China CAC Cyberspace & Data Governance Brief
Headline
China's Cybersecurity Review Office opens formal security review of Palo Alto Networks products sold in China
Executive Summary
China's Cybersecurity Review Office initiated a formal cybersecurity review of Palo Alto Networks products sold in China, announced August 6, 2026. The review proceeds under the Cybersecurity Review Measures and is grounded in China's national security and cybersecurity statutes.
Bottom Line
The Cybersecurity Review Office's announcement places Palo Alto Networks products sold in China under formal statutory review, with the review's outcome carrying the potential to restrict or prohibit procurement by critical information infrastructure operators. The review is active; no interim measures, timeline, or outcome are stated in the announcement. Cresthaven reading: firms operating critical information infrastructure in China that rely on Palo Alto Networks products, and Palo Alto Networks' own China-market operations, sit in a period of unresolved regulatory exposure until the review concludes.
Key Regulatory Signals
- Formal Review Initiated Against a Named Vendor: The Cybersecurity Review Office has opened a cybersecurity review specifically targeting Palo Alto Networks products sold in the Chinese market. The announcement cites protection of critical information infrastructure and prevention of cybersecurity risks as the stated basis. Cresthaven reading: operators of critical information infrastructure in China that have deployed Palo Alto Networks products face direct exposure to the review's scope and potential procurement restrictions.
- Statutory Grounding Signals Broad Investigative Authority: The review is anchored in China's National Security Law and Cybersecurity Law, with the Cybersecurity Review Measures as the procedural framework. These instruments authorize the review office to require information submissions, suspend procurement, and recommend prohibition of reviewed products.
- No Timeline or Outcome Stated: The announcement does not specify a review duration, interim measures, or a decision timeline. The Cybersecurity Review Measures do not impose a fixed public deadline for conclusion of reviews of this type.
- Precedent Pattern: Prior Reviews Have Resulted in Market Exclusion: The Cybersecurity Review Office has previously initiated reviews against Micron Technology (2023) and NVIDIA (2025), with the Micron review resulting in a procurement ban for critical information infrastructure operators. Cresthaven reading: the precedent pattern places Palo Alto Networks' continued market access in China at risk pending the review's conclusion.
Regulatory Delta
- The Micron Technology review (2023) established the operative precedent: a formal cybersecurity review under the Cybersecurity Review Measures produced a procurement ban for critical information infrastructure operators, the first such outcome imposed on a major U.S. technology vendor.
- This action is the first formal cybersecurity review targeting a U.S. cybersecurity infrastructure vendor. Prior reviews covered semiconductor and consumer-technology companies; this one does not.
- The action follows a period of escalating U.S.-China technology restrictions, including U.S. export controls on advanced semiconductors and networking equipment. It fits a broader pattern of reciprocal regulatory pressure across the technology sector in both jurisdictions.
Materiality Classification
HIGH — The Cybersecurity Review Office's formal review of a named major U.S. cybersecurity vendor under China's Cybersecurity Review Measures represents a first-in-kind precedent for the cybersecurity infrastructure sector, with prior reviews having resulted in procurement bans applicable to critical information infrastructure operators across China.
Intelligence Outlook
Monitor the Cybersecurity Review Office for any interim measures, information-submission requirements, or a final determination under this review, with particular attention to any procurement guidance directed at critical information infrastructure operators.