure of the misconduct, and a one-year ban on submitting new filings for the manufacturer or on the acceptance of test results from the non-compliant lab. 

The first batch of products proposed for labeling includes consumer internet-connected cameras (excluding devices used in public security). Network critical equipment and dedicated cybersecurity products already regulated under existing rules are excluded from this labeling catalog. 

For foreign stakeholders, enterprises producing eligible products should review the testing requirements and prepare for the filing process, particularly for higher-tier labels. Monitoring the final version of the Measures and subsequent implementation rules is advised to ensure timely compliance once the scheme takes effect.