China's Electronic Signature Law: Scope, Reliable Signatures and Certification

The statute behind electronic signatures in mainland China

The Electronic Signature Law of the People's Republic of China (中华人民共和国电子签名法) is the primary statute that gives electronic signatures and data messages their legal force in mainland China. It was adopted on 28 August 2004 by the 11th session of the Standing Committee of the 10th National People's Congress and entered into force on 1 April 2005. It has been amended twice: on 24 April 2015 by the Decision on Amending Six Laws, including the Electric Power Law, and on 23 April 2019 by the Decision on Amending Eight Laws, including the Construction Law. The current version runs to five chapters and 36 articles. The law sets the legal effect of a signature rather than naming a technology: Article 13 defines a reliable electronic signature by four conditions, and Article 14 gives it the same effect as a handwritten signature or a seal. In mainland China that reliable-signature route is delivered by a digital signature carried on a digital certificate issued by a licensed electronic certification service provider, so Chapter III's certification rules are part of how equal legal effect is obtained.

28 Aug 2004

Adopted by the 10th NPC Standing Committee

1 Apr 2005

Date the law entered into force

2015 / 2019

Two amendments, both by NPC decision

5 chapters, 36 articles

Structure of the current version

How the 36 articles are organised

The law moves from general principles to the technical rules, then to certification and liability. Chapter I — General provisions (Articles 1-3). Purpose, definitions of electronic signature and data message, and the scope rule that parties may agree to use electronic signatures unless a document type is excluded. Chapter II — Data messages (Articles 4-8). When a data message satisfies writing, original-document and record-retention requirements, and the factors a court weighs when assessing a data message as evidence. Chapter III — Electronic signatures and certification (Articles 9-26). The four conditions for a reliable electronic signature, the equal-effect rule, the signer's duties, and the licensing, certificate-content, retention and cross-border rules for certification services. Chapter IV — Legal liability (Articles 27-33). Liability of the signer, the fault presumption applied to certification providers, penalties for unlicensed certification activity, and sanctions for officials and for forgery. Chapter V — Supplementary provisions (Articles 34-36). Definitions of signer, relying party, certificate and signature-creation data, the power to issue implementing rules, and the commencement date of 1 April 2005.

Article 13: the four conditions for a reliable electronic signature

Article 13 sets a single test. An electronic signature is reliable when all four conditions are met at the same time; the law also lets the parties agree on their own reliable conditions. 01 — Exclusive to the signer. When the signature-creation data is used for signing, it belongs exclusively to the electronic signer. Shared credentials used by several people fail this condition. 02 — Controlled by the signer at the time of signing. The signature-creation data must be under the signer's control at the moment of signing. A workflow where an administrator can sign in someone else's name does not satisfy it. 03 — Any later change to the signature is detectable. After signing, any alteration of the electronic signature itself must be detectable. This is the integrity property that a cryptographic signature provides. 04 — Any later change to the content is detectable. After signing, any alteration of the content and form of the data message must be detectable. Tamper evidence therefore applies to the document body, not only to the signature value.

Article 14: the effect of a reliable signature

Under Article 14, a reliable electronic signature has the same legal effect as a handwritten signature or a company seal. Article 3 completes the picture by prohibiting a document from being denied legal effect merely because it was signed electronically, provided the parties agreed to use an electronic signature. Article 7 does the same for evidence: a data message must not be rejected as evidence merely because it was generated, sent, received or stored electronically. Article 8 then lists what a fact-finder examines when testing the authenticity of a data message — the reliability of the method used to generate, store or transmit it, the reliability of the method used to keep its content intact, and the reliability of the method used to identify the sender.

