A pharmaceutical firm in central Beijing needs to send clinical-trial data abroad. A year ago it could not use the fast negative-list path, because its office sat outside the free-trade zone. In 2026 that changed — and the change reaches thousands of companies that never thought of themselves as "free-trade" players.
The mechanism is the data-export negative list (数据出境负面清单). Born from the 2024 rule on promoting and regulating cross-border data flows (促进和规范数据跨境流动规定), it lets each free-trade zone (自由贸易试验区) write its own list of data that still needs a heavy compliance path, while everything outside the list can leave with far lighter obligations. In 2026, Beijing and Shanghai went further: they extended the list from the zone to the entire municipality.
Key takeaways
- The negative list (负面清单) is a carve-out: data outside the list can exit without the three heavy gates — security assessment, standard contract, or certification.
- Beijing extended its "two-zone" (两区) negative list citywide on 11 May 2026, covering 9 industries, 67 scenarios, and 612 data fields (字段) under a "1+9" design.
- Shanghai extended its list to the whole city on 25 April 2026, covering 4 industries (reinsurance, international shipping, trade, meteorology), 9 scenarios, 29 data subcategories, and 109 data items.
- Both expansions are local implementations already in force (生效实施); they build on the national 2024 framework that is itself effective.
- For foreign-invested enterprises and domestic firms going global, the practical effect is lower compliance cost and shorter processing time for routine cross-border data.
From zone to city
The original design deliberately limited the convenience to free-trade zones. That left a strange gap: a multinational's China headquarters in a central district, or a domestic firm's R&D center outside the zone, still faced the full three-path regime for the same kind of data. Beijing and Shanghai — both with very high concentrations of foreign-invested enterprises — pressed to close that gap.
Beijing's move, announced at a municipal press conference on 11 May 2026, reworks its 2024 free-trade-zone list into a citywide "two-zone" system. The "1+9" structure is one set of management measures plus nine sector lists spanning automobiles, medicine, civil aviation, retail, artificial intelligence (人工智能), medical devices, autonomous driving (智能网联汽车), trade logistics, and banking. The city says the package passed the national data-security coordination mechanism and Beijing's cyberspace committee, and was filed with the CAC and the National Data Administration (国家数据局).
Shanghai's expansion, reported on 25 April 2026, adds reinsurance, international shipping, trade, and meteorology to its earlier free-trade lists, reaching 109 data items. State media notes Shanghai accounts for roughly 40 percent of the country's completed data-export security assessments and standard-contract filings, backed by nearly 80,000 foreign-invested enterprises and about 1,700 regional headquarters and R&D centers.
Why it matters beyond paperwork
The headline number is convenience, but the structural point is bigger. By moving from "pilot inside the zone" to "governance across the whole city," Beijing and Shanghai signal that the negative-list approach is maturing from experiment to default. The supporting machinery is also getting lighter: Beijing says it cut enterprise filings to essentially "one form, one letter of commitment" (一表、一书), and it pairs the list with a one-stop service center and an online platform.
This sits inside a broader 2026 data-export ecosystem. The two-year review of the 2024 cross-border rule reported that the personal-information export certification (个人信息出境认证) system has gone live — three agencies certified, a professional-institution filing system online — giving companies a third, certification-based path alongside assessment and standard contracts. Negative lists and certification together point to a regime that wants to police the sensitive few while freeing the ordinary many.
Reading the stage correctly
It is worth being exact about status. The national 2024 rule that created the negative-list mechanism is in force (生效实施). The Beijing and Shanghai citywide expansions are local implementations that, by their 2026 announcement dates, are themselves in effect. None of this is a draft or a filed-but-unpassed proposal; these are operating policies. What remains a work in progress is the list's coverage — both cities describe a "mature one batch, publish one batch" (成熟一批发布一批) dynamic mechanism, so the field count will keep growing.
Honest limitations
This article draws on municipal press releases (Beijing, 11 May 2026), Shanghai state-media reporting (CNR, 25 April 2026), and the CCTV two-year review of the 2024 cross-border rule (23 March 2026). I verified the announcement dates, sector counts, and field counts against those sources. The "roughly 40 percent" Shanghai share and the ~80,000 / ~1,700 enterprise figures are reported by state media and treated as indicative, not independently audited. I did not read the full legal text of either city's negative list, so the precise field definitions are summarized. I have described the expansions as effective local implementations and have not implied any pending national law; the underlying 2024 framework's own status was not re-litigated here. Cross-province applicability of one city's list to another firm's needs follows a separate "one place innovates, many places apply" (一地创新、多地适用) principle that I have noted but not detailed.
What readers can do now
- If your firm moves data out of China, check whether your specific data field now sits outside a citywide negative list — Beijing and Shanghai cover medicine, AI, autos, finance, and more, which can remove the heaviest compliance gates.
- Map the three paths. Even with lists expanding, know when you still need security assessment, a standard contract, or certification — the list only helps for data outside it.
- Watch the field count grow. Both cities update lists in batches; subscribe to the municipal cyberspace-office notices so a new batch does not surprise your compliance calendar.