A rollout that has outgrown the pilot label
China's Ministry of Industry and Information Technology (MIIT) now describes intelligent connected vehicles as a technology in scaled deployment. The figures behind that claim were set out by Guo Shougang, an MIIT official, at a Beijing media roundtable on 27 July 2026, as reported by China News Service. More than 20,000 test licenses have been issued. Over 57,000 km of roads are open to testing, and testing has passed 220 million km. Level 2 driver assistance is fitted to 70.5% of passenger cars this year, and the first batch of Level 3 vehicles has begun operating in designated areas. At the conference's opening on 21 October, MIIT Vice Minister Xin Guobin pledged to prudently advance access and on-road pilots and to speed up scaled autonomous-driving demonstrations. Guo also said in July that a standards framework covering data security, cybersecurity and functional safety, from R&D through operation monitoring, has already been built, and that MIIT would speed up key standards. The analysis below rests on those figures and the published 2021 rules.
The case for tight data control
The strongest argument for strict state oversight is that a modern connected car is a roaming sensor platform. Cameras, radar and location logs capture roads, buildings, pedestrians and drivers continuously. Aggregated at fleet scale, that data can reveal infrastructure layouts, traffic patterns and individual movements. Regulators who worry about misuse or unreviewed export of such data are responding to a real risk. The Cyberspace Administration of China (CAC) made this case when it introduced its automotive data rules, citing the risks of exporting important data without a security assessment and of excessive collection (CAC Q&A, 20 August 2021).
What the existing rules already do
The operative framework is the Several Provisions on Automobile Data Security Management (Trial). CAC, the National Development and Reform Commission, MIIT, the Ministry of Public Security and the Ministry of Transport issued it jointly, and it took effect on 1 October 2021 (CAC text). Its design has several notable features:
- It encourages in-vehicle processing, no collection by default, and desensitization of data that is collected.
- It requires separate consent for sensitive personal information. It also allows biometric data such as fingerprints, voiceprints and faces to be collected only where there is a driving-safety purpose and sufficient necessity.
- It requires important data to be stored within China. Sending it abroad requires a completed outbound security assessment, and processors may not exceed the assessment's conclusions.
- It imposes risk-assessment reports, an annual report due by 15 December, and regulator spot checks.
Several of these are sound engineering and privacy ideas. Processing data on the vehicle and collecting less by default reduce both breach exposure and the regulatory burden, and they are choices other jurisdictions could borrow.
Where proportionality is tested
The difficulty is that these rules were written when the fleet was small. In 2021 the question was how a few thousand test vehicles should handle data. Now it is how tens of millions of driver-assisted cars, and a growing number of Level 3 vehicles, should handle it. Three pressure points follow.
The first is the boundary of "important data". The CAC's own explanation says only that the Provisions "further clarify" the concept and does not provide a catalogue (CAC Q&A). Manufacturers need predictable, published categories to decide what must stay onshore. When the line is vague, companies tend to over-localize, which raises cloud costs and can slow the safety learning loops that improve driving systems.
The second is the cost of the safety feedback loop. Crash reconstruction, edge-case mining and cross-model validation depend on moving and pooling data. If operation-monitoring standards demand rich logging while localization and export rules restrict where the logs can go, firms will need clear safe-harbour pathways. Otherwise, safety data will sit in silos that regulators and engineers cannot easily use.
The third is consistency across the standards stack. The MIIT official also said China is strengthening standards for combined driver-assistance systems, and that the country co-led a UN global technical regulation for automated driving systems (China News Service). That outward-facing, interoperable approach is the right instinct. Domestic data standards should be built to align with it, so that the same vehicle platform does not need a bespoke compliance build for every market.
What a proportionate standards push would look like
The ministry's commitment to speed up key standards, including on data security and monitoring, is welcome if it delivers clarity rather than additional layers. Four design choices would make it work:
- Publish concrete data categories. Tiered lists of what counts as important data, with examples, would replace case-by-case guesswork.
- Scale obligations to risk. A Level 2 assistance feature and a Level 3 system operating in a designated zone present different exposure, and their logging and reporting duties should differ accordingly.
- Create a defined path for safety-data sharing. Anonymized incident and near-miss data should be able to flow to approved testing and research bodies without a bespoke approval each time.
- Publish enforcement results. Aggregate information on spot checks and assessments would let firms learn what regulators actually treat as a violation.
The bottom line
The numbers in MIIT's account, from 57,000 km of open roads to a 70.5% Level 2 fitment rate, show that vehicle data policy is no longer a niche concern. It is now an industrial policy for the largest car market in the world. The 2021 Provisions built a defensible foundation: minimization, consent and controlled export. The next round of standards should keep that foundation and make it predictable at scale. Rules that are clear, risk-tiered and aligned with international norms protect drivers and also let engineers keep improving a technology whose main benefit is safety.