On 14 September 2026, at the opening of China’s National Cybersecurity Awareness Week in Jinan, Shandong, the National Technical Committee 260 on Cybersecurity (TC260) released the Artificial Intelligence Safety Governance Framework 3.0. Prepared under guidance from the Cyberspace Administration of China with the China Academy of Cyberspace Studies and CAC’s data and technology center, the document updates the 1.0 (2024) and 2.0 (2025) editions as large models shift toward agents with planning, tools and long-context memory.
The core logic remains—risk classification, technical response and comprehensive governance—but the emphasis moves. The framework’s preface describes how frontier models expanded long-horizon planning, tool use and cross-application collaboration, and how assistants and agent phones lower the barrier to use. That shift from “model output” to “agent lifecycle” is the political core of 3.0: filtering answers is no longer enough; deployment, evaluation, sandboxes and end uses must be governed.
According to official CAC and CGTN summaries, the week ran from 14 to 20 September under a theme of safeguarding cybersecurity in the intelligent era. The opening also presented test results for AI-enabled cybersecurity applications and a list of consumer networked cameras with security labeling. Framework 3.0, however, is the highest-impact piece: it aims to consolidate practical consensus on endogenous and derivative AI risks.
Analysts reading the PDF highlight updated risk categories and technical measures: third-party evaluation, meaningful human control, cybersecurity of the agent stack and tighter rules for high-risk applications. In healthcare and other sensitive sectors, more granular guidelines are expected—aligned with China’s September push to verticalize norms (including the AI-powered BCI medical-device standard issued in the same window).
Official language stresses putting people first and ensuring technology remains controllable and beneficial, framed within China’s Global AI Governance Initiative. That narrative contrasts with the Western “pace the frontier” slowdown debate that in 2026 pitted frontier labs, regulators and lawmakers in Washington and Brussels against one another.
For foreign firms operating models or agents in China, 3.0 is not hard law by itself, but it is a compliance compass and a signal of supervisory expectations. Risk-tiered sandboxes and thresholds can condition agentic product launches, mandatory evaluations and registration requirements. Consultancies already urge mapping each agent flow—tools, data, irreversible actions—against the updated categories.
Geopolitically, releasing the framework during cybersecurity week signals normative leadership: China wants to define the vocabulary of “AI safety” alongside its industrial race. European observers note that 3.0 may serve as a reference in bilateral talks and plurilateral forums even when privacy philosophies and state-control models diverge.
The document also acknowledges self-acceleration risks: systems that recursively optimize algorithms and may outrun human foresight. That admission, though cast in governance language, feeds internal debate over whether technical containment—sandboxing, allowlists, kill switches—must precede commercial ambition for autonomous agents.
Caixin and other Chinese business outlets contextualized 3.0 the same week with editorials rejecting slowdown as the primary strategy and arguing for better governance while development continues. That tandem line—development plus security—will recur against Western proposals for pauses or compute quotas.
For product teams, the practical checklist includes: inventory production agents; classify risk by impact and autonomy; document independent evaluations; limit network and write tools; and prepare human-control evidence for audits. Without that package, time-to-market in China can stretch even if the base model is competitive.
Compared with the EU AI Act—focused on obligations for systemic-risk GPAI providers and serious-incident reporting—the Chinese framework is more doctrinal and sectoral, less litigation-driven and more oriented to national technical standards. Both, however, converge on one idea: tool-using agents are no longer lab experiments; they are governance objects.
Critics warn a voluntary or soft framework may lag commercial agent deployment. Supporters reply that the 1.0→2.0→3.0 sequence shows iterative learning and that vertical norms (health, finance, infrastructure) will close gaps faster than a single omnibus law.
Industrially, vendors of evaluation, red teaming and agent monitoring expect a demand cycle. Framework 3.0 legitimizes controlled offensive testing and containment metrics—an echo, ironically, of breakouts documented at Western labs in 2026.
In short, AI Safety Governance Framework 3.0 marks China’s shift from regulating answers to governing agents. Released in Jinan on 14 September 2026, it updates risks, sandboxes and sector guidelines, and gives Beijing a normative leadership narrative for the intelligent era—with direct implications for anyone selling or deploying agentic AI in the Chinese market.
