China has published what NYU Shanghai RITS describes as its first national policy framework dedicated to AI agents, and it sets out how regulators expect agent decision rights, identity, supply chains and high-risk deployments to be governed. The Implementation Opinions on the Standardised Application and Innovative Development of Intelligent Agents (智能体规范应用与创新发展实施意见), published by the Cyberspace Administration of China (CAC) on 8 May 2026 and coordinated with the National Development and Reform Commission (NDRC) and the Ministry of Industry and Information Technology (MIIT), contain 38 numbered measures. Most of them promote adoption, but measures 3 to 14 set a security baseline that will shape standards, filing and testing for agents in sensitive sectors. This guide explains what the document says, what is and is not binding, how it fits with China's existing AI rules, and what security and compliance teams running agents in mainland China should do now. Measure numbers and quotations follow the Chinese text published on the CAC website; English renderings are our own.
Source note: measure content follows the Chinese text published by the Cyberspace Administration of China on 8 May 2026 (English renderings are our own); the Opinions are a policy document, and binding duties come from the separate instruments listed below. Confirm against the official text before relying on it.
Key takeaways
- It is a policy document, not a penalty regime. The Opinions set direction and tasks for regulators and industry; they contain no fines and no effective date, and enforcement still runs through existing laws such as the Cybersecurity Law and the CAC's algorithm and generative AI rules.
- Users keep the final say. Measure 6 requires developers to define which decisions only users may make, which need user authorisation and which an agent may take alone, and states that users hold the right to be informed and the final decision; agents must not exceed their authorised scope.
- Agent identity is on the agenda. Measure 4 asks for exploration of an agent registry covering digital identity, discovery, capability declaration and compliance certification, plus research on agent identification and trusted interconnection.
- Sensitive sectors get filing, testing and recall. Measure 11 introduces tiered governance by scenario and impact, with filing (备案), testing and recall of problem products for agents in sensitive and key sectors, and lighter self-testing and self-discipline elsewhere.
- Standards will carry the detail. Measure 3 calls for a standards system covering interfaces, data exchange, evaluation, security and certification, promotes an Agent Interconnection Protocol (AIP) and allows mandatory standards in medicine, transport, media and public security.
What the Opinions are and how they are structured
The preamble defines an intelligent agent as an intelligent system with autonomous perception, memory, decision-making, interaction and execution capabilities (具备自主感知、记忆、决策、交互与执行能力的智能系统), and places the document under the State Council's "AI Plus" action opinions. It is organised in six parts.
| Part | Subject | Measures | What it does |
|---|---|---|---|
| I | Basic principles | Unnumbered | Four principles: safe and controllable, orderly and compliant, innovation-driven, application-led; safety, reliability and trustworthiness are called the baseline requirement for development |
| II | Building foundations | 1 to 4 | Core technology and toolchains, a standards system and protocols, an agent registry and trusted interconnection |
| III | Holding the security baseline | 5 to 14 | Product rules, decision rights, behaviour control, built-in security, supply chain, derived risks, tiered governance, compliance services, self-discipline and a credit system |
| IV | Application-led development | 15 to 33 | 19 priority application scenarios across research, industry, consumption, livelihoods and social governance |
| V | Innovation ecosystem | 34 to 38 | Open source, collaboration platforms, agent app stores, open pilot scenarios and international outreach |
| VI | Safeguards | Unnumbered | CAC, NDRC and MIIT coordinate; an agent development evaluation index with monitoring and rolling adjustment |
Legal status and how it fits with binding rules
An "implementation opinion" (实施意见) is a policy instrument: it tells ministries, local governments, standards bodies and industry what to build, and signals how regulators will read existing law. The text published on 8 May 2026 sets no effective date, no deadlines or numeric targets, and no penalties. Some commentary has described the Opinions as enforceable from 15 July 2026; that is the effective date of the separate Anthropomorphic AI Interaction Services Measures, not of this document. Treat the Opinions as strong regulatory direction, and the following instruments as the binding layer that already applies to many agents.
