IT Application Innovation (ITAI): What China's Domestic Substitution Programme Means for Western Teams

I was recently setting up WeCom, Tencent's enterprise version of WeChat, for a new domestic startup I've been working with. The job was ordinary: internal chat, WeChat customer contact, company email. Buried in the email settings of the admin panel, I found a toggle I wasn't expecting: "IT Application Innovation (ITAI) Email".

The panel explained itself plainly. When enabled, it said, all member emails would be migrated to "an environment built on domestically produced infrastructure" to meet the enterprise's ITAI compliance requirements: domestic CPUs, domestic operating systems, domestic databases, domestic middleware. Below the toggle sat framed certificates attesting to compatibility with the Hygon CPU ecosystem. Anyone using a third-party mail client would be logged out and need to update their IMAP/POP settings. One click, and a company's entire email estate moves onto a Chinese technology stack.

I enabled it. The startup had no hard compliance requirement, but no reason to avoid it either, and nothing changed in features or performance. What stayed with me was the ease of it. A national technology policy, the kind usually discussed in ministerial documents, was sitting in a commercial SaaS admin panel as a checkbox. This article is about the programme behind that checkbox: what IT Application Innovation is, how it actually works, and what it means if you sell into or operate in China.

What is ITAI, and where did it come from?

IT Application Innovation is the English rendering of xinchuang (信创), short for 信息技术应用创新, "information technology application innovation". In plain terms, it is the Chinese state's programme to replace foreign technology in government and critical industries with domestically produced alternatives, from chips and operating systems through to databases and office software.

The stated aim is large: end China's reliance on suppliers such as Oracle and Microsoft, and build domestic champions in their place. Hold that as the programme's goal, not as an accomplished result. How far the installed base has actually moved is a harder question, and I'll come back to it.

The roots are older than the label. China's 2006 to 2020 national science and technology plan already funded megaprojects in core electronic components, high-end chips and basic software (the 2006 plan). The xinchuang label and the current procurement machinery came later. A December 2022 piece in The China Project traces the acceleration to the US pressure on Huawei from 2018 onwards and describes xinchuang as a successor formulation to Made in China 2025. That motivation rings true from here. Any government watching a flagship company get cut off from American suppliers would ask what else runs on foreign foundations, and the honest answer in 2018 was: most of it. Foreign vendors, notably IBM, Oracle and Dell EMC, had supplied the majority of China's enterprise IT since the 1990s, a market position the same piece puts at up to 80 per cent.

Worth stating plainly: there is a real security logic here, and there are real costs and lock-in risks on the other side. Both can be true. In scope terms, the programme spans four layers, as that piece usefully summarises them: IT infrastructure such as chips, servers and cloud computing; basic software, notably operating systems; application software; and information security. The WeCom toggle lives at the top of that stack, which is part of what makes it interesting. Policy had reached all the way up into an everyday SaaS product.

How the programme actually works: procurement lists, certificates, "2+8+N"

ITAI is not primarily a slogan. It is machinery, and the machinery is procurement.

In December 2023 the Ministry of Finance and the Ministry of Industry and Information Technology issued a family of government procurement requirement standards covering basic hardware and software: desktops, laptops, all-in-one PCs, workstations, general servers, operating systems and databases. The desktop standard, Cai Ku document 29 of 2023, says that party and government organs at township level and above, and the public institutions directly supporting them, must write one specific requirement into desktop procurement. The CPU and operating system must have passed the official "secure and reliable" evaluation (安全可靠测评). The operating system standard carries the same clause for the OS itself. Other organisations may include the requirement; the party-state must. That single clause is the programme's teeth.

Around the mandate sits a certification layer. Products pass third-party testing, vendors complete mutual compatibility verifications with each other, and the certificates become sales assets. Those framed Hygon certificates in the WeCom panel are exactly that layer, surfaced to an ordinary admin. WeCom's own help page for the feature says its email has passed third-party authoritative testing and completed mutual compatibility verification with domestic chip, operating system and database makers, and that enabling the toggle migrates every member mailbox automatically.

You will also meet the shorthand "2+8+N" for the rollout. One caveat before the definition: this is industry shorthand rather than a single official document, and the sector lists vary between sources. The version I can source (an industry explainer) reads it as:

• 2: the party and government sector, where substitution started around 2019;
• 8: critical industries, listed there as finance, telecoms, power, petroleum, aerospace, transport, healthcare and education, though other versions swap in energy or add the military to the leading pair;
• N: everyone else, where adoption is encouraged rather than mandated.

One discipline worth keeping when you read about this space: published targets and achieved penetration are different numbers, and reporting frequently blends them.