Article 3: which documents fall outside the electronic-signature rule

Article 3 permits electronic signatures in civil and commercial documents and then carves out exceptions. The list of exceptions narrowed in the 2019 amendment. Personal-status documents. Documents involving marriage, adoption or inheritance, and other relationships of personal status, are outside the rule. These matters are handled under the relevant family and succession procedures rather than by electronic signature. Public-utility service documents. Documents involving the suspension of water, heating or gas supply and similar public-utility services are excluded. Where another law or regulation says so. Any other document type that a law or administrative regulation places outside electronic documents is also excluded. This is the residual category, so it should be checked against the specific sector rules that apply to the transaction. The 2019 change to real-estate documents. The original 2004 text also excluded documents involving the transfer of real-estate rights such as land and buildings. The 2019 amendment deleted that item, so the current Article 3 no longer lists real-estate transfers among the exclusions. Sector rules on property registration still apply, and several older commentaries, vendor pages and court summaries written before 2019 continue to quote the deleted wording.

Article map for compliance checks

The provisions that matter most when a team reviews an electronic-signature workflow in mainland China.

	What the law establishes	What it means in practice
Article 3	Scope and the excluded document types	Confirm the document type is not in an excluded category before launching a fully electronic flow
Articles 4-6	When a data message counts as writing, as an original, and as a retained record	Retention must keep content reproducible and identifiable, with sender, recipient and time recorded
Article 7 and Article 8	Admissibility of data messages, and the factors used to test their authenticity	Keep evidence of how the record was generated, stored, transmitted and signed
Article 13 and Article 14	The four reliability conditions, and equal effect with a handwritten signature or seal	Design the signing flow so exclusive possession and sole control are demonstrable
Article 15	The signer's duty to safeguard signature-creation data and to report compromise	A lost or compromised key must trigger notice and a stop to further use
Articles 16-19	The certification service that carries a reliable signature, the six conditions for providing it, and the filing of business rules	Check that the certification entity doing the identity and certificate work is a licensed provider
Article 18	Application to the competent State Council department, with a decision due within 45 days	A publicly licensed provider publishes its name and licence details
Articles 20-22	Identity verification duties and the content of a certificate	The certificate must state the provider, holder, serial number, validity, verification data and the provider's own signature
Article 24	Certification-related information must be kept for at least five years after certificate expiry	Long-file disputes should still be resolvable years after signing
Article 26	Recognition of certificates issued abroad once approved by the competent State Council department	Cross-border certificates need an approval route rather than automatic equivalence

Who is allowed to provide certification services

In mainland China, the reliable electronic signature that Article 14 recognises is delivered by a digital signature carried on a digital certificate, and Chapter III sets who may issue those certificates and on what conditions. Certification is supplied by a licensed provider. Article 16 provides that where an electronic signature involves certification, the service is supplied by a lawfully established electronic certification service provider, a licensed CA. The signature that carries the equal legal effect of Article 14 is a reliable electronic signature under Article 13, and in mainland China that route runs on a digital signature carried on a certificate from such a provider. The certification layer is therefore part of the signing chain rather than an optional add-on. Six conditions for a licensed provider. Article 17 requires corporate legal-person status, suitable technical and management staff, adequate funding and premises, facilities meeting national security standards, documentary proof that the national cryptography authority has approved the use of cryptography, and any other conditions set by law. A 45-day licensing decision and a public register. Article 18 requires an application to the competent department of the State Council, which decides within 45 days of receipt and issues a licence or a reasoned refusal. Licensed providers must publish their name and licence number online. Certificate content and retention. Articles 21 and 22 require certificates to be accurate and to state the provider, the holder, the serial number, the validity period and the holder's verification data, and require certificate content to stay complete and accurate while valid — including when a service is being suspended or terminated, which Article 23 requires to be notified 90 days in advance and reported 60 days in advance. Five-year retention after expiry. Article 24 requires the provider to keep certification-related information for at least five years after the certificate expires. For teams managing contracts with long dispute tails, this is the retention floor to hold the provider to.

