每周数据法律资讯 Data Law Weekly（20260615—20260621）

1.国家金融监督管理总局发布《关于银行业保险业人工智能安全开发应用的指导意见》

6 月 18 日，国家金融监督管理总局发布《关于银行业保险业人工智能安全开发应用的指导意见》，从治理架构、开发应用、数据治理、算力建设、风险管理、能力提升、保障与监督等方面提出了32项指导性意见。一是完善人工智能治理架构，要求加强顶层设计和统筹管理，建立健全全生命周期管理体系。二是推进高水平人工智能开发应用，完善开发与测评体系，实现模型开发部署全流程管理，稳妥探索技术研发和金融智能体建设。三是提升数据治理能力，完善数据管理运营体系，持续推进高质量数据集和知识工程建设。四是加强智能算力建设，按需布局自主可控、安全高效的算力底座，鼓励大型机构向中小机构输出算力服务，支持基础设施共建共享。五是完善风险治理框架，实施分类分级管理和高风险应用准入，建立人工监督和干预机制，加强外包和供应链风险管理。六是提升安全开发应用能力，增强模型稳健性、透明度和可解释性，加强网络安全、数据安全与个人信息保护，强化运营韧性和业务连续性管理。七是要求监管部门加强指导和监督，督促落实风险治理。

【参见：

https://www.nfra.gov.cn/cn/view/pages/governmentDetail.html?docId=1261784&itemId=&generaltype=1】

National Financial Regulatory Administration Issued the Guidelines on Safe Development and Application of Artificial Intelligence in Banking and Insurance Industries

On June 18, the Guidelines put forward 32 guiding requirements covering seven dimensions: governance framework, development and application, data governance, computing infrastructure development, risk management, capacity improvement, as well as guarantee and supervision. First, improve the AI governance framework by strengthening top-level design and overall management, and establishing a sound full-lifecycle management system. Second, advance high-quality AI development and application, perfect development and evaluation systems to realize full-process management of model development and deployment, and steadily explore technology research and development as well as the construction of financial agents. Third, upgrade data governance capacity, optimize data management and operation systems, and continuously develop high-quality datasets and knowledge engineering. Fourth, boost intelligent computing infrastructure development by deploying self-controllable, secure and efficient computing foundations as needed. Large institutions are encouraged to provide computing services to small and medium-sized ones and support co-construction and sharing of infrastructure. Fifth, refine the risk governance framework, implement classified and tiered management and access control for high-risk applications, set up manual supervision and intervention mechanisms, and strengthen risk management of outsourcing and supply chains. Sixth, enhance the capacity for secure development and application, improve model robustness, transparency and interpretability, reinforce cybersecurity, data security and personal information protection, and strengthen operational resilience and business continuity management. Seventh, regulatory authorities shall strengthen guidance and supervision to urge the implementation of risk governance.

[Reference: 

https://www.nfra.gov.cn/cn/view/pages/governmentDetail.html?docId=1261784&itemId=&generaltype=1]

2.国家网信办就《促进分布式数字身份互通互认应用规定（征求意见稿）》公开征求意见

6月18日，国家网信办就《促进分布式数字身份互通互认应用规定（征求意见稿）》公开征求意见，共8章43条，包括分布式数字身份的注册与互通互认、可验证凭证的签发与验证、分布式数字身份的管理等内容。明确了分布式数字身份公共服务、分布式数字身份链、权威身份认证机构、应用服务机构等定义，建立了境内与境外分类注册签发机制，推动与金融、交通、海关、税务、公共资源交易等现有行业身份体系的互通互认。强化用户自主管理权，支持自愿注册、自主持有与停用，允许按需选择性披露凭证信息，落实最小化信息收集原则。增设未成年人保护条款，要求不满14周岁用户须征得监护人同意并由其代为申请。规范平台接入备案、凭证存证、数据留存等管理要求，明确身份链运营方、权威认证机构、应用服务机构、凭证签发机构等各方在应急响应、数据安全、个人信息保护、审计留存等方面的责任义务。

【参见：

https://mp.weixin.qq.com/s/ILON0mWTYtXTtkVNnvjCMA】

CAC Launched Public Consultation on the Draft Provisions for Interoperable Distributed Digital Identity Application

On June 18, opened public consultation on the Draft Provisions for Interoperable Distributed Digital Identity Application, which contains 8 chapters and 43 articles covering the registration and mutual recognition of distributed digital identities, issuance and verification of verifiable credentials, and administration of distributed digital identities. It defines concepts including public services for distributed digital identities, distributed digital identity chain, authoritative identity certification institutions and application service institutions. It establishes classified registration and issuance mechanisms for domestic and overseas entities, and promotes mutual recognition with existing industry identity systems in finance, transportation, customs, taxation and public resource trading sectors. The document strengthens users’ right to independent control, supports voluntary registration, independent holding and deactivation, allows selective disclosure of credential information as needed, and implements the data minimization principle. Special clauses for minor protection are added, requiring users under 14 to obtain guardian consent and apply through their guardians. It standardizes management requirements such as filing for platform access, credential archiving and data retention, and clarifies the liabilities and obligations of identity chain operators, authoritative certification bodies, application service institutions and credential issuers in emergency response, data security, personal information protection and audit record retention.