| Instrument | Status | Why it matters for agents |
|---|---|---|
| Cybersecurity Law, as amended | Amendment adopted 28 October 2025, in force 1 January 2026 | Network security duties, higher fines and explicit reference to AI; the penalty backstop for agent operators |
| Interim Measures for Generative AI Services | In force since 15 August 2023 | Public-facing agents built on generative models need content safety, data and filing controls |
| Algorithmic Recommendation Provisions | In force since 1 March 2022 | Algorithm filing for services with public opinion attributes or social mobilisation capability |
| Measures for Labelling AI-Generated Synthetic Content and GB 45438-2025 | In force since 1 September 2025 | Agent outputs that publish text, images, audio or video must carry explicit and implicit labels |
| Interim Measures for Anthropomorphic AI Interaction Services | In force since 15 July 2026 | Agents offering continuous emotional interaction face security assessment, minors and exit rules |
See the China Generative AI Measures and AI Labelling Rules Guide, the China Anthropomorphic AI Interaction Services Measures Guide and the China Cybersecurity Law Guide.
The security baseline, measure by measure
| Measure | Requirement (summary) | Practical control |
|---|---|---|
| 5 Laws, ethics, values | Research agent-specific law and ethics; prevent agents spreading harmful values, exploiting users through algorithms, or fostering dependence in minors and older people | Ethics review for agent launches; dependence and manipulation tests in red-team plans |
| 6 Decision rights | Define user-only decisions, decisions needing user authorisation, and autonomous decisions; users have the right to know and the final decision (知情权和最终决策权); no action beyond authorised scope | A per-agent decision matrix enforced in the tool layer, with scoped credentials and explicit approval steps |
| 7 Behaviour control | Embedded rules and behavioural fencing in public, private and specialised spaces; explore blockchain-based mechanisms so behaviour in important scenarios is verifiable and traceable | Policy enforcement points between agent and tools; tamper-evident action logs |
| 8 Built-in security | Safeguards for data, personal information, cryptography, attack detection, permissions and behaviour control; address data poisoning, privacy leaks, algorithm tampering, vulnerabilities and loss of control; build agent security testing and evaluation | Pre-release agent security testing; memory and retrieval poisoning controls; least privilege |
| 9 Supply chain | Full lifecycle security rules for model access, API calls and extension tools; explore supply chain information sharing and early warning | Inventory of models, plugins and tool servers; signed and approved tool catalogue |
| 10 Derived risks | Continuous risk identification, warning and intervention; strengthen human-machine joint review (人机协同审核) and interception; prevent use for automated attacks, privacy violations, disinformation and fraud | Runtime monitoring, abuse detection, human review queues for flagged actions |
| 11 Tiered governance | Classify agents by scenario and impact; in sensitive and key sectors the CAC and sector regulators define open scenarios and apply filing, testing and recall of problem products; low-risk areas use self-testing, reporting, platform management and self-discipline | Risk tiering of each agent; sector-specific filing plan |
| 12 Compliance services | Expand risk monitoring, testing, consulting and certification; third-party evaluation and mutual recognition; publish a maturity report | Budget for third-party evaluation in high-impact sectors |
| 13 and 14 Self-discipline and credit | Industry rules on functional compliance, algorithm governance, IP and fair competition; platform user agreements and privacy policies; voluntary credit evaluation covering misuse, inducement to consume, false advertising and concealed defects | Clear agent terms of use and disclosure of agent capabilities and limits |
Agent identity, registry and interconnection
Measures 3 and 4 describe national infrastructure for agent identity. Measure 4 asks for exploration of an agent registry that provides digital identity, discovery, capability declaration and compliance certification, and for research on agent identification, trusted interconnection, compliant payment, security and conflict resolution, using IPv6 for end-to-end communication. Measure 3 promotes the Agent Interconnection Protocol (AIP) and prioritises interface standards for software, services and hardware. Neither measure creates a registration duty today: registration, as distinct from sector filing under measure 11, is something to explore.
