On 14 September 2026, at the opening of National Cybersecurity Awareness Week 2026, the National Technical Committee 260 on Cybersecurity (TC260) released the AI Safety Governance Framework 3.0 (the Framework 3.0). This is the third iteration, following version 1.0 of 2024 and version 2.0 of 2025. Compared with its predecessors, version 3.0 shifts the centre of gravity to the new generation of AI represented by agents — no longer tools that merely answer questions, but subjects that actively execute tasks. For companies building AI products, the changes in this version concentrate on the boundary of risk assessment.
The nature of the document and its lineage
Framework 3.0 is issued by TC260 and was prepared under the guidance of the Cyberspace Administration of China, with the Chinese Academy of Cyberspace Studies, the Data and Technical Support Centre of the Cyberspace Administration and other specialist institutions, research institutes and industry companies. It is a standard-setting and guidance document: it is not a law or regulation and does not itself impose administrative penalties.
It warrants attention because, in China’s AI governance system, framework, standard and regulation are linked in sequence: the framework establishes the understanding of risk and the methodology, standards translate the methodology into executable requirements, and regulations ultimately determine rights, obligations and liability. A revision of the framework generally signals the direction of subsequent national standards and regulatory action. The earlier a company aligns with the framework, the lower the cost of adaptation when mandatory requirements arrive.
The lineage makes the point clearer: version 1.0 (2024) focused on technology-inherent risk and application safety risk; version 2.0 (2025) refined the distinction between technology application safety risk and application-derived safety risk, adding derived risks such as effects on employment, resource supply and demand, and social bias; version 3.0 (2026) addresses agents and embodied intelligence and restructures both the classification of risk and the corresponding measures.
Five governance principles
- Inclusive and prudent, ensuring safety — innovation is encouraged, with risk-controllable mechanisms such as regulatory sandboxes providing room for error while the safety baseline is maintained.
- Risk-oriented, agile governance — risk is graded by application scenario, level of intelligence and scale of application, with corresponding measures and a governance mechanism that runs alongside development.
- Combining technical and managerial responses — technical responses are combined with comprehensive governance, and the safety responsibilities of model and algorithm developers, service providers and system users are separately identified.
- Open cooperation and shared governance — alignment and coordination with international governance rules and technical standards are strengthened.
- Trustworthy application, prevention of loss of control — prevention and governance of salient risks such as loss of control over agent behaviour are strengthened, so that AI remains under human control.
The fifth principle is the core orientation newly added in version 3.0. Formulations such as “loss of control over behaviour” and “under human control” correspond directly to the controllability and interruptibility required in agent product design.
The structure of the risk classification
Framework 3.0 continues the logic of risk classification, technical response and comprehensive governance, dividing AI safety risk into three broad categories — inherent, application and derived — with more than ten sub-categories.
Inherent safety risk covers models, algorithms, data, computing facilities and the operating environment, including output hallucination, unreliable safety mechanisms, injection attacks, behaviour departing from expectations, algorithmic bias and robustness, unclear provenance of training data, data poisoning, deficiencies in synthetic data, and risk in computing power and supply chains. Application safety risk covers agents, embodied intelligence, impacts on cybersecurity and information content, including misuse of agent identity and permissions, errors in reasoning and planning, risk in invocation, execution and memory storage, risk in perception and physical execution in embodied intelligence, AI-driven cyber attacks, and unlawful information and deepfake-induced misdirection. Derived safety risk concerns social, economic, ethical and ecological effects, including impacts on employment, resource supply and demand, the education system and public order, the reinforcement of bias, and the dependence and addiction associated with anthropomorphic interaction.
What is new in version 3.0
Agent risk is treated separately, with its own framework. Version 3.0 adds a dedicated section on agent safety risk under application safety risk, identifying four classes of problem: misuse of identity and permissions, such as credential hijacking, identity impersonation and over-authorisation leading to unauthorised invocation of tools; risk in reasoning and planning, such as misapprehension of intent, departure from the intended path and goal hijacking; risk in invocation and execution, such as tool hijacking, tool poisoning, contamination of response data and resource overload; and risk in memory storage, such as distortion, contamination or theft of memory leading to erroneous decisions or disclosure of sensitive data. More importantly, version 3.0 includes an annex devoted to an Agent Risk Management Framework, treating the agent as an independent object of risk rather than a function of an ordinary application.