The domestic stack ITAI buys: Kylin OS, Loongson, OceanBase and the rest

What does the programme actually put in place? A business-level tour, leaving the deep technical comparisons to one side.

Operating systems. The flagship is Kylin OS, made by Kylinsoft. China's state-owned assets regulator describes Kylinsoft as a China Electronics Corporation company, the state electronics conglomerate, and the company's own history says it was formed in January 2020 by merging two earlier Linux vendors. Its desktop and server systems run across the domestic CPUs. The main rival is UnionTech's UOS, which ships desktop and server editions of its own (UnionTech). Both exist to fill the seat that Windows and, in the server room, foreign Linux distributions long occupied.

Chips. Four names cover most of what you will encounter. Loongson is the purist: in 2020 it launched its own instruction set, LoongArch, and every CPU it has designed since runs on it (Loongson's LoongArch page). Huawei's Kunpeng and Phytium sit in the Arm camp, built on Armv8 licences; Phytium's own site lists desktop, server and embedded lines. Hygon, the name on those WeCom certificates, is in the x86 camp. The camp breakdown, including which vendors hold which architecture licences, comes from the industry explainer cited above.

Databases. The headline name is OceanBase, a distributed database that Ant Group started building in 2010 and spun off as a separate company in 2024 (South China Morning Post). Ant is headquartered here in Hangzhou, in Xihu District (Ant Group profile), which makes OceanBase very nearly a neighbour. I visited Ant's campus about two years ago on a trip with Zhejiang University.

Alongside OceanBase sit Dameng, a database company that grew out of a Wuhan university, and Huawei's GaussDB line. I have not verified current capability or market-share figures for any of them against primary sources, so I am deliberately not quoting any.

What this means for Western vendors and teams

If you sell into China

Assume that government-adjacent customers, and increasingly the regulated industries in the "8", are running or procuring the domestic stack. Compatibility with Kylin or UOS, with domestic CPUs, and with OceanBase-class databases is becoming a procurement requirement in those sectors, not a nice-to-have. In practice that means paying for the certification layer described above: third-party testing and mutual compatibility verification with the domestic vendors whose logos your customers already trust.

The sharper observation is the WeCom toggle itself. ITAI compliance is being productised inside mainstream commercial SaaS, with the certificates displayed as a selling point. If Tencent does this for email, expect Chinese platforms and partners to productise compliance the same way across the stack. The question Western vendors will increasingly hear is not "are you cheaper" but "which stack do you run on".

If you operate in China

My own experience was benign: one toggle, no functional change, a note that third-party mail clients need reconfiguration. For a company with no hard compliance requirement, that is the realistic texture of the programme today: available, easy, largely invisible. I would not overstate the reach. I have seen no evidence that purely private commercial procurement is mandated onto the domestic stack, and the ministry standards themselves make the hard requirement optional outside the party-state. The touchpoints that matter are the ones that brush regulated customers, state-linked partners, or official data and compliance obligations.

The AI chapter of the same story

If any of this feels familiar from the AI side of China's technology world, it should. Domestic AI compute and the open-weight model ecosystem are the same substitution logic applied one layer up the stack. I have written about China's open-weight AI ecosystem separately, and about whether any of this adds up to China winning the AI race. I won't re-argue those pieces here; the point is that the email toggle and the model weights are chapters of one story, not two.

What I don't know, and what I'm watching

Candidly, quite a lot.

The biggest gap is between the programme's aim and installed reality. Ending reliance on Oracle and Microsoft is the goal; I have found no dated, primary evidence quantifying how much of the legacy estate actually remains, so I am treating the outcome as an open question rather than reporting a number I cannot stand behind. Performance parity is similarly unverified by me: domestic vendors claim it, procurement mandates presume it, and independent public benchmarks are thin.

I also don't know how far substitution will travel into genuinely private procurement, where the mandates do not reach. And a small curiosity from our own keyword research: US English search interest in "Kylin OS" rose to roughly three times its 2026 baseline in August before settling back. Whether that reflects a real event, I cannot say; I have not found corroboration, so I am noting it as an observation, not a fact.

The decision fork for a Western team is therefore not "is the domestic stack good enough yet". It is: which of your Chinese customers and partners are inside the mandated perimeter, and what would compatibility cost you if that perimeter moved?

Closing note

A checkbox in an admin panel turned out to be a useful teacher. The programme behind it is real, funded, and enforced through procurement rather than proclamation, and its ambition to retire Oracle and Microsoft from Chinese government and critical infrastructure is exactly that: an ambition.

If your team sells into or operates in China and wants a practitioner's read on your exposure, get in touch.