Secretive China Agency Backtracks on Aggressive Policies After $1 Trillion Rout

By Communist Party standards, the Cyberspace Administration of China’s rise has been nothing short of breathtaking.

In just over 10 years, the regulator has morphed from a singularly minded online censor into one of the country’s most powerful administrators — with oversight of both data and artificial intelligence, two pillars of future economic growth.

But the CAC’s rapidly expanding portfolio has also appeared to leave some of its bureaucrats overwhelmed, according to people familiar with the matter. That has contributed to a sense of confusion in recent years, according to interviews with more than a dozen executives, consultants and lawyers who work with the agency or advise foreign businesses.

That confusion became evident in 2021 when the CAC’s decision to force Didi Global Inc. off US bourses accelerated a $1 trillion selloff in Chinese tech stocks. Then came a surprise dictate in late 2022 on what data could be transferred beyond the country’s borders — which set off months of back-and-forth between companies and the CAC over things like how to handle hotel reservations and human resource systems.

While the CAC has rolled back some of its more controversial measures — a rarity in Xi Jinping’s government — some China watchers are concerned the regulator remains a significant risk for investors. The worry is that the agency will struggle to manage Xi’s competing priorities of economic growth and national security, leading to more policy flipflops that discourage innovation and investment.

“This is a little bit of a rebalancing act, against the overall trend of tightening in recent years,” said Xiaomeng Lu, director of the geo-technology practice at Eurasia Group. “CAC is still very much concerned about national security” and could become more hawkish when the economy improves, or when geopolitical tensions heighten, she added.

Whether the CAC settles on a more hands-off or more hands-on approach will have substantial implications for businesses from Apple Inc. to Tesla Inc. in China. Bloomberg News reported last year that it was taking Citigroup Inc. longer than expected to set up a wholly-owned securities business in the country because of the agency’s data rules. The same regulations, meanwhile, led Morgan Stanley to pull about 200 technology developers out of China.

It became such a concern for European firms that European Union leaders raised the issue directly with Premier Li Qiang when they visited Beijing in December of last year.

“This sort of tension is something that infuses the entire system - it’s China’s personality,” said Tom Nunlist, an analyst at the Beijing-based consultancy Trivium. “At one point, it all fell apart and didn’t work, so now the agency is sort of reckoning with reality that it can’t do things this way.”

(The CAC also regulates providers of financial news and information in China, including Bloomberg LP, the parent of Bloomberg News.)

Unlike other regulators such as for the securities and banking watchdogs, the CAC answers directly to the Party rather than the State Council or cabinet. That means it rarely publishes readouts from its internal meetings, nor does it disclose its budget like other ministries do, making it more opaque.

The director of the CAC — also the deputy head of the Communist Party’s powerful propaganda department — over the past half-decade has been a little-known official named Zhuang Rongwen.

Zhuang rarely veers from the official script and rarely headlines even state media articles. Under his tenure, public reports of “illegal and harmful” information — meaning violent, pornographic, and politically sensitive — to the regulator have increased, official figures show.

The agency did not respond to multiple faxed requests to interview Zhuang and his deputies, or answer questions on its handling of data and AI policies.

The CAC isn’t the only agency in Beijing that’s had a recent history of taking markets and boardrooms by surprise. The eleventh-hour pulling of Ant Group Co.’s initial public offering in November 2020 started a rout in shares of Chinese technology companies. Later, the education ministry in 2021 essentially wiped out swathes of the after-school tutoring industry almost overnight.

But what makes the CAC particularly important is its pivotal role in the evolution of AI, a key battleground in the US-China geopolitical conflict. That race will likely shape the tech leaders of the future and help tilt the geopolitical balance, as Chinese firms from Baidu Inc. to SenseTime Group Inc. race to match the likes of OpenAI.

A 2016 law established the regulator’s remit as dealing with internet security, a term that has since expanded to include the governance of new technologies. Arms of the CAC have also taken so-called “golden shares” in sector leaders like Alibaba Group Holding Ltd., securing a means to hold long-term sway over the industry.

The agency was among the first major watchdogs in the world to lay down the rules of the road for AI development. Its draft guidelines in 2023 placed most of the legal responsibility on companies themselves to ensure AI chatbots adhered to “core socialist values” and other standards, potentially inhibiting innovation. There also, it showed signs of a change in tack.

In July that year, after consulting industry players, the agency watered down the most stringent of these rules, unveiling a new focus on development and AI innovation. Supervision of the technology was also expanded beyond the CAC to include other agencies, including the more growth-oriented science and technology ministry and the National Development and Reform Commission.

Still, the CAC is ever present. The Financial Times reported this week that the agency has forced companies including ByteDance Ltd., Alibaba, Moonshot and 01.AI to take part in government reviews of their AI models.

Read More: China Looks to Relax Data Export Rules to Allay Business Fears

“Development now has definitely won out for the time being, especially with the need to focus on technologies such as AI and having tech competition as a big focus of the Chinese government,” said Tiffany Wong, director with the China practice at Albright Stonebridge Group.

If AI is the future, then data is the more immediate concern for businesses. After the CAC issued its rules on data transfers in late 2022, frustration at companies mounted for months during a chaotic back-and-forth with CAC offices, according to people familiar with the process. There was confusion over things like how airlines and hoteliers would handle reservations, or whether companies could sync Chinese employee data with global human resource platforms. Regulators often took months to respond to queries, the people said.

Some companies raced to file data applications to the CAC that were rendered unnecessary just months later, the people said. Others chose to remain in a state of limbo, as their lawyers placed bets on when policy exemptions would come through. Executives weighed pulling sensitive personnel, banks plotted how to reshape balance sheets, and China representatives urged global headquarters for bigger compliance budgets.

In September 2023, the CAC did release a series of draft exemptions to their requirements, though worries persisted. The EU Chamber of Commerce issued a report in November calling on the agency to provide greater clarity on the rules, with EU leaders then directly raising their concerns with Premier Li when they visited Beijing in December.

In March this year, the CAC followed through on its September draft and rolled back some — but not all — of those constraints on data transfers. That decision to relax some of its strictest rules — after meeting with firms including Walmart Inc. — was an unexpected shift, according to people familiar with the matter. So too was an April announcement that a CAC affiliate cleared Tesla to collect data in China.

At one event last year, a CAC official admitted to businesses that it was still figuring out its own data transfer rules, according to an attendee.

“The government is walking the highwire in balancing security and development,” said Angela Zhang, a China tech law expert and author of High Wire: How China Regulates Big Tech and Governs Its Economy. “To stimulate the economy and boost employment, Chinese regulators have lifted many restrictions and relaxed control. The CAC is no exception.”

For many observers, the policy confusion exposed fault lines at an agency tasked with supervising far too large and fast-moving an arena, according to people familiar with the regulator. That’s fomented confusion and made investors cautious.

That means even as the CAC adopts a more open attitude, doubts remain over where it’s taking the country’s tech regulations.

“They’re shifting the emphasis towards being open, but not yet letting go of security very much,” Nunlist said. “It became very clear from what happened with Didi that you can’t dodge them. Nobody will ever chance that again.”