China's AI Framework 3.0 Names the Four Control Surfaces of an Agent

Most governance documents are read for what they require. This one is worth reading for what it agrees with.

On 14 September 2026, at the opening of China's National Cybersecurity Awareness Week, the National Technical Committee 260 on Cybersecurity — TC260, working under the guidance of the Cyberspace Administration of China — published version 3.0 of the Artificial Intelligence Safety Governance Framework. It is the third edition, following 1.0 in 2024 and 2.0 in 2025, and the first to carry a dedicated risk framework for agentic AI.

What changed

The framework keeps the structure of its predecessors: classify the risk, apply technical countermeasures, govern comprehensively. What changed is the taxonomy underneath, and it changed in the direction every other regulator has been moving — from systems that answer questions to systems that take actions.

Version 3.0 adds a standalone application risk category for agents, covering identity and permission abuse, reasoning and planning failures, tool call execution, and memory storage. It backs that with an Agentic AI Risk Management Framework in Appendix 2 and a set of Fundamental Principles for Trustworthy AI in Appendix 3. Around them sit new classes for embodied AI and for cybersecurity impact, the latter including autonomous cyberattack behaviour. The inherent-risk section has been expanded to cover poisoning of an agent's memory module and defects in synthetic training data. The governance section retains the regulatory sandbox mechanism and adds explicit emphasis on preventing loss of control over autonomous behaviour.

The four surfaces

Strip the jurisdiction away and that agentic risk category is a list of four places where an agent can be controlled, or fail: identity — what the agent is permitted to be; tools — what it is permitted to call; memory — what it is permitted to retain and who can write to it; and planning — how it decides, and whether that decision can be interrupted.

That list should look familiar. Singapore's agentic AI governance work this year organises its controls around substantially the same surfaces. The prompt-injection guidance issued in the United States treats tool invocation and memory as the two points where an untrusted instruction becomes an action. The EU AI Act reaches the same territory from a different direction, through its human oversight and logging obligations for high-risk systems. Three legal systems with very different theories of the state have converged on the same four control points, because the control points are a property of the technology rather than of the politics.

What this document is not

It is not law. Framework 3.0 is TC260 technical guidance — not a statute, not a mandatory GB standard, and it carries no compliance deadline. The binding instruments in China remain the Interim Measures for the Management of Generative AI Services, in force since August 2023, together with the Algorithm Recommendation and Deep Synthesis provisions, under which public-facing generative AI services must complete an algorithm filing and a security assessment before launch. A comprehensive Artificial Intelligence Law remains on the State Council's legislative work plan and is not expected before 2027.

The practical weight of the framework comes from that relationship rather than from any penalty of its own. It is the vocabulary the supervisor uses when it reads a filing. A team submitting a security assessment for an agent with tool access will now be read against risk classes that did not exist in the taxonomy a month ago. Guidance without a deadline is still the guidance you are graded against.

Why this matters outside China

Most organisations reading this will never make a CAC filing. The reason to pay attention is convergence. When independent regulators describe the same risk surface in the same terms inside a single year, that description is stabilising — and an AI governance programme built to it will survive translation into whichever regime eventually applies to you. The expensive alternative is to build a separate control set per jurisdiction, discover that four fifths of it overlaps, and pay for the discovery.

The honest state of most AI policies I read is that they govern the model and ignore the agent. They specify acceptable use, data handling, and human review of outputs. They rarely say which identity the agent runs as, which tools it may call without a human in the path, who is allowed to write to its memory, or what happens when someone needs to stop it mid-task.

One thing to do this quarter

Take your most consequential deployed agent and answer four questions in writing. What identity does it hold, and is that identity distinct from the human who invoked it? Which tools can it call, and which of those change state in a system of record? What can write to its memory, and is any of that path reachable by an attacker? Who can stop it mid-task, and when was that last tested?

Four answers, one page. If any of them takes more than a day to establish, that is the finding — and it is now a finding you share with three regulators.