On 3 September 2026, the Cyberspace Administration of China (CAC), the National Development and Reform Commission, and the Ministry of Industry and Information Technology jointly published the Implementation Opinions on the Regulated Application and Innovative Development of Intelligent Agents — the first national-level document dedicated to the behavior of AI agents, rather than the models behind them.
The document's central move is a three-tier decision framework: some actions may be decided only by the user, some require explicit user authorization, and some may be left to autonomous agent decisions — with two guarantees underneath: the user always retains the right to know and the final say, and an agent may never act beyond the scope of its authorization. For brands operating AI in China — customer service agents, marketing automation, WeChat private-domain assistants — this is the point where "content compliance" stops being enough and "behavior compliance" begins.
1. A Rulebook for Agents, Not Models
Every previous regulation China published about generative AI governed content: what a model may generate, how synthetic content must be labeled, whether an AI may mimic a person. The Implementation Opinions shifts the target. It governs what an agent does — the tools it calls, the systems it touches, the actions it takes across platforms.
This is not a cosmetic change. When a model only outputs text, the risk surface is the text. When an assistant can call APIs, read a contact list, draft a contract, or place an order, the risk surface is the action itself. The regulators say so explicitly: agents' high autonomy and high permissions create three risk categories — privacy leakage, unauthorized operations, and loss of behavioral control.
The document is framed as the execution arm of the State Council's August 2025 Opinions on Deeply Implementing the "AI+" Action, which set quantified targets: new-generation intelligent terminals and agents reaching over 70% application penetration by 2027 and over 90% by 2030. Put differently: China expects agents to become infrastructure in the next four years, so it is writing the rulebook before the deployment wave arrives.
| What changed | Before (content-era rules) | Now (behavior-era rules) |
|---|---|---|
| Regulatory object | The model's output | The agent's actions |
| Core risk | Harmful or misleading content | Unauthorized, out-of-scope, or runaway actions |
| Main duty | Label, filter, disclose AI involvement | Define decision tiers, log every action, stay inside authorization |
| Enforcement posture | Post-publication review | Runtime governance during execution |
| Target horizon | (per measure) | 2027: >70% penetration; 2030: >90% (State Council "AI+" opinion) |
2. Why Now: Content Regulation Was Only the First Chapter
China's AI regulation in 2026 has moved through distinct phases, each building on the last. The Implementation Opinions is the third pillar of what is becoming a "content → persona → behavior" progression:
- Content phase: the Measures for Labelling AI-Generated Synthetic Content (effective 1 September 2025) and the interim rules for generative AI services require labeling and filing of what AI produces. By the end of June 2026, 988 generative-AI services were filed and 598 applications registered — the regulator's baseline is now visible.
- Persona phase: the Interim Measures for the Administration of AI Personification Interaction Services (published by the CAC and four other agencies) target anthropomorphic agents — the inducement and psychological-influence risks of AI that pretends to be human in conversation.
- Behavior phase (this document): once an agent can act across systems, the regulator stops looking at what it says and starts looking at what it does — the boundary of authorization, the trail it leaves, and who is accountable when it acts.
Why now, concretely? Because agents have crossed from "answering questions" to "executing tasks": phone assistants, terminal smart stewards, and cloud agents that can book flights, draft and sign documents, operate other software, or manage money. Regulators point at real incidents — frontier models escaping sandboxes during safety evaluation, high-permission terminal agents (the OpenClaw class) that can execute shell commands and reach across networks, turning from helpful assistant into a liability if compromised.
The message to industry: the risk the state worries about is no longer what an AI says; it is what an AI does on its own.
3. The Functional Definition: Five Capabilities Make You an Agent
Article 1 defines the regulated object functionally rather than by product category: an agent is "an intelligent system with autonomous perception, memory, decision-making, interaction, and execution capabilities — an important form of AI products and services."
That matters for compliance in two ways. First, scope does not depend on what you call the product — an "assistant," a "copilot," a "digital human," or a "bot" can all be captured if they exhibit the five capabilities. Second, the definition puts "decision" and "execution" at the center: the moment a system starts choosing on its own and calling tools to carry out those choices, its compliance risk shifts from content-output risk to behavior-execution risk.
For brands, the practical question is therefore not "are we an agent vendor?" but "does our AI touch decision and execution?" If the answer is yes — and for anyone running customer-service automation, private-domain assistants, dynamic pricing, or automated campaign tools it almost certainly is — the behavior framework below applies.
4. Three Decision Tiers and Two Guarantees
The heart of the document is a triage of decisions, so that autonomy is granted by category rather than by default:
| Decision tier | Meaning | Typical actions |
|---|---|---|
| User-only decision | The agent may never decide on its own | Signing contracts, consenting to privacy terms, spending money without confirmation |
| User-authorized decision | The agent may act but must obtain authorization first | Sending messages on the user's behalf, reading photos/contacts, placing orders |
| Agent-autonomous decision | The agent may act within a defined scope | Routine scheduling, monitoring, low-risk automation inside a declared boundary |
Two guarantees sit under all three tiers. First, the user has the right to know about autonomous decisions and retains the final decision. Second, whatever the agent executes may not exceed the scope of authorization. An assistant cannot quietly sign a contract for you, and it cannot touch data or systems outside the permission you granted.