What changed in 2026, and what did not

The 2026 development sits one layer below the statute: it regulates how certification providers may use commercial cryptography. Order No. 6 on cryptography use, in force 1 July 2026. The Measures for the Administration of the Use of Cryptography in Electronic Certification Services, issued by the State Cryptography Administration as Order No. 6, were approved on 13 April 2026, issued on 30 May 2026 and took effect on 1 July 2026, replacing the earlier 2009 measures. A provider that uses commercial cryptography to deliver electronic certification services must hold an electronic-certification cryptography-use licence. Applications moved to the provincial level. Under Announcement No. 56 of 30 June 2026, applicants may submit licence applications to the cryptography administration of the province where they are domiciled. Providers that already held a cryptography-use licence before 1 July 2026 must assess their operations against the new measures and report the outcome. It does not amend the Electronic Signature Law. Order No. 6 changes how certification providers handle cryptography. It does not rewrite the statute, it does not change Article 13, and it does not invalidate contracts signed before July 2026. The Electronic Signature Law remains the source of the reliability test and the equal-effect rule. Why the distinction matters for procurement. Two licences now answer two different questions: whether an entity may provide public certification services at all, and whether that entity's use of commercial cryptography meets the 2026 requirements. Ask for the licence held by the specific legal entity that issues the certificate, not for a general claim of compliance.

Business and operations

Confirm the document type is not in an excluded category under Article 3
Confirm that the signing route uses a certificate issued by a licensed certification service provider
Match the signer authentication method to the value and regulatory exposure of the document
Keep the completed record and its audit trail retrievable for the retention period the business needs

Legal and compliance

Name the legal entity that issues the certificate for each signing method
Check the certification provider's licence status as at the signing date
Require evidence that exclusive possession and sole control were maintained at signing
Confirm that a certificate issued outside mainland China has an approval route if equivalence is claimed

Applying the law to a signing workflow

A practical order of work when a team builds or reviews a mainland China signing process.

Classify the document

Check the document type against Article 3 and against the sector rules that apply to it before committing to a fully electronic flow.

Confirm the certification layer

Confirm that the certificate is issued by a licensed certification service provider, and match the identity-verification evidence and certificate level to the value and regulatory exposure of the document.

Design for the four conditions

Make exclusive possession, sole control, and detectability of change to both signature and content explicit design requirements rather than afterthoughts.

Verify the certification provider

Record the issuing entity, its licence, the certificate content required by Article 21, and its retention commitment under Article 24.

Preserve the evidence package

Keep the signed file, certificate data, authentication events, consent record, timestamps and delivery records together so the Article 8 factors can be evidenced later.

Common questions

Yes. Article 14 gives a reliable electronic signature the same legal effect as a handwritten signature or a company seal, and Article 3 bars a document from being denied effect merely because it was signed electronically, unless the document type falls within an exclusion. Validity still depends on meeting the Article 13 conditions and on the document type being permitted to be electronic.

Where to verify the primary sources

Three primary sources are worth checking directly rather than through a summary. First, the consolidated text of the Electronic Signature Law published by the National People's Congress, which shows the 2004 adoption together with the 2015 and 2019 amendments. Second, the State Cryptography Administration's Order No. 6 and Announcement No. 56, which together set the 2026 cryptography-use licensing regime and the provincial application route. Third, the state department responsible for the information industry, which maintains the licensing regime for certification services and publishes licensed providers. Because the wording of Article 3 changed in 2019, prefer the consolidated current text over any pre-2019 quotation.

How this maps to eSign.AI

eSign.AI supports electronic-signature workflows that must operate under the Electronic Signature Law, including signer identity checks, certificate-backed signing, electronic seals and retained signing evidence. Where a workflow crosses into mainland China, we connect it to the China-native certification and signing chain so that the local certificate and evidence trail are preserved, while the same agreement can continue for counterparties in other jurisdictions. Compliance questions about a specific document type are answered against the current statute and the sector rules that apply to it, not against a vendor summary.

Team discussing the right eSignature approach for a business

Explore the right eSignature approach for your business

Talk to our team about eSignature requirements, compliance considerations, and document workflows across your target markets.

Keep reading

Industry Insights