China's 1-hour cyber incident reporting: what foreign firms must do

Since November 2025, China requires serious cyber incidents to be reported within 1 to 4 hours. Thresholds, deadlines and what foreign companies need to do now.

2026-10-11

On November 1, 2025, China's Measures on National Cybersecurity Incident Reporting took effect. Issued by the Cyberspace Administration of China (CAC) on September 11, 2025, they set some of the world's shortest deadlines: as little as one hour for critical infrastructure operators and four hours for other network operators. Linklaters called it the world's strictest regime of its kind. Any company that runs networks or systems in mainland China, including subsidiaries of foreign groups, needs a plan.

Who is covered

The measures apply to all network operators in the PRC: owners, administrators and service providers of networks. That includes critical information infrastructure operators (CIIOs) and state organs. Mayer Brown notes the measures do not create new substantive duties; they standardize procedures under the Cybersecurity Law, Data Security Law and PIPL.

The four severity levels

Incidents are graded as particularly major, major, relatively major or general. Meeting any single threshold is enough. Selected thresholds, per Latham & Watkins:

Metric	Particularly major	Major	Relatively major
Personal information leaked	>100 million people	>10 million	>1 million
Direct economic loss	>RMB 100 million	>RMB 20 million	>RMB 5 million
CII overall outage	>6 hours	>1 hour	>10 minutes
CII main functions outage	>24 hours	>3 hours	>30 minutes

Leaks of "important data" are at least relatively major, and loss of "core data" at least major. General incidents are not subject to the fast timelines, though sector rules may still apply.

The deadlines

CIIOs: 1 hour. Report relatively major or higher incidents to the CII protection department and public security. For major incidents, that department escalates to the CAC and Ministry of Public Security within 30 minutes.
State organs: 2 hours to the relevant CAC office.
Other network operators: 4 hours to the provincial CAC, which escalates major incidents to the national CAC within one hour.
Follow-up: if the cause or impact is unclear, file what is known and supplement later.
Post-incident: a full report within 30 days after the incident is resolved, covering root cause, response, impact, accountability and lessons.

The measures do not say exactly when the clock starts; Latham reads it as running from awareness of the incident. Financial institutions face a parallel PBOC regime, in force since August 1, 2025, requiring a brief report within one hour and a detailed one within 24 hours for significant incidents.

What the report must contain

Entity and system details; time, type, level and impact; measures taken; for ransomware, the amount, method and date of any demand; preliminary cause; threat intelligence and forensic leads; planned remediation; and security controls in place. Reports go through channels including the 12387 hotline and the CAC's online platform.

How it compares

The four-hour clock for ordinary operators is far tighter than the four business days US public companies get under the SEC's Form 8-K rule, which also runs from a materiality determination rather than from awareness. The difference reflects purpose: China's regime is designed to feed real-time situational awareness to the state, not to inform investors.

Penalties and incentives

The measures set no fines of their own. Failure to report, late reporting or falsified reports can be punished under the CSL, DSL and PIPL, and the CSL amendments in force since January 1, 2026 raised fines to as much as RMB 10 million for entities and RMB 1 million for individuals in severe cases. Conversely, penalties may be reduced or waived if the operator had reasonable protections, followed its emergency plan, limited the damage and reported on time.

Sector and AI rules

The national measures sit on top of sector rules. Mayer Brown points out that sector-specific duties may require reporting even below the national thresholds, and Linklaters notes a non-binding practice guide for generative AI services that covers incident classification and emergency response. Companies in finance, telecom, energy or AI should check both layers.

What foreign companies must do

Direct obligations

A foreign group's Chinese subsidiary that operates networks is a network operator and is in scope. Linklaters notes the measures do not explicitly create direct liability for offshore businesses, but they can be affected indirectly: offshore recipients under China's standard contract must notify Chinese partners of breaches, and PIPL's extraterritorial reach still applies.

Practical steps

Map China-based systems and data, including which might count as CII, important data or large volumes of personal information, so severity can be graded quickly.
Create a China annex to the global incident response plan, with local decision makers empowered to file within four hours without waiting for headquarters.
Prepare templates in Chinese that cover every required field.
Identify regulators and contacts at the provincial CAC and sector authorities in advance.
Amend vendor contracts so IT and security providers must notify you promptly and help with reporting, with defined timelines and audit rights.
Run tabletop exercises that test the one- and four-hour clocks, including night and weekend scenarios.
Align with other regimes: the same incident may trigger SEC, GDPR or LGPD notices; coordinate messaging.
Line up breach counsel and forensics with China capability before an incident.