China’s largest e‑commerce platforms, JD.com and Tmall (Alibaba), have announced major updates to their product certification requirements for online sellers. Effective October 1, 2026, all smart home products listed on these platforms must obtain CQC certification under the expanded 2026 scope – including mandatory cybersecurity and interoperability testing. This policy shift directly affects thousands of domestic and international brands selling through JD.com and Tmall. Understanding these new CQC requirements for online sellers is essential to avoid delisting, financial penalties, and loss of market access.
1. Which Products Are Affected by the New CQC Mandate?
The JD.com and Tmall mandate applies to all products listed in the “smart home” category. Based on the official notices issued in January 2026, affected product categories include:
- Smart door locks (fingerprint, facial recognition, Bluetooth-enabled)
- Smart sensors (motion, temperature/humidity, door/window contact, smoke/gas)
- IP cameras (indoor and outdoor, including pan-tilt-zoom models)
- Smart lighting systems (controllable LED bulbs, strips, luminaires with wireless connectivity)
- Smart home hubs/gateways (devices that aggregate and control multiple smart endpoints)
- Smart plugs and smart switches (already partially covered, now with stricter cybersecurity add-ons)
- Smart thermostats and HVAC controllers
Products that do not have any wireless connectivity (e.g., traditional non‑smart door locks, basic LED bulbs without remote control) are not affected. However, any product marketed as “smart,” “connected,” or “app‑controlled” falls under the scope – even if the connectivity is optional. Sellers who are unsure whether their products are affected should consult the platform’s category manager or a China compliance specialist.
2. Specific Certification Requirements: What Sellers Must Provide
For affected products, JD.com and Tmall now require sellers to upload one of the following documents to their product listing backend before October 1, 2026:
- Full CQC Smart Home Certification (certificate code 001048) – including cybersecurity testing (CQC 1336-2026) and, if applicable, interoperability testing (CQC 1337-2026). This is the gold standard and is valid for 5 years.
- CQC Cybersecurity Test Report only – a less expensive option that covers only the mandatory security requirements (no interoperability or full safety). However, products with only the test report may be marked as “basic compliance” and could be deprioritized in search rankings.
- Provincial-level equivalent certification – some provincial quality supervision bureaus offer similar certification. However, JD.com and Tmall strongly prefer national CQC certification, and products with provincial certificates may face additional random checks.
Additionally, sellers must provide a valid China Responsible Person (RP) or a local legal entity (WFOE) to act as the certificate holder. Foreign brands without a China presence must appoint a third‑party agent to hold the CQC certificate on their behalf.
3. Enforcement Timeline and Transition Period
The two platforms have published a staggered enforcement schedule:
- April 1, 2026: Notification period – JD.com and Tmall began notifying affected sellers via official messages and email. Sellers were encouraged to start the CQC application process early.
- July 1, 2026: Soft enforcement – products without at least a pending CQC application (proof of submission) will start receiving lower search rankings and may be hidden from “smart home” category browsing.
- October 1, 2026: Full enforcement – any product listing without a valid CQC certificate or test report uploaded will be automatically delisted. Sellers may appeal within 15 days by providing proof of ongoing application (submission receipt), but only one 30‑day extension is available.
- December 31, 2026: Final deadline for all products to have full CQC certification (not just test report). After this date, even products with pending applications will be delisted if the certificate is not issued.
Foreign brands with large product portfolios should prioritize high‑volume SKUs first. The platforms have indicated that enforcement will be systematic and automated – there will be no manual exceptions for “small sellers” or “new brands.”
4. Penalties for Non-Compliance
Sellers who fail to comply with the new CQC requirements face a range of penalties:
- Product delisting: The listing is removed from the platform. The seller can re‑list only after uploading the required certification.
- Financial penalties: JD.com imposes a fine of RMB 10,000 per non‑compliant SKU for the first offense, doubling for repeat violations. Tmall deducts the seller’s deposit (starting at RMB 5,000 per SKU).
- Search ranking demotion: Even during the soft enforcement period, products without at least a test report will appear on page 10 or later for most search queries, effectively eliminating visibility.
- Store suspension: Sellers with three or more non‑compliant SKUs after the October deadline may have their entire store suspended for 30 days, with a second offense leading to permanent store closure.
- Blacklisting: Repeated violations may lead to the seller being blacklisted from both JD.com and the Alibaba ecosystem (Tmall, Taobao, 1688) – a potentially fatal blow for brands dependent on Chinese e‑commerce.