For practitioners this points in a clear direction. Each agent will be expected to have a distinct, verifiable identity rather than borrowing a human user's session or a shared service account, a declared capability set that can be checked against its authorisations, and a record that ties actions back to that identity. Build that now, in a way that can later map to a national registry or protocol. See the Agent Identity and Access Guide, the AI agent registry guide and the Agent Identity Standards Tracker.
Turning decision rights into controls
Measure 6 is the most directly actionable provision. A workable implementation separates three classes of action and enforces them outside the model, so a prompt injection cannot move an action between classes.
| Decision class (measure 6) | Examples | Enforcement | Evidence |
|---|---|---|---|
| Reserved to the user | Payments above a threshold, signing contracts, deleting accounts, sending messages in the user's name to new recipients | Agent has no credential that can perform the action; it prepares, the user executes | User action log separate from agent log |
| Requires user authorisation | Booking within a budget, changing settings, sharing personal information with a third party | Per-action approval or a time-bound, scoped grant with limits | Approval record linked to the agent action ID |
| Agent may decide autonomously | Search, summarise, draft, read-only lookups within granted data | Least privilege scopes and rate limits; user notified of autonomous decisions | Action log with identity, tool, input and outcome |
See the AI Agent Action Approvals and Spending Limits Guide and the AI Agent Authorisation Guide.
Priority application scenarios
Part IV lists 19 scenarios that regulators want to see agents deployed in. They matter for compliance because measure 3 names medicine, transport, media and public security as candidates for mandatory standards, and measure 11 applies filing, testing and recall in sensitive and key sectors.
| Group | Scenarios (measure numbers) | Likely scrutiny |
|---|---|---|
| Scientific research | Scientific exploration (15), R&D assistance including software development agents (16) | Supply chain and code security |
| Industry | Smart manufacturing (17), energy and resources including power grids (18), transport (19), agriculture (20), finance risk control and anti-money laundering (21) | High: sector regulators, possible mandatory standards in transport |
| Consumption | Consumer terminals across phones, PCs, cars and wearables (22), culture and tourism (23), commerce and customer service (24) | Decision rights, payments, personal information |
| Livelihoods | Education (25), healthcare (26), human resources (27), information services including emotional support (28) | High: medicine named for mandatory standards; content rules for information services |
| Social governance | Government services (29), judicial services (30), public safety (31), urban governance (32), public procurement (33) | High: public security named for mandatory standards |
What to do now: a phased approach
- Inventory agents in scope. List every agent that serves users in mainland China or acts on systems there, with owner, model, tools, data and the scenario it falls under.
- Tier each agent. Classify by scenario and impact in the spirit of measure 11; flag agents in healthcare, transport, media, public safety, finance and government work as candidates for filing and testing.
- Map binding rules first. For each agent, record which in-force instruments already apply: generative AI filing, labelling, algorithm filing, anthropomorphic measures, personal information rules.
- Implement the decision matrix. Write the measure 6 decision classes per agent and enforce them in the tool and credential layer; pilot on one agent, test with injected instructions, then roll out.
- Give each agent its own identity. Issue a distinct workload identity and scoped, short-lived credentials per agent; record declared capabilities; keep a revocation path that works in minutes.
- Secure the supply chain. Approve models, plugins and tool servers through one catalogue, and monitor for changes, in line with measure 9.
- Test before release. Run agent security tests covering prompt injection, data poisoning, privacy leakage and loss of control (measure 8), and keep results for any later filing or third-party evaluation.
- Watch for standards. Track national standards and protocol work (AIP, interface and certification standards) and plan to re-assess when a mandatory standard is issued for your sector.
Rollback is simple to design and often forgotten: every agent needs a kill switch that revokes its credentials and stops its tool access without redeploying the application. See the AI Agent Kill Switch and Containment Guide.