[Reference: 

https://mp.weixin.qq.com/s/ILON0mWTYtXTtkVNnvjCMA]

3.国家网信办、工信部、公安部联合发布《网络数据安全风险评估办法》

6月18日，国家网信办等三部门联合发布《网络数据安全风险评估办法》，将于2026年 8月20日正式施行。《办法》明确了适用范围、评估机制和部门职责，规定在境内开展网络数据安全风险评估应当遵守本办法；明确了风险评估的有关要求、依据和形式；规定重要数据处理者应当每年度开展风险评估；明确了评估机构的认证、培育、重大风险通知等要求；明确了风险评估报告的编制、报送与检查要求，规定重要数据处理者应当依法按照有关主管部门规定和要求编制并报送风险评估报告，有关主管部门将报告通报同级网信部门；明确了监督管理要求，规定省级以上有关部门可以要求网络数据处理者委托通过认证的评估机构开展风险评估，有关部门发现重要数据处理活动可能危害国家安全、公共利益的，应当依据职责责令重要数据处理者进行整改，对拒不整改或者未达到整改要求的重要数据处理者，可以采取要求其停止处理重要数据等措施。

【参见：

https://mp.weixin.qq.com/s/ypoiNq_5IxGtLw8o9pg9xQ】

CAC, MIIT and MPS Jointly Released the Measures for Cyber Data Security Risk Assessment

On June 18, the CAC, MIIT and MPS jointly released the Measures for Cyber Data Security Risk Assessment. The Measures will take effect on August 20,2026. The Measures clarify the scope of application, assessment mechanisms and departmental responsibilities, stipulating that all cyber data security risk assessments carried out within China shall comply with this document. It specifies relevant requirements, basis and forms for risk assessment. Entities processing important data shall conduct risk assessments on an annual basis. It sets forth requirements for the certification and cultivation of assessment institutions as well as notification of major risks. It clarifies rules on the compilation, submission and inspection of risk assessment reports, requiring important data processors to compile and submit reports to competent authorities in accordance with laws and regulatory provisions, and competent authorities shall circulate such reports to CAC departments at the same level. It also defines supervision and administration rules: authorities at or above the provincial level may order cyber data processors to entrust certified assessment institutions to conduct risk assessments. If competent authorities find that important data processing activities may endanger national security or public interests, they shall order relevant processors to rectify the problems within their respective remits. For entities refusing rectification or failing to meet rectification standards, authorities may order them to suspend the processing of important data.

[Reference: 

https://mp.weixin.qq.com/s/4lwnSfcB3EBxlARg7MsZyQ]

4.上海市通信管理局印发《上海市电信领域数据安全事件企业上报指引》

6月18日，上海市通信管理局印发《上海市电信领域数据安全事件企业上报指引》，指导上海市电信领域数据处理者（基础电信业务经营者、增值电信业务经营者、相关互联网企业等）规范、及时、准确地开展数据安全事件上报。当企业发现数据安全事件，应依据《上海市电信领域数据安全事件应急预案（试行）》事件分级标准，自行研判属于较大、重大或特别重大数据安全事件的，或者属于上海市通信管理局要求报告的其他情形的，应当立即上报；一般数据安全事件由企业按照本单位应急预案自行处置，并留存记录。企业报告事件时，应参照《数据安全事件上报（模板）》提交信息。重大及以上数据安全事件报告需上报人签字或者上报单位盖章。涉及系统、影响主体和范围等信息不明确的，可填“尚不明确”，不得因信息不完整延误报告。

【参见：

https://mp.weixin.qq.com/s/RYvPxaul1iNus4hKUsWd_Q】

Shanghai Communications Administration Issued the Reporting Guidelines for Data Security Incidents in the Telecommunications Sector

On June 18, Shanghai Communications Administration issued the Reporting Guidelines for Data Security Incidents in the Telecommunications Sector, to guide data processors in Shanghai’s telecommunications industry (basic telecom operators, value-added telecom service providers, relevant internet enterprises, etc.) to submit standardized, timely and accurate reports on data security incidents. Upon detecting data security incidents, enterprises shall classify incidents by themselves in line with the tiered criteria laid down in the Trial Emergency Response Plan for Data Security Incidents in Shanghai’s Telecommunications Sector. Enterprises shall immediately report moderate, major or extremely major data security incidents, as well as other incidents required by Shanghai Communications Administration. Minor data security incidents may be handled internally by enterprises in accordance with their own emergency response plans with complete records retained. Enterprises shall submit incident information by referring to the Data Security Incident Reporting Template. Reports on major and above incidents must bear the signature of the reporter or the official seal of the reporting entity. If information concerning affected systems, parties or scope remains unclear, enterprises may fill in “to be clarified” and shall not delay reporting due to incomplete information.