Given these severe consequences, major brands have already started the CQC certification process. Smaller sellers are scrambling to understand the requirements – many are partnering with third‑party compliance agencies to fast‑track applications.
5. Why JD.com and Tmall Are Imposing CQC Mandates
Several factors drove this policy change:
- Cybersecurity incidents: In 2024-2025, multiple reports emerged of compromised smart home devices (mainly IP cameras and smart locks) being used for botnet attacks and privacy violations. The platforms faced reputational damage and regulatory pressure.
- New GB standards: The 2026 expansion of CQC’s smart home scope (discussed in previous articles) provided a ready‑made certification framework. The platforms chose to adopt it rather than develop their own.
- Government directive: The Ministry of Industry and Information Technology (MIIT) and the State Administration for Market Regulation (SAMR) issued a joint guidance in late 2025 encouraging e‑commerce platforms to enforce higher security standards for IoT products.
- Consumer demand: Surveys show that Chinese consumers are increasingly concerned about smart device security. Certified products command higher trust and, consequently, higher conversion rates.
For foreign brands, this shift means that CQC certification is no longer just a voluntary differentiator – it is a requirement for accessing China’s largest online sales channels. Brands that do not comply will effectively be frozen out of the e‑commerce market.
6. Step‑by‑Step Compliance Guide for Online Sellers
To meet the JD.com and Tmall CQC requirements before the October deadline, sellers should take the following actions:
- Inventory affected SKUs: Review your product catalog on both platforms. Identify which items fall into the smart home categories listed above. Create a spreadsheet with model numbers, current certification status (if any), and priority based on sales volume.
- Engage a CQC‑accredited lab and agent: If you do not have a China office, appoint a local Responsible Person (RP) who can act as the certificate holder. Many compliance agencies offer end‑to‑end CQC certification services, including document translation, sample submission, and ongoing maintenance.
- Perform gap analysis and testing: Submit samples to an accredited lab for cybersecurity (CQC 1336-2026) and, if needed, interoperability (CQC 1337-2026) and updated safety/EMC tests. Budget 6-8 weeks for testing.
- Obtain certificate or test report: Once testing is passed, the lab submits the report to CQC for certificate issuance (2-3 weeks). For time‑sensitive products, sellers can request only the test report first (which can be uploaded as interim proof) while the full certificate is being processed.
- Upload documentation to platform backend: For each SKU, upload the CQC certificate or test report along with the certificate holder’s business license (if the holder is the RP). The platforms have integrated with CQC’s database for automatic verification – ensure the certificate number is correctly entered.
- Maintain annual compliance: CQC certificates require annual follow‑up inspections (remotely allowed) and random sample testing. Sellers must keep records and promptly address any non‑conformities to avoid certificate suspension, which would trigger platform delisting.
For sellers with large portfolios (more than 50 SKUs), the platforms recommend using CQC’s “family model” certification, which allows up to five similar models to be certified under one application, reducing costs and lead times by up to 50%.
7. Cost and Lead Time Considerations
Obtaining CQC certification for smart home products involves significant investment, but the cost of non‑compliance (lost sales, fines, store suspension) is far higher. Typical costs:
- Full CQC certification (cybersecurity + safety + optional interoperability): $12,000 – $25,000 per product family (1-5 models).
- Cybersecurity test report only: $4,000 – $8,000 per product family. This option meets the minimum platform requirement but does not include interoperability or long‑term certificate maintenance.
- China Responsible Person / agent fees: $2,000 – $5,000 per year, depending on the number of certificates.
- Translation and legal documentation: $1,500 – $3,000 per product family for certified Chinese translations of technical files and privacy policies.
- Annual maintenance (follow‑up inspections, random testing): $1,000 – $3,000 per year per product family.
Lead times: Expect 10-14 weeks from initial gap analysis to full certificate issuance. For the test report only, 6-8 weeks. Sellers who apply after August 2026 may face lab capacity shortages and should be prepared to pay expedite fees (20-30% premium).
Summary: JD.com and Tmall have updated their CQC requirements for online sellers, mandating cybersecurity testing and, for many products, full CQC smart home certification by October 1, 2026. Foreign brands without a China presence must act quickly – engage an agent, perform gap testing, and upload the required documentation. Non‑compliance leads to delisting, fines, and potential store suspension. While certification costs are significant, they are a necessary investment to retain access to China’s $600 billion e‑commerce market. Start your compliance process now – the October deadline is closer than it seems.