A compliance officer in Hangzhou opens a WeChat mini-program, types a question about brain recordings, and gets an answer drawn from a document the city published this week.
The document is careful and specific. It sorts brain data into tiers and names the kinds a company cannot put on its balance sheet without asking first.
There is a catch. The officials presenting it said plainly that it cannot compel anyone to do anything.
Key takeaways
- On 2 November 2026, the Hangzhou Justice Bureau (杭州市司法局) issued a compliance guide for the brain-computer interface (脑机接口) industry, alongside one for humanoid robots.
- It sorts brain data into five security tiers, states that raw brain data is sensitive personal information, and requires consent before a company treats that data as an asset.
- It splits devices into invasive, interventional and non-invasive, and draws the line between a medical device and a consumer product.
- Officials describe it as a guidance document with no compulsory legal effect. That is not a footnote; it is the whole design.
- A consultation draft was published with a comment deadline of 30 April 2026, so this week's version follows a review cycle.
What was actually published
At a press conference on 2 November, the Hangzhou Justice Bureau presented two sector guides — one for humanoid robots, one for brain-computer interfaces — and launched "Hangzhou Compliance Code" (杭州合规码), a free mini-program that collects the city's compliance documents and adds a self-assessment quiz.
The BCI guide is organised around three risk areas, as described by Xu Zhizhong (徐志忠), a deputy director of the bureau.
Ethics: human trials must clear ethics review, obtain informed consent, and complete national filings, step by step rather than in principle.
Data: brain data gets a five-level security classification, raw brain data is designated sensitive personal information, and any plan to capitalise it as a data asset must start with the user's consent.
Regulation: devices are sorted into invasive, interventional and non-invasive classes, with the boundary between medical device and consumer product made explicit.
The consent clause is the interesting one
"Data assetisation" (数据资产化) is the phrase to watch. It means putting a dataset on the balance sheet — valuing it, sometimes pledging it, sometimes selling access.
The guide does not ban it. It makes consent the precondition. For a hospital that has accumulated years of cortical recordings, or a consumer headset maker sitting on sleep EEG, that single sentence changes the order of operations: you cannot back-fill consent after the valuation.
Five tiers is a practical decision, not a philosophical one. A raw multi-channel cortical recording, a derived feature vector, and a summary statistic are not equally dangerous, and treating them identically would make the rule unusable. The guide separates them and applies the strictest handling to the raw layer.
Why a city is writing this
China has general law that already covers the territory: the Personal Information Protection Law (个人信息保护法), the Data Security Law (数据安全法), and the Medical Device Supervision and Administration Regulation (医疗器械监督管理条例). The Hangzhou guide cites all three. None of them was written with neural data in mind, which is why a municipal justice bureau could produce the most granular public text on the subject.
The city says it has now produced 68 sector compliance guides under a "one industry, one handbook" (一业一册) model, covering everything from live-stream commerce to cross-border e-commerce. Brain-computer interfaces and humanoid robots were added because both sit in the city's "296X" advanced manufacturing cluster plan.
A consultation version of the BCI guide was released for public comment with a deadline of 30 April 2026, and the published text follows that cycle.
What guidance can and cannot do
A guidance document has one real enforcement mechanism: it can be cited. When a dispute reaches a regulator or a court, a company that followed the city's own handbook has a defensible story about intent. A company that ignored it does not.
That is weaker than law, stronger than nothing, and it shifts the burden. A startup cannot afford a legal department to interpret three statutes; it can afford to read a document that tells it which records to keep and which forms to file.
Guidance that cannot be enforced can also be ignored, and "we followed the Hangzhou guide" is not a defence against a Personal Information Law violation. The guide's own framing concedes this: it is a risk-identification tool for companies, not a safe harbour.
The gap it leaves open
Three questions it does not resolve.
First, jurisdiction. A Shenzhen or Beijing company recording brain data from Hangzhou residents is not obviously bound by a Hangzhou municipal document, and neural data crosses provincial lines the moment it is uploaded.
Second, deletion. Consent can be withdrawn, but a trained decoder is not a database row. Removing a patient's raw recordings does not remove the model that learned from them, and nothing in the guidance addresses model-level erasure.
Third, the consumer boundary. Non-invasive headbands that read EEG for focus or sleep are sold as wellness products, not medical devices. The guide draws the line; it does not say who inspects the grey zone in between.
Honest limitations
The guide's contents are reported through the issuing bureau's own press conference, the transcript published by the municipal government, and coverage by China News Service; I have not read the full published text, so details beyond the three risk areas and the five-tier scheme may differ. The five-tier structure is confirmed in both the official transcript and a summary of the April consultation draft, but the tier definitions themselves are not public in the material I could verify. Officials' characterisation that the document has no compulsory legal effect is direct quotation, not my inference. Nothing here tells you how any company will actually behave, and I found no enforcement action or court case applying the guide.
What readers can do now
- If you handle neural data in China, read the guide against your consent records and retention schedule now — retrofitting consent after a valuation or a partnership is the failure mode it targets.
- If you build consumer neurotech, document where you sit on the medical device versus wellness line before a regulator draws it for you.
- If you invest, treat municipal guidance as a leading indicator of national rule-making, not as compliance. Cities publish first; statutes follow years later.