Regulations on the Management of Security Vulnerabilities
China's 2021 rules making network product makers report flaws to MIIT within two days.
China's vulnerability rules, in force since 1 September 2021, give network product makers two days to report a flaw to the Ministry of Industry and Information Technology and bar handing undisclosed bugs to foreign organisations other than the vendor.
Last refreshed: 12 October 2026
Does China's two-day bug-reporting rule feed state hackers?
Timeline for Regulations on the Management of Security Vulnerabilities
Named as Regulations on the Management of Security Vulnerabilities
Cybersecurity: Threats and Defences: Mentioned in: Ten agencies name Beijing firm in hacksBackground
The Regulations on the Management of Network Product Security Vulnerabilities were issued on 12 July 2021 by three bodies: the Ministry of Industry and Information Technology (MIIT), the Cyberspace Administration of China and the Ministry of Public Security. They took effect on 1 September 2021.
Article 7 obliges providers of network products to report a flaw to MIIT's vulnerability-sharing platform within two days. Article 9 forbids publishing details of a flaw before the provider has a fix, and forbids passing undisclosed flaws to overseas organisations other than the product's own provider.
A report from the Atlantic Council argues that the regime gives the Chinese state early sight of bugs before vendors ship fixes. Allied governments have since named Chinese private firms in state-linked hacking: advisory AA26-281A of 8 October 2026 identified Beijing's Integrity Technology Group as an enabler of such intrusions.