Decision guidance for multinationals
- Global programme or China-specific: the measure 6 decision matrix, per-agent identity and supply chain controls match what the EU AI Act and agent security frameworks already push towards, so build them once globally; keep filing, labelling and content controls China-specific.
- Small deployments: an internal productivity agent with no public users in China mainly needs good identity, logging and least privilege; public-facing agents bring filing and content duties.
- Large or sensitive deployments: plan for third-party evaluation and possible recall procedures, and engage early with the sector regulator rather than waiting for a mandatory standard.
Detection and measurement
- Inventory coverage: share of agents in China with a named owner, tier and mapped instruments.
- Decision-matrix enforcement: share of agents whose reserved and authorised actions are enforced outside the model, and the number of blocked out-of-scope actions per month.
- Identity hygiene: share of agents using their own identity and credentials with a lifetime under 24 hours.
- Traceability: share of agent actions that can be traced to agent identity, user and approval record.
- Revocation time: measured time from kill switch to loss of all tool access in tests.
Framework mapping
| Opinions measure | NIST SP 800-53 Rev 5 | NIST CSF 2.0 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|
| 6 Decision rights | AC-3, AC-6 | PR.AA-05 | A.5.15, A.8.2 |
| 4 Agent identity | IA-9, AC-2 | PR.AA-01 | A.5.16 |
| 7 Traceability | AU-2, AU-12 | DE.CM-09 | A.8.15 |
| 8 Built-in security and testing | SA-11, SI-4 | PR.PS-06 | A.8.29 |
| 9 Supply chain | SR-3, CM-8 | GV.SC-05, ID.AM-02 | A.5.19, A.5.21 |
| 11 Tiered governance | RA-3 | GV.OC-03, ID.RA-05 | A.5.31 |
Common failure patterns
- Treating the Opinions as binding law, or as irrelevant: both are wrong; the binding duties come from existing measures, but the Opinions show where filing, testing and standards are heading.
- Enforcing decision rights in the prompt: a system prompt that says "ask before paying" is not a control; the credential must not allow payment without approval.
- Agents borrowing human sessions: agents that act with a user's full token cannot show they stayed within an authorised scope, and their actions cannot be told apart from the user's.
- Unmanaged tool supply chain: plugins and tool servers added by developers without review, against measure 9.
- No rollback: no tested way to stop an agent or recall a faulty version in a sensitive sector.
Practitioner checklist
- Inventory every agent serving users or systems in mainland China, with owner, scenario and tier.
- Record which in-force instruments apply to each agent: generative AI, labelling, algorithm filing, anthropomorphic measures.
- Write a measure 6 decision matrix per agent and enforce it in the credential and tool layer.
- Give each agent a distinct identity and short-lived, scoped credentials.
- Log agent actions with identity, user, tool and approval reference in tamper-evident storage.
- Approve models, plugins and tool servers through one catalogue.
- Run and keep agent security test results before each release.
- Test the kill switch and recall procedure for agents in sensitive sectors.
- Track national agent standards and the AIP protocol quarterly.
Standards and references
- Cyberspace Administration of China: Implementation Opinions on the Standardised Application and Innovative Development of Intelligent Agents (Chinese)
- NYU Shanghai RITS: China issues first national policy framework dedicated to AI agents
- University of Hong Kong DPO: Chinese AI agents guidelines
- Cloud Security Alliance: China's AI agent regulation research note
- China Law Translate: Interim Measures for the Management of Generative AI Services (translation)
- China Law Translate: Provisions on the Management of Algorithmic Recommendations (translation)
- Cyberspace Administration of China: Anthropomorphic AI Interaction Services Measures announcement (Chinese)
This guide summarises China's Implementation Opinions on intelligent agents as published on 8 May 2026 and checked on 11 November 2026, and is not legal advice. Related NHI Mgmt Group resources: Global AI Regulation Map · Agentic AI Compliance Guide · Agentic AI Identity Guide · AI Agent Kill Switch and Containment Guide · AI Kill Switch Act Guide