The document also demands runtime governance — oversight during execution, not only after a problem surfaces. Which actions may auto-run, which require a second confirmation, and which data may be read-only versus writable must all be designed in advance. High-risk behaviors — cross-platform access and autonomous tool invocation — are specifically named as the red lines this document draws.
5. The Infrastructure Layer: Registration, Passports, Audit Trails
Beyond individual duties, the Opinions introduce a governance infrastructure that will define how agents are identified and audited at scale:
- Agent registration platform. The document proposes exploring a national registration platform providing digital identity management, discovery, and capability declarations for agents — a public directory of what agents exist, what they declare themselves able to do, and who operates them.
- Digital passports. Building on lifecycle identity registration, a "digital passport" concept is being explored to determine accountability in single- and multi-agent scenarios, solving the problem of tracing responsibility when autonomous behavior crosses organizational boundaries.
- Mandatory audit trails. Complementing these, the wider governance design requires retaining complete logs of every round of agent reasoning, decision, and execution — a shift from auditing only outputs to auditing the full decision-execution chain, so regulators and courts can trace what happened.
- Harness as a legal design requirement. Governance thinking is moving toward embedding controllability and algorithmic due-process into the agent's underlying architecture (the "harness" layer) rather than relying on post-hoc review — so that human oversight cannot be circumvented by the algorithm.
None of this is law yet — the Opinions are policy guidance, and the State Council's 2026 legislative work plan separately advances comprehensive AI legislation. But the direction is explicit: agent behavior will be identifiable, traceable, and auditable by design.
6. Where It Sits: China's 2026 Agent Governance Stack
Read together with what came before, the document completes a layered system that foreign brands should map as a whole:
| Layer | Instrument | What it governs |
|---|---|---|
| Ethical review | Ethical Review and Service Measures for AI Science & Technology (10 agencies) | Ethics review as a pre-launch gate |
| Persona | AI Personification Interaction Service Measures (CAC + 4 agencies) | Inducement and psychological influence of human-like agents |
| Behavior | Implementation Opinions on Intelligent Agents (CAC + NDRC + MIIT, published 3 Sep 2026) | Decision tiers, authorization scope, runtime governance |
| Labeling | AI-Generated Synthetic Content Labeling Measures (effective 1 Sep 2025) | Explicit and implicit labeling of AI output |
| Standards | AI Application Ethics & Safety Guidance 1.0 (national TC) | Unified technical yardstick for compliance judgment |
| Legislation | State Council 2026 legislative work plan | Path to a comprehensive AI law |
Watch for one more near-term milestone: the 2026 National Cybersecurity Awareness Week (14–20 September) is expected to release version 3.0 of the AI Security Governance Framework, which will add detail to this stack.
7. What Brands Running AI in China Must Do Now
For foreign brands, three things follow — and none of them are optional if you operate any AI that can act, not just generate:
Map your decision tiers. Inventory every AI touchpoint that can execute: customer-service agents that reply to users, WeChat assistants that send messages, campaign tools that adjust bids or push content. Classify each action into user-only / user-authorized / agent-autonomous, and be prepared to demonstrate that classification.
Design for authorization and audit, not for best-case. The regulator's expectation is runtime governance: second confirmations for consequential actions, read-only defaults for personal data, complete logs of what the agent was asked, decided, and did. Log retention and traceability are no longer an engineering nicety — they are the compliance artifact the regulator will ask for.
Treat this as the third chapter of a compliance story you already know. Brands that already handled the labeling measures (September 2025) and the personification rules (2026) have the playbook: this document extends the same logic from content to behavior. If your China stack routes through China-hosted infrastructure — the same logic behind moving landing pages to Jimuyu or keeping customer data on domestic platforms — the behavior layer now has to be built into the agent itself, not added around it.
Watch the near-term calendar. The framework 3.0 release during Cybersecurity Awareness Week (14–20 September) will likely sharpen definitions. Anything you deploy now should be built to absorb that update without re-architecture.
The Bottom Line
China has now written the rulebook for agents as infrastructure. The three-tier decision framework, the authorization guarantees, and the move to runtime governance tell brands one thing: in China, an AI that acts on its own is treated as a product with duties, not a feature with caveats. For brands whose China AI strategy still assumes that compliance ends at labeling and content review, the gap just widened.
The good news is the direction is legible. Define the tiers, log the actions, respect the authorization boundary, and audit continuously — and the same agent stack that drives efficiency can be the compliance asset that differentiates you.
Sources: CAC official Q&A on the Implementation Opinions on the Regulated Application and Innovative Development of Intelligent Agents (央广网, 3 Sep 2026); State Council Opinions on Deeply Implementing the "AI+" Action (Aug 2025); AI Personification Interaction Service Measures; Measures for Labelling AI-Generated Synthetic Content (effective 1 Sep 2025); registration figures (988 services filed / 598 applications registered, end-June 2026); industry analysis of China's agent governance stack and EU AI Act comparison (2026-09).