China's Electronic Certification Rules 2026: The October 30 Deadline for CA-Compliant e-Signatures

China's regulator has tightened the rules that sit underneath every electronic signature. In April 2026 the Ministry of Industry and Information Technology (MIIT) issued its Notice on Electronic Certification Business Rules (工信发函〔2026〕181号), together with the industry standard T/CQAE 11034-2025, Electronic Certification Business Rules Specification. Electronic certification service providers must rebuild their processes to meet four non-negotiable requirements — direct CA verification, direct CA subscriber agreements, retained proof of intent, and controlled private-key management — before the transition period ends on 30 October 2026.

For companies that sign contracts in or with mainland China, this is not an internal matter for a vendor. When a signed contract is disputed, the court now examines exactly these links in the trust chain. This article sets out what changed, what the four rules require, and what a buyer should verify.

What the 2026 reform covers

China's electronic signature regime has two layers that are often confused. The Electronic Signature Law sets when a signature is legally reliable. Below it, the electronic certification rules govern how a licensed certification authority (CA) verifies identity, issues certificates, and keeps evidence.

The 2026 measures work on that second layer. MIIT's notice (工信发函〔2026〕181号) requires certification authorities to review their existing processes against the revised business rules and carry out a full compliance overhaul. The companion standard T/CQAE 11034-2025 — an industry association standard, not the text of the notice itself — sets out the operational detail that reviews are measured against.

This line is distinct from the State Cryptography Administration's separate work on the use of cryptography in electronic certification services, which governs cryptography-use licensing rather than the business rules themselves; the two lines impose different obligations on the same providers.

The reform is deliberately not cosmetic. Providers cannot satisfy it by rewriting internal policy or updating their certification practice statement (CPS) text alone. The notice also rules out workarounds: a platform may not use contract terms to reclassify certification as a "security service" or an "auxiliary authentication service", and it may not convert a third-party certification arrangement into a self-built project to avoid the rules.

The four red lines

The standard reduces the overhaul to four requirements that providers describe as red lines — no exemptions, no transitional version.

• Direct CA verification (CA直验). Identity must be verified by the licensed CA itself. Delegating identity checks to an external organisation or individual is prohibited, and a different legal entity counts as external. The point is to keep the link between a real identity and a digital certificate intact.
• Direct CA subscriber agreement (CA直签). The certification service agreement must be signed directly between the CA and the certificate subscriber, so that rights and obligations are stated and accepted — not buried behind a default checkbox or an unclear authorisation.
• Retained proof of intent (意愿留证). The subscriber's intent must be recorded and traceable across the whole chain. Higher-assurance certificates require confirmation through audio or video recording; basic-level certificates require a traceable confirmation record.
• Controlled private-key management (私钥直管). Signing keys are held by the subscriber in the first instance. Where a CA hosts the key, it needs the subscriber's written authorisation, encrypted storage, and a full record of every use — no unauthorised invocation.

These four requirements change the structure of arrangements built on "connecting to a CA" or "joint certification", because in those models the regulated steps were often performed by parties other than the licensed CA.

Why courts are already applying the standard

The reform is not only an administrative exercise. In a recent case, the Changjiang District People's Court of Jingdezhen City, in its review opinion, cited the Electronic Certification Business Rules Specification and asked the parties to submit a direct-CA verification report, on the basis that a CA may not entrust user identity verification to a third party.

That is the practical consequence for businesses. If a contract is later contested and the identity-verification chain was subcontracted, default-checkboxed, or never evidenced, those gaps become the point of attack. A signature that looked valid at signing can be hard to defend at dispute.

Three checks every buyer should run

The notice places the transition obligations on providers, but it also gives buyers a checklist. Any question the provider cannot answer clearly is a reason to look closer at the certification chain.

• Check the licence. Confirm that the electronic signature provider, and the CA that actually issues the certificates, hold a valid electronic certification service licence. Verify it through MIIT's official query channel at https://ythzxfw.miit.gov.cn/index, not from a marketing page. A missing licence is disqualifying.
• Check for direct CA verification. This is the core red line. For individuals, the licensed CA system should run real-name checks plus face or SMS second-factor verification with no third-party relay. For organisations, the CA should verify the business licence and complete account or liveness checks directly, without the platform touching the core verification data. If any step is answered as "done by the platform" or "outsourced to a third-party verification service", the chain is broken.
• Check the certificate issuer. Open a signed contract and read the certificate details. The issuing body should match the licensed CA exactly. Watch for vague wording such as "issued on behalf of", "jointly issued", or "co-issued", and confirm the certificate can be looked up in MIIT's electronic certification service system. If the issuer is not the licensed CA itself, the certificate's legal weight is weakened under the new framework.

What foreign companies should do

Teams outside mainland China that sign with Chinese counterparties should treat the October 30 deadline as a selection and review window, not only a remote compliance event.

• Ask your provider for the legal name of the certificate issuer for each signing method, and the licence evidence behind it. The platform brand, the registration process, and the licensed CA may be three different entities.
• Ask how identity was verified, how the subscriber agreement was presented and accepted, where keys are generated and who can invoke them, and what records are retained for each step.
• Ask for a sample evidence package: the signed file, certificate information, signer authentication events, consent and intent records, timestamps, and audit history.
• Remember that provider licensure and contract enforceability are related but not identical. Whether a particular document is binding still depends on the document type, the parties' intent, the reliability of the signature method, and the evidence available. For the wider picture of signing in mainland China, see the mainland China electronic signature overview.

What to watch next

The transition ends on 30 October 2026, after which MIIT is expected to move to full-scale inspection. Providers that cannot meet the requirements face suspension of non-compliant business and, at the limit, delisting or revocation of their licence. Buyers that review their providers now avoid discovering a broken certification chain during a dispute.

Key takeaways

• MIIT's Notice on Electronic Certification Business Rules (工信发函〔2026〕181号) and the standard T/CQAE 11034-2025 set four red lines for electronic certification in China.
• The four rules are direct CA verification, direct CA subscriber agreements, retained proof of intent, and controlled private-key management.
• The transition period ends on 30 October 2026, after which inspections and licence action are expected.
• Courts are already applying the standard: a Jingdezhen court required a direct-CA verification report in a recent case.
• Buyers should verify the provider's licence, the direct-CA verification step, and the certificate issuer's identity before relying on a Chinese-issued certificate.