![workplace-with-people-in-walking-in-blurred-motion-in-modern-office-space_AdobeStock_714071973](https://www.nortonrosefulbright.com/-/media/images/nrf/hero/workplace-with-people-in-walking-in-blurred-motion-in-modern-office-space_adobestock_714071973.jpeg?w=265&revision=757b8aa8-f74f-4e2d-9ccd-084ec5192278&revision=5250277392097387904&hash=380B464034E4102358A0D456AAB43445)
Publication
Merger law reform in Australia: What next after the Exposure Draft?
As expected, the Australian Commonwealth Treasury released an exposure draft for the proposed new Australian merger regime on 24 July 2024.
China | Publication | May 2019
On 21 May 2019 a draft regulation, entitled Measures on Cybersecurity Review (Cybersecurity Review Measures), was issued by the China Administration of Cyberspace (CAC) for public comment. The Cybersecurity Review Measures are intended to replace the Interim Measures for Security Review of Network Products and Services, which had been implemented on 1 June 2017. The issuance of the draft Cybersecurity Review Measures demonstrates the Chinese government’s ongoing commitment to enhance cybersecurity and compliance requirements for supply chains in relation to critical information infrastructure.
The draft Cybersecurity Review Measures contain provisions which could have an important impact on vendors and suppliers who sell IT and network products to strategic and sensitive industries (such as the financial, energy, public utility, telecom, transportation and other important sectors).
In this briefing, we outline the key provisions of the draft Cybersecurity Review Measures and provide high-level analysis of the implications this new regulatory development may have for IT and network vendors and suppliers.
The draft Cybersecurity Review Measures make it clear that CAC will be the leading authority for regulating cybersecurity review for operators of critical information infrastructure (CII Operators). CAC will work with multiple Chinese national key regulators (such as the National Development and Reform Commission, the Ministry of Information and Industry, the Ministry of Public Security, the Ministry of Commerce, and the People’s Republic of China and the National Administration Bureau of Cryptography) to set up the cybersecurity review regime.
The Cybersecurity Review Office, which is a governmental agency under CAC, will be granted the power and authority to:
The China Cybersecurity Law has established? a general requirement that CII Operators must undergo a national security review where the procurement of network products and services may affect national security.
Consistently with the requirements of the China Cybersecurity Law, the draft Cybersecurity Review Measures provide that CII Operators must conduct a pre-assessment of the potential cybersecurity risks in connection with the network products and services concerned. the CII Operator must report to the Cybersecurity Review Office for cybersecurity security review if any of the following risks are identified:
The draft Cybersecurity Review Measures provide that the Cybersecurity Review Office will focus on the following aspects when assessing whether the procurement may involve a national security risk:
It seems that supply chain risks and financing or control by foreign governments have been highlighted as key factors, among others, in evaluating the procurement risks in connection with network products and services supplied to CII Operators. In the light of increased U.S. / China trade disputes, it is possible that this regime could be used by the Chinese government as a retaliatory measure for responding to trade restrictions imposed by the U.S. government on Chinese-made products.
In terms of the procedures, the draft Cybersecurity Review Measures provides that CII Operators should conduct a pre-assessment and produce a cybersecurity risk report. Where CII Operators decide to make a report to the Cybersecurity Review Office, the following procedures should be followed:
(a) the Cybersecurity Review Office will have 30 working days to conduct the preliminary review (which can be extended for another 15 days in complicated cases);
(b) the Cybersecurity Review Office will formulate a review conclusion with suggestions based on its preliminary review and send the conclusion and suggestions to the cybersecurity review member units for consultation;
(c) the cybersecurity review member units will issue written response opinions within 15 working days, and if the opinions are consistent, the Cybersecurity Review Office will revert to the CII Operator with the review conclusion (but if the opinions are inconsistent, a special review process will be initiated); and
(d) the special review process will, as a general principle, take 45 working days (which can be extended for complicated scenarios).
The draft Cybersecurity Review Measures require CII Operators to use contracts, procurement documents and other binding means in order to require vendors and suppliers to cooperate with the cybersecurity review. CII Operators can also add conditions that procurement contracts will only come into force after a cybersecurity review has passed.
It appears from the provisions described above that a cybersecurity review can have significant implications for vendors and suppliers who sell their network products and services to CII Operators. The cybersecurity review process will not only add an extra timeline and procedures to the procurement process, but it will also add uncertainty to procurement contracts.
The draft Cybersecurity Review Measures provide for legal definitions for certain important concepts. They refer to CII Operators as those operators which have been identified by Chinese authorities. This seems to be a different approach from the Cybersecurity Law, which defines CII by way of a list of non-exhaustive industries (such as financial, transportation, energy, telecom, etc.), plus a catch-all under which the scope of CII can be interpreted loosely at the discretion of the governmental authorities.
The draft Cybersecurity Review Measures accordingly seem to suggest that Chinese authorities may take initiatives in identifying CII. This can provide more practical certainty for businesses in determining who may fall within the scope of CII. IT and tech vendors and suppliers will be able to assess whether their customers are CII Operators, and therefore whether a procurement by their customers will be subject to the cybersecurity review process.
Another important definition provided for in the draft Cybersecurity Review Measures is the concept of “safe and controllable”. This definition:
Publication
As expected, the Australian Commonwealth Treasury released an exposure draft for the proposed new Australian merger regime on 24 July 2024.
Subscribe and stay up to date with the latest legal news, information and events . . .
© Norton Rose Fulbright LLP 2023