Filed under miit
Every brief tagged "miit".
- § 01 · AI-ETHICS-REVIEW
Are Companies Ready for AI Ethics Review? A Practitioner's Guide to Committees, Expert Re-Review, and the Registration Platform
AI ethics review has become a live issue: most algorithm- and AI-heavy companies applying to list in Hong Kong have recently received targeted regulatory inquiries on it. This practitioner's guide from 网安寻路人 walks through the regime built on MOST's 2023 Sci-Tech Ethics Review Measures and MIIT's 2026 AI Ethics Review Measures, starting with an 11-question FAQ. Its sharpest reading concerns Article 26 of the AI Measures, which waives expert re-review only where filing or registration already made ethics compliance a condition. The authors say they have seen almost no algorithm or generative AI filing that did, so algorithmic recommendation and deep synthesis providers, and generative AI filers and registrants, almost all still need full ethics review including expert re-review. On the committee, which is not mandatory because a Service Center can stand in, the guide calls for at least 7 members including an outsider, and advises against seating independent directors. It also covers registration on the national platform (within 30 days of setup, annual reports by March 31), the 30-day decision and re-review clocks, a 72-hour emergency track, the pilot Service Centers in ten provinces, and consequences that cross-refer to the Law on Progress of Science and Technology, the PIPL, the DSL, and the CSL.
- § 02 · ENFORCEMENT
MIIT Public-Naming Bulletin 2026 Batch 5 (Total Batch 58): 26 Apps and SDKs Named, With Auto-Renewal, Misleading Downloads, and Non-Compliant Use in the Findings
On August 25, 2026, MIIT's Information and Communications Administration Bureau issued its fifth public-naming bulletin of 2026 (total Batch 58), citing 26 apps and SDKs for conduct infringing user rights. DCC translates the bulletin and the full 26-entry annex, taken from the PDF on MIIT's website. The findings run to 48 across eleven categories. Seventeen entries drew non-compliant collection of personal information, and eight drew non-compliant use, a category absent from Batch 4. Two categories reach past personal information altogether: a non-compliant auto-renewal service and deceiving or misleading users into downloading an app. Seven of the 26 are education or study apps, two of them gaokao application planners. A city-run media center, a piano maker, and three SDKs, one an ad SDK, complete the profile.
- § 03 · ENFORCEMENT
MIIT Public-Naming Bulletin 2026 Batch 6 (Total Batch 59): 17 Apps and SDKs Named, With Mini-Programs, Forced Targeted Push, and Store-Listing Disclosure in the Findings
On October 15, 2026, MIIT's Information and Communications Administration Bureau issued its sixth public-naming bulletin of 2026 (total Batch 59), citing 17 apps and SDKs for conduct infringing user rights. DCC translates the bulletin and transcribes the 17-entry image table in full. The findings run to 30 across eleven categories. Fourteen entries drew non-compliant collection of personal information. Two categories are new to the MIIT batches DCC has covered: inadequate display of app information on a distribution platform, and swipe-triggered window redirects. Two more, non-compliant use of personal information and forcing users to accept targeted push, first appeared in Batch 5. Eight of the 17 were sampled inside super-apps rather than app stores: three WeChat mattress-brand mini-programs, an Alipay mini-program, a Douyin listing, and three Kuaishou listings. Three Android SDKs, one of them an ad SDK cited for inadequate SDK information disclosure, complete the list.
- § 04 · ENFORCEMENT
MIIT Public-Naming Bulletin 2026 Batch 4 (Total Batch 57): 32 Apps and SDKs Cited for PI Violations, Excessive Permission Demands, and SDK Disclosure Failures
On July 2, 2026, MIIT's Information & Communications Administration Bureau issued its fourth public-naming bulletin of 2026 (total Batch 57), citing 32 apps and SDKs for infringing user rights — non-compliant and beyond-scope collection of personal information, forced/frequent/excessive permission demands, frequent self-start and associated start, uncloseable and redirect-abusing information windows, and inadequate SDK information disclosure. The batch runs under the same 2026 CAC + MIIT + MPS special campaign as the earlier CAC notification and Shanghai takedown covered in DCC's enforcement tracker, on the same rectify-or-face-disposition pathway. DCC transcribes the full 32-entry list from the bulletin's attached image table. The profile: a mobility-and-transport long tail (ride-hailing driver apps, EV charging, bus-information tools) alongside recognizable names — Neta Auto's app, PetroChina Kunlun's charging app, NetDragon's fortune-telling app, iFlyPlus — plus two WeChat mini-programs, multiple Apple App Store listings, one developer named twice, and three SDKs, one of which (闪登 SDK) drew four separate findings including the headline SDK-disclosure failure.
- § 05 · ENFORCEMENT
From Naming to Takedown: Shanghai Pulls 46 Apps That Missed the Rectification Window
On June 24, 2026 the Shanghai Communications Administration (上海市通信管理局, the MIIT's directly-administered local communications authority) issued a notification ordering the takedown of 46 apps and SDKs that, after public naming and a rectification window, still had not fixed user-rights and personal-information violations. DCC reads it as the next rung on the enforcement ladder above the CAC's 30-app naming notification: same 2026 CAC + MIIT + MPS special campaign, but the local communications-administration tier converting an unrectified naming into an operative sanction — removal from distribution, with further measures flagged (suspension of access, administrative penalty, inclusion in the telecom-business bad-record list). The legal basis is PIPL, the Cybersecurity Law, the Telecom Regulations, and the Telecom and Internet User PI Protection Provisions. The 46-app list — transcribed here from the notice's attached image — is almost entirely Shanghai-registered long-tail O2O lifestyle apps (moving, housekeeping and cleaning, pet services, local travel agencies, community group-buy food, fitness and restaurants), and several operators appear with multiple apps taken down at once. DCC's read for overseas counsel: the provincial communications administrations are where a missed rectification window becomes a removed app, and the takedown tier sweeps the small-operator long tail, not just big nationals.
- § 06 · RISK-ASSESSMENT
From Principle to Running System: How the Network Data Security Risk Assessment Measures Operationalize the Data Security Law
On June 18, 2026 the CAC, MIIT and the Ministry of Public Security jointly issued the Measures for Network Data Security Risk Assessment as Order No. 24, effective August 20, 2026. The 25-article rule adds no new substantive duty; it turns the Data Security Law's open-ended 'conduct risk assessment' obligation into an executable, verifiable, trigger-able governance system. DCC reads it as a three-tier standing model plus an event-driven escalation layer: important-data handlers must assess every year (general-data handlers are encouraged to every three), retain the report for three years and submit it within 20 working days; sectoral competent authorities run annual inspection plans filed by end-January; the national cyberspace administration consolidates and cross-shares reports with telecom, public-security and state-security departments; and where a high-risk finding or a breach of important data or large-scale personal information appears, regulators can compel assessment by a certified institution and order the operator to cease processing important data. The four institutional increments over the DSL: an annual mandatory action, networked multi-department supervision, a three-track assessment structure, and dynamic event-triggered oversight.