Three steps to decide if ReguNav fits China.
For CFOs, COOs, Heads of Risk supervised under China authority. Skip the architecture diagrams — see the regulator, the deliverable, and the ROI you'll quote to the board.
Sovereign AI ready for China.
ReguNav supports AI vendors operating in mainland China under PIPL 2021, the CAC Generative AI Service Measures, MIIT algorithm filings, and cross-border data-transfer review. ICP filing + algorithm-recordation workflow surfaces directly to MIIT.
China regulator landscape
Every China control on the platform is anchored to a named regulator artefact. When the regulator updates their guidance, the framework registry takes the bump and every dependent control inherits it.
Frameworks anchored in China
China PIPL
202118 clauses · 12 controlsChina's comprehensive personal-information protection statute. Applies to processing of personal information of natural persons within China, and extraterritorially where processing outside China is (i) for the purpose of offering goods or services to natural persons within China, or (ii) for analysing or assessing the activities of natural persons within China. Establishes seven processing principles, six legal bases including separate-consent requirements for sensitive personal information + cross-border transfer + automated decision-making, the rights of individuals, the obligations of Personal Information Handlers (PI Handlers) including localisation + CAC security assessment for Critical Information Infrastructure Operators (CIIOs) and large-volume processors, and penalties up to 5% of preceding-year turnover or RMB 50 million.
Connected components for China.
Derived from @regunav/taxonomy at request time — add a new regulator / agent / framework to its source registry and it surfaces here automatically, no copy edits required.
What you get in China.
Honest status on every capability — live means wired end-to-end in production. Pick the ones your driver requires; we'll quote a date for anything not yet live.
Framework rule packs
- What you get
- 24 framework rule packs ship populated — SOC 2, ISO 27001, PCI DSS, GDPR, HIPAA, EU AI Act, FedRAMP and more — no empty schemas to fill in.
- Problem solved
- Buying a compliance tool and finding the rule library empty. Six weeks lost to copy-pasting control text from PDFs before the platform produces anything useful.
- ROI
- 6 weeks saved on first-control-to-evidence onboarding.Assumes: compared to building one control library per framework in-house.
Evidence ranker
- What you get
- Ranks every artefact you upload against the control it best satisfies — across 24 frameworks at once.
- Problem solved
- GRC manager spends 8h/week mapping evidence to controls by hand. Most artefacts satisfy 4–7 controls; manual mapping captures one.
- ROIinteractive
- 8h/wk of compliance-manager time reclaimedAssumes: team of 50, 3 frameworks in scope, monthly evidence refresh.
Sealed evidence packs
- What you get
- Content-addressed (sha256) evidence bundle the auditor pulls via URL. Replayable byte-for-byte from any timestamp.
- Problem solved
- Auditor email chain: 'send me the December evidence again, this time with the policy header'. Three round-trips per request.
- ROIinteractive
- $120k audit-prep cost avoidedAssumes: 3 framework audit, $250/h loaded GRC rate, baseline ~480h of prep.
WORM hash-chained audit trail
- What you get
- Every action against your tenant logged immutably with a per-row hash chain. Tampering with one row breaks verification of every later row.
- Problem solved
- Regulator asks 'who approved that change on March 4?' and the answer is a Slack search and a memory.
- ROI
- Zero regulator findings on access-control evidence.Assumes: banking-grade auditor sample (typically 25 events) verified against hash chain.
Regulator + auditor report packs
- What you get
- Seven stakeholder-shaped report packs (board, regulator, auditor, customer DPA, internal audit, …) generated from your live D1 records.
- Problem solved
- Four days re-formatting the same data for the board pack, the regulator submission, and the customer security questionnaire.
- ROIinteractive
- $96k of GRC time saved annually on report assemblyAssumes: 48 stakeholder-days/yr of report formatting at $250/h.
Code Constitution™ GitHub App
- What you get
- Compliance checks run inline on every PR (≤90s). Findings appear as line+column annotations in the review UI.
- Problem solved
- Compliance review happens quarterly. By the time the auditor flags a missing model card, it has been in production for 60 days.
- ROIinteractive
- $110k of audit-prep + remediation time saved annuallyAssumes: ~20 engineers × 220 working days × 5% PR finding rate × 2h post-hoc cost at $250/h.
How to decide for China.
- 1. Identify your supervisor. Cyberspace Administration of China (+ 1 more on this page).
- 2. Pick the framework that closes your audit. China PIPL.
- 3. Run the ROI math. Each card above shows the assumption behind the number. Plug in your team size and audit cost — if it doesn't close, neither should the deal.
- 4. Book a 30-min walk-through. We demo against a synthetic China tenant — same engine that runs your production tenancy. No slide deck.
China SaaS, fintech, healthcare-AI, or essential-service?
We work with organisations supervised by every regulator listed above. The jurisdiction-aware engine routes incident reports, DSARs, and FRIA submissions to the correct authority + timeline automatically.
Talk to China team →Jurisdiction codes + regulator data are sourced from @regunav/jurisdictions (Apache-2.0, open-source). Adding a new market is a single registry entry — no copy-paste regulator content. See /uk for the bespoke deep-dive template.