China's new AI-agent rules make tiered decision authority mandatory

What is this?

On July 15, 2026, China’s Implementation Opinions on the Standardized Application and Innovative Development of Intelligent Agents took effect — the first national framework anywhere to treat AI agents as a regulated category distinct from the generative-AI models beneath them. Jointly issued on May 8, 2026 by the Cyberspace Administration of China (CAC), the National Development and Reform Commission and the Ministry of Industry and Information Technology, the text defines an agent as an “intelligent system capable of autonomous perception, memory, decision-making, interaction, and execution.” That definition pulls agents out of the 2023 generative-AI rules and attaches obligations to their autonomy rather than to their training data.

How it works

The core mechanism sits in Article 6: before an agent is deployed, its decision authority must be written down and sorted into three tiers. Tier 1 covers decisions only a human may make — irreversible or rights-affecting actions the agent may never take on someone’s behalf. Tier 2 covers actions the agent may propose but execute only after explicit user approval. Tier 3 covers matters the agent handles on its own inside a delegated scope, with the user keeping the right to be informed and to override at any time. Two properties decide the tier: how sensitive an action is, and whether it can be undone — moving money or signing a contract sits high, summarizing search results sits low.

Two further articles give the tiers teeth. Article 11 scales oversight by sector: in sensitive fields such as healthcare, transportation, media and public safety, regulators require registration, compliance testing and recall of faulty products, with a reported registration threshold around one million subscribers or 100,000 monthly active users. Lower-risk consumer uses lean on self-assessment, industry self-regulation and credit ratings. Article 7 requires a “verifiable, traceable” mechanism — behavior logs, and back-tracing technologies including blockchain — so that an agent’s actions can be reconstructed after the fact.

Why it matters

Chinese legal commentary summarizes the liability rule as “look at control, not code”: responsibility falls on whoever controlled the agent in a given situation — usually the operator that deployed it — not on the developer who wrote the code. That shifts the compliance burden from model-building toward deployment governance, and it makes proof the central problem. Declaring that a decision belonged to Tier 2 is easy; proving after an incident that the user actually approved it, and on what basis the agent judged, requires records that live in neither the code nor the policy document. The effective date already had operational bite: platforms including Doubao and Qwen shut down anthropomorphic “companion” features the same day, and the rules single out dependence among minors and elderly users — plus misuse of agents in automated attacks, privacy violations and fraud — as harms to contain.

Defenses

The rules read, in effect, as a security-controls checklist for anyone running agents, in China or not. Write the authorization policy before deployment and map every agent action to a tier, with human-only and approval-required actions enforced by the runtime rather than by convention. Gate high-consequence, irreversible tool calls — payments, contracts, deletions — behind explicit human approval. Instrument the data layer so that for every decision you retain the outcome, the rationale (what the agent read to decide) and the approval record (who authorized it, and when); this lineage is what makes a tier provable to an auditor. Scope agent credentials to the delegated task, keep an override path open at all times, and monitor the configuration and memory an agent loads at startup. These controls map cleanly onto OWASP’s “excessive agency” guidance and onto the EU’s “meaningful human control” discussion.

Status

Item	Detail
Framework	Implementation Opinions on Intelligent Agents (CAC / NDRC / MIIT)
Issued / effective	May 8, 2026 / July 15, 2026
Decision tiers	Human-only · approval-required · autonomous (Art. 6)
Sector filing	Healthcare, transport, media, public safety (Art. 11)
Traceability	Verifiable, back-traceable behavior logs (Art. 7)

Key dates: framework published May 8, 2026; in force since July 15, 2026.