[Reference: 

https://mp.weixin.qq.com/s/RYvPxaul1iNus4hKUsWd_Q]

5.国家网信办、工信部、公安部印发《实施网络安全标识的产品目录（第一批）》及相关实施规则

6月18日，网信办等三部门联合发布《实施网络安全标识的产品目录（第一批）》及相关实施规则，同时，全国网络安全标准化技术委员会组织制定了《网络安全标识消费类网联摄像头安全要求》（网络安全标准实践指南 TC260-PG-20265A），作为消费类网联摄像头实施网络安全标识的标准依据。明确了消费类网联摄像头的网络安全标识对应的网络安全能力由低到高依次为基础级、增强级、领先级三个级别，相应的标识等级分别用一星、二星、三星表示。企业自愿申请产品安全备案并张贴带核验二维码的官方安全标识，备案有效期限三年；文件细化产品检测项目、备案申报材料、标识使用规范，对伪造、冒用、涂改安全标识的企业设置惩戒机制，违规主体一年内不再受理其安全标识备案申请。

【参见：

https://mp.weixin.qq.com/s/uo12tNYrxZXVWxpWMx-qhg】

CAC, MIIT and MPS Issued the First Batch of Product Catalogue for Cybersecurity Label Implementation and Supporting Implementation Rules

On June 18, CAC, MIIT and MPS jointly issued the First Batch of Product Catalogue for Cybersecurity Label Implementation and supporting implementation rules. Meanwhile, TC260 formulated the Cybersecurity Label – Security Requirements for Consumer Connected Cameras (TC260-PG-20265A), serving as the standard basis for cybersecurity labeling of consumer connected cameras. The document specifies three tiers of cybersecurity capabilities for consumer connected cameras in ascending order: basic, enhanced and advanced, marked by one, two and three stars respectively. Enterprises may voluntarily apply for product safety filing and affix official cybersecurity labels with verification QR codes, with filing valid for three years. It details product testing items, filing application materials and label usage specifications, and sets punitive measures for enterprises that forge, falsely use or alter cybersecurity labels; filing applications from such non-compliant entities will not be accepted within one year.

[Reference: 

https://mp.weixin.qq.com/s/uo12tNYrxZXVWxpWMx-qhg] 

6.全国网安标委就《个人信息安全规范》等5项国家标准公开征求意见

6月17日，全国网络安全标准化技术委员会发布5项数据、网络安全国家标准征求意见稿，包含《数据安全技术自动化工具收集网络数据技术要求》、《网络安全技术关键信息基础设施安全检测评估方法》、《网络安全技术零信任能力成熟度模型及评价方法》、《网络安全技术人工智能技术涉及未成年人应用安全指南》、《数据安全技术个人信息安全规范》，意见征集截止时间为2026年8月16日。

【参见：

https://www.tc260.org.cn/portal/suggestion】

The TC260 is soliciting public comments on five national standards, including the “Specification for Personal Information Security”

On June 17, the TC260 released draft versions of five national standards on data and cybersecurity for public consultation, including: “Data Security Technology-Technical Requirements for Automated Tool-based Collection of Network Data”，“Cybersecurity Technology-Security Detection and Assessment Methods for Critical Information Infrastructure”，“Cybersecurity Technology-Zero Trust Capability Maturity Model and Assessment Methods”，“Cybersecurity Technology-Security Guidelines for AI Applications Involving Minors”，and “Data Security Technology-Personal Information Security Specification”. The public consultation will close on August 16, 2026.

[Reference:

https://www.tc260.org.cn/portal/suggestion]
 

1. 欧盟议会批准AI法案简化措施并禁止“AI裸体化”应用

6月16日，欧洲议会批准《人工智能法》部分简化修订，旨在降低企业合规负担，同时保留风险分级监管框架。修订内容包括推迟部分高风险AI系统义务适用时间，AI生成内容机器可读标识义务也延后至2026年12月2日。同时，法案明确禁止用于生成儿童性虐待材料，以及未经同意生成可识别个人私密部位或性活动图像、视频、音频的“AI裸体化”应用。相关规则仍需欧盟理事会正式通过后生效。

【参见：

https://www.europarl.europa.eu/news/en/press-room/20260611IPR45207/ai-act-ep-approves-simplification-measures-and-nudifier-app-ban】

EP approves AI Act simplification and “nudifier” app ban

On June 16, the European Parliament approved amendments to simplify parts of the AI Act, aiming to reduce compliance burdens while preserving its risk-based framework. The changes postpone certain obligations for high-risk AI systems and delay machine-readable labelling rules for AI-generated content until 2 December 2026. The amendments also ban AI systems used to generate child sexual abuse material or non-consensual intimate or sexually explicit images, videos or audio of identifiable persons. The text still requires formal Council approval before entering into force.

[Reference:

https://www.europarl.europa.eu/news/en/press-room/20260611IPR45207/ai-act-ep-approves-simplification-measures-and-nudifier-app-ban]