Browse one official source starting point for each of AuditReady's 15 industry groups. The source and activity determine whether a document rule may apply.
The upload inventory recognizes one conditional China source lead: a personal-information protection impact assessment under PIPL Articles 55–56. It does not check the 15 sector sources below or decide whether any rule applies.
This is a first national-source pass for AuditReady's 15 marketplace industry groups, not an exhaustive list of Chinese national, provincial, local, sector, licensing or product rules. Source origin and an industry label do not establish legal applicability, a missing document, or compliance.
Internal management rules and an incident plan for personal-information processors; a prior impact assessment and record for the specified Article 55 processing activities.
First scope question: Does the organization process personal information within the law's scope, and does any Article 55 activity occur?
Read the official Chinese source ↗A full-process data security management system for covered data processing; periodic risk-assessment reports for processors of important data.
First scope question: Does the organization conduct data processing in the law's scope, and is any data classified as important data under the relevant catalogue?
Read the official Chinese source ↗Safety responsibility and safety rules for covered production and business operations.
First scope question: Is the entity conducting production or business operations, and which sector safety rules add detail?
Read the official Chinese source ↗An environmental management ledger and permit execution reports for covered discharge-permit holders.
First scope question: Does a particular facility hold or require a pollutant discharge permit, or only registration?
Read the official Chinese source ↗Industrial and Information Technology Sector Data Security Management Measures (Trial) · Articles 2–3 and 13
Data life-cycle security management rules and procedures for covered industrial, telecommunications or radio data processors.
Check scope: Is the operator within the measure's industrial, telecommunications or radio-data scope?
Read official source ↗Bank and Insurance Institution Data Security Management Measures · Risk-management and incident-response provisions
Data-security risk management and incident-response processes for covered bank or insurance institutions.
Check scope: Is the entity a bank or insurance institution covered by the NFRA measure, or subject to a different financial regulator?
Read official source ↗Medical Record Management Rules for Medical Institutions · Institutional medical-record management provisions
Medical-record creation, custody and management procedures for covered medical institutions.
Check scope: Is this a licensed medical institution, and which paper or electronic record rules apply?
Read official source ↗Good Manufacturing Practice for Drugs (2010 Revision) · Articles 150–163
Specifications, manufacturing instructions, procedures and batch records for drug manufacturers.
Check scope: Does the activity involve drug manufacturing, medical devices, clinical research or another separately regulated life-sciences activity?
Read official source ↗Food Safety Law · Articles 44 and 49–51
Food-safety management systems and, for specified producers, input, purchase and outgoing-inspection records.
Check scope: Is the operator a food producer, food business or edible-agricultural-product producer, and which product-specific rule applies?
Read official source ↗Hazardous Chemicals Safety Law (effective 1 May 2026) · Articles 5 and 13
Safety management rules and position responsibilities for covered hazardous-chemical units; major-hazard records and emergency plans where Article 13 applies.
Check scope: Which chemicals, activities and major-hazard thresholds apply, and do Article 121 exclusions change the rule?
Read official source ↗Measures for Electric Power Enterprise Emergency Plans · 2025 issued measure; operative article pin pending
Electric-power emergency plans and related plan management for covered power enterprises.
Check scope: Is the organization an electric-power enterprise, another energy operator, or a contractor with different duties?
Read official source ↗Industrial and Information Technology Sector Data Security Management Measures (Trial) · Articles 2–3 and 13
Data-security management rules and procedures for covered industrial-data processing.
Check scope: Does this manufacturer process industrial data within this measure, and what other product or safety rules govern its operations?
Read official source ↗Regulations on Pollutant Discharge Permit Management · Articles 21–22
Environmental management ledger and permit execution reports for covered permit holders.
Check scope: Does the site need a discharge permit, or only registration, and what does the particular permit require?
Read official source ↗Coal Mine Work Safety Regulations · Coal-mine enterprise safety and emergency-plan provisions
Mine-safety rules, operating procedures and accident emergency plans for coal-mine enterprises.
Check scope: Is this a coal mine, a non-coal mine or a contractor, and which mine-specific rules apply?
Read official source ↗Safety Management Standards for Road Passenger Transport Enterprises · Articles 3 and enterprise safety-management provisions
Safety management rules, operating procedures and emergency plans for road passenger transport enterprises.
Check scope: Is this a road passenger carrier, freight carrier, logistics provider or another transport mode?
Read official source ↗Safety Management Measures for Primary and Secondary Schools and Kindergartens · School safety-system and emergency-plan provisions
School safety management systems and emergency plans for covered schools and kindergartens.
Check scope: Is the organization a school, kindergarten, university or education service provider?
Read official source ↗Law on Guarding State Secrets (2024 revision) · Articles 7–8
Secrecy responsibility and management systems for state organs and units handling state secrets.
Check scope: Is this a state organ, a unit handling state secrets, or a contractor without classified work? Do not upload restricted material.
Read official source ↗Listed Company Information Disclosure Management Measures (2025 revision) · Article 31
Information disclosure management system for covered listed companies.
Check scope: Is the entity listed on a mainland Chinese exchange and subject to this CSRC measure?
Read official source ↗Bank and Insurance Institution Data Security Management Measures · Risk-management and incident-response provisions
Data-security risk management and incident-response processes for covered insurers.
Check scope: Is this an insurer, intermediary or other insurance-sector entity, and does the NFRA measure cover it?
Read official source ↗Each source still needs an operative version pin, Chinese-text review, sector and activity rules, local and product overlays, reusable document wording, and tested report behavior. No China sector source is an enabled assessment pack. A document type match means only that the uploaded heading suggests the same broad document family. This is not legal advice.