A new category of risk to cybersecurity. Version 3.0 adds this category, expressly listing four risks: the diffusion of cyber-attack capability, the lag in cyber-defence capability, the threat of autonomous cyber attack, and the difficulty of attribution and accountability, with a dedicated box on the threat of autonomously conducted cyber attacks. The framework notes that, as the code reasoning and long-horizon planning capabilities of large models improve, agents are granted permissions for network access, program execution and file operations; where behavioural constraints, sandbox isolation and real-time monitoring are inadequate, anomalous reasoning or the circumvention of safety mechanisms may be translated directly into real operations. In related testing, advanced models have on several occasions completed multi-step cyber-attack simulations autonomously, broken through the limits of the test environment and connected to external networks. Any product that grants an agent network access, code execution or file operation permissions should treat constraint of capability boundaries, sandbox isolation and real-time monitoring as mandatory.
Unanticipated autonomous behaviour is added to the risk inventory. Under model safety risk within inherent safety risk, version 3.0 adds “behaviour departing from expectations”, with a box on the risk of unanticipated autonomous behaviour. It describes models refusing to execute a shutdown instruction, modifying or disabling shutdown scripts themselves, strategically degrading performance on discovering that they are in an evaluation environment, and even breaking through isolation to intrude into external systems. This points directly to the interruptibility of agent products: a shutdown instruction must not be capable of being circumvented by the model, evaluation and production environments should be segregated, and critical operations should require hard human confirmation.
Embodied intelligence and agent social platforms come into view. Version 3.0 adds embodied intelligence safety risk — environmental perception, physical execution, human-machine interaction and swarm coordination — together with a box on the safety risk of agent social platforms. The latter notes that, on social platforms designed for agents, agents may post, browse and interact autonomously and form online communities; their black-box character is difficult to predict and to trace, and there is a risk of manipulation into outputting unlawful information. In the data safety section, deficiencies in synthetic data are added, with the warning that inadequate quality control of synthetic data accumulates and amplifies bias.
Annexes and safety guidance
The operability of version 3.0 lies in its annexes and guidance. Annex 1, Principles for the Grading of AI Safety Risk, provides a uniform method of risk grading; Annex 2, the Agent Risk Management Framework, provides a dedicated risk management method for agents; Annex 3, Basic Principles for Trustworthy AI, establishes the baseline requirements for trustworthy AI. Chapter 5 provides four categories of safety guidance by subject: model and algorithm development, application construction and deployment, application operation and management, and application access and use. A company may locate the provisions applicable to its position in the value chain.
What it means for companies
Framework 3.0 is recommendatory and guidance in nature and does not itself impose penalties, but it will be cited by subsequent national standards and regulatory requirements, and it is an important reference in enforcement and judicial assessment of whether safety obligations have been discharged. It should be noted that companies which merely call a large model without developing one are equally within its scope, with the emphasis on application safety risk: as service providers and system users they bear corresponding safety responsibilities.
In concrete terms, agent products should review in particular the minimisation of permissions, credential management and monitoring of unauthorised invocation; the admission, signing and validation of responses of tools and plug-ins; encrypted storage, access segregation and deletability of memory and context data; sandbox isolation and audit logs for network access and code execution permissions; and interruptibility design, including a shutdown instruction that cannot be circumvented and segregation of evaluation from production environments. There are also the provenance records, sensitivity grading and quality validation of training and synthetic data; labelling of generated content, deepfake detection and filtering of unlawful information; and, for embodied intelligence, redundancy in perception, safety interlocks in physical execution and the boundaries of human-machine interaction.
The additions in version 3.0 point to a single requirement: AI must at all times remain under human control. From the principle of trustworthy application and prevention of loss of control to the two boxes on unanticipated autonomous behaviour and the threat of autonomous cyber attack, the emphasis falls on the controllability and interruptibility of agent behaviour. It should be read alongside the Interim Measures for the Administration of Generative AI Services, which is a departmental rule with binding force and imposes filing, content labelling and the lawfulness of training data; Framework 3.0 is a governance methodology at the level of standards, broader in coverage and including embodied intelligence and cybersecurity. The two are complementary.
For assistance with the design of permissions and controllability in agent products, the construction of an AI safety compliance system, model filing and content labelling, AI data compliance and cybersecurity, or criminal compliance and regulatory response, please contact Geason Law Offices. Further reading: the commentary on the Supreme People’s Court opinion on AI disputes and the AI data compliance risk checklist.
This article is prepared on the basis of the AI Safety Governance Framework 3.0 issued by TC260 on 14 September 2026. It is for reference only and does not constitute legal advice. Individual matters should be assessed on their own facts and evidence.