China releases AI Safety Governance Framework 3.0 covering agents and embodied AI

China’s National Technical Committee 260 on Cybersecurity released AI Safety Governance Framework 3.0 at the opening of 2026 National Cybersecurity Week. The Cyberspace Administration of China published the same notice. The 136-page bilingual PDF keeps the risk-classification, technical-responses, and comprehensive-governance structure from versions 1.0 and 2.0 and expands coverage of AI agents, embodied intelligence, and computing infrastructure — including risks of autonomous cyberattacks.

While U.S. labs argue about pacing, Beijing’s standards body shipped an updated national AI safety framework that explicitly catalogs agent autonomy, robot and embodied failure modes, and AI-driven cyber offense. Readers get the primary document, not a rumor about what China “might” do.

China’s National Technical Committee 260 on Cybersecurity, or TC260 — the country’s national cybersecurity standards committee — released 《人工智能安全治理框架3.0》 / AI Safety Governance Framework 3.0 at the opening of 2026 National Cybersecurity Week on 14 Sep 2026. The Cyberspace Administration of China, or CAC — the internet regulator — republished the same notice that evening at 19:40, crediting 全国网安标委, the national cybersecurity standards body. That TC260 publish page, the CAC notice, and the official 136-page PDF are the filing event. This is a standards-body framework — guidance and a risk map — not a new statute this desk can name.

CAC says Frameworks 1.0 and 2.0 came out in 2024 and 2025. Version 3.0, the notice says, was compiled under CAC guidance with the China Academy of Cyberspace, the CAC data and technology support center, plus labs and industry.

The official PDF cover names “National Technical Committee 260 on Cybersecurity of SAC” and is dated September 2026. SAC is China’s Standardization Administration. The document is bilingual Chinese and English, 136 pages.

The structure stays “风险分类、技术应对、综合治理” — risk classification, technical responses, and comprehensive governance — the same three-part spine as 1.0 and 2.0, with updated risk classes and adjusted measures, per CAC and the PDF table of contents. This is not a claim that every old control was rewritten.

PDF risk chapters, as the document’s §2 lays them out, include endogenous risks — problems inside the system, in models, algorithms, data, compute facilities, and runtime — application risks, including agent safety and embodied intelligence, and derivative risks, including the spread of cyberattack capability and autonomous cyberattack threats. An AI agent here is software that can plan and act, not only chat back an answer. Embodied AI is AI that acts in the physical world — robots, vehicles, machines that move.

Agent risks the PDF calls out include identity and privilege abuse, planning failures, tool and plugin call risks, and memory-store risks. Embodied risks include sensing, physical action, human-robot interaction, and multi-robot coordination (PDF §2.2).

Annex 2 is an “Agentic AI risk management framework,” per the PDF table of contents / Appendix 2. It is a risk-management annex, not a license this desk can show.

Principles on the record include “可信应用、防范失控” — trusted use, and prevent loss of control — with explicit attention to agent behavior slipping out of control (PDF §1.5). Loss of control here is a risk the framework names, not a claim a system already escaped.

CGTN’s same-day wrap, as event context only: Cybersecurity Week runs 14–20 Sep 2026 in Jinan, in eastern China’s Shandong Province. The theme ties cybersecurity to the “intelligent era.” Organizers also released 2026 test results for AI-enabled cybersecurity apps and a list of consumer cameras that finished cybersecurity labeling.

MLex’s 15 Sep Insight note, a specialist secondary, frames the update as expanding coverage of compute infrastructure, AI agents, and embodied intelligence amid concern about evasion of controls and lower barriers to cyberattacks. It is not a second official primary.