China’s AI Safety Governance Framework 3.0 treats an AI agent’s permissions as a governance decision. For companies using AI across borders, access to the technology does not automatically grant access to the evidence needed to justify that decision.
Consider the procurement team of a European manufacturer. Its AI assistant is configured to read supplier files, identify expired audit certificates and draft follow-up emails. A human buyer reviews and authorises each message before it is sent. If, under operational pressure, the assistant is allowed to send routine reminders on its own, it becomes an agent in the sense the regulatory frameworks use: it acts on behalf of the team without approval for each message.
The model did not change. Its permissions did.
The assistant’s existing permissions allowed it to access company information and external documents. Granting it the ability to send information without the buyer’s approval adds risk. For example, a compromised supplier document could contain embedded instructions that the assistant then follows, an attack known as prompt injection. Once the assistant is authorised to send messages, that manipulation can cause data to leak.
In June 2025, Aim Security’s EchoLeak showed how a malicious incoming email could make Microsoft 365 Copilot expose confidential information, with no click required. EchoLeak did not depend on permission to send emails, but it showed the same underlying danger: outside content directing the system.
Released on 14 September 2026, China’s AI Safety Governance Framework 3.0 devotes an entire annex, Appendix 2, to this shift from assistance to delegated action. The implication for companies extends beyond China. Granting an agent new permissions is a governance decision, one that falls to the people who authorise these systems as much as to those who build them.
How China got here
In early 2026, the rapid spread of the open-source agent OpenClaw in China brought security warnings. On 10 March, CNCERT, China’s National Computer Network Emergency Response Technical Team, warned of prompt injection, malicious plug-ins and data leaks. On 15 March, the National Internet Finance Association of China, the sector’s self-regulatory body, advised member institutions to keep the agent off terminals that handle customer data, funds or trades.
On 8 May, the Cyberspace Administration of China, the National Development and Reform Commission and the Ministry of Industry and Information Technology issued joint implementation opinions on agents. They distinguish decisions reserved for the user, those requiring the user’s authorisation and those the agent may make independently.
The September framework translates those distinctions into operational controls. Its annex recommends unique identities for agents, confirmation or human approval for critical actions such as transmitting or deleting data, and refusal to act when required approval fails or does not arrive.
Significant changes to permissions should prompt a security impact assessment and any necessary regression testing. When an agent is retired, its credentials should be revoked and its subscriptions cancelled.
The annex recommends human approval for critical actions, but an approval step is not the same as effective scrutiny. In ‘Humans in the Loop’ (76 Vanderbilt Law Review 429), Rebecca Crootof, Margot Kaminski and Nicholson Price argue that human oversight cannot be understood simply as inserting a person into an automated process. Its value depends on the role that person can actually play.
If human approval is kept for emails with sensitive attachments, the quality of review may decline as message volumes grow. Approvers may check the tone of a message and stop opening its attachments.
Human oversight is effective only if the review can identify material errors under operational conditions. Approvers need the time, information and authority to intervene when necessary. Without these, oversight may become a procedural formality.
Who controls the technology supply?
Beyond what an agent may do, the framework asks who controls the technology it depends on. Its Chinese and English versions frame this concern differently. The Chinese says 个别国家, “certain countries”, use technology monopolies and export controls to obstruct development. The English adds “may” and replaces “monopolies” with “technology barriers”. The English wording is more cautious, but both versions keep the phrase “unilateral coercive measures” (单边强制措施).
Washington and Brussels treat AI supply as strategy too. America’s AI Action Plan combines proposed exports of complete AI technology packages to partners with stronger controls on sensitive computing technology. Europe’s Apply AI Strategy links adoption to technological sovereignty, including a “buy European” approach, particularly in the public sector.
For a business choosing its next technology vendor, this brings business continuity into the safety debate. Can we control what the system does, and can we keep obtaining the technology it depends on? European companies faced the second question in June. A US export-control directive barred foreign nationals from Anthropic’s most advanced models, and Anthropic suspended them for all its customers for nearly three weeks.
Selecting a technology supplier is only the first step. The manufacturer must also establish which rules apply, what evidence supports the permissions it grants the AI system and who answers to the people affected by the system’s actions, including those who never interact with it.
One AI assistant, different governance layers
For our manufacturer, which rules apply is only part of the question. It also has to know whether it is looking at law, guidance or a technical standard.
Framework 3.0 is guidance without binding force. TC260, China’s cybersecurity standards committee, issued it under the guidance of the Cyberspace Administration of China. A closer comparison is NIST’s AI Risk Management Framework in the US or the standards work of CEN-CENELEC JTC 21 in Europe.
China’s Interim Measures for the Management of Generative AI Services principally concern services offered to the public in China, and Article 2 expressly sets apart services that are not. An internal procurement tool is not automatically covered, though that is no general exemption from other applicable law.
In the EU, the rules that matter most here sit outside the AI Act. Routine supplier administration is not a high-risk use listed in Annex III, so Article 14’s human-oversight requirements do not apply, though the transparency duties in Article 50 may. The GDPR still governs any personal data the assistant handles.
At the technical standard level, ETSI’s EN 304 223 addresses permissions directly: limit them to what the function requires (provision 5.1.2-6) and reassess risks when settings change (5.1.3-1.1). The Safety and Security chapter of the General-Purpose AI Code of Practice is written for frontier-model developers. An ordinary business user falls outside it. In the US, NIST’s AI Agent Standards Initiative, launched in February, includes work on agent security, identity and authorisation.
However the rules divide, the manufacturer must draw one line itself. Permission to send a reminder is not permission to disclose commercially sensitive information.
Can the evidence travel?
The technology already does. Alibaba’s Qwen models are available through Amazon Bedrock. A European company could build its AI assistant on a Chinese-developed model delivered through an American cloud. What evidence would justify allowing that assistant to act on the company’s behalf?
Chinese regulators can require safety assessments for specified public-facing services and ask providers to explain their training data and algorithms during supervision (Articles 17 and 19). Those supervisory powers do not give an overseas customer equivalent access to the information.
Of the ten leading Chinese developers Concordia AI examined between June 2025 and May 2026, only five made safety-evaluation results public alongside any release, and none did so consistently. In a separate sample of 30 deployed agents, the 2025 AI Agent Index also found limited disclosure about safety and evaluation practices: 25 of the 30 disclosed no internal safety results. These figures measure disclosure. Testing done in private would not appear in them.
The annex’s recommendation of a comprehensive audit trail raises further questions for multinational organisations with Chinese subsidiaries. The annex to the Chinese framework recommends detailed activity logs, local data storage and data transfers that comply with national rules. Headquarters’ access to these logs has to be designed into the system architecture. It cannot be presumed. Where that is not possible, the contract with the subsidiary or cloud provider has to provide for it, within the limits of Chinese law.
Obtaining evidence is only the first question. Its value also depends on how it was produced. In an international testing exercise involving the UK, France and the European Commission, two AI models judging agent behaviour disagreed with human reviewers on 15% to 41% of tasks, depending on the judge and the test variation. Either side may have been wrong, which is why a score needs a clear account of how the evaluation was done.
Evidence that an assistant can draft messages safely does not establish that it can also send them safely. Before switching on send, our manufacturer’s tests should include:
- whether a forged instruction in a supplier document can redirect an attachment
- whether missing approval blocks a sensitive message
- whether the approver can catch consequential errors under realistic workloads
- whether the action can be reconstructed afterwards.
The model did not change, but the evidence needed to trust the system did.
Who answers to the supplier?
Now suppose the assistant misreads a supplier’s certificate and, instead of sending a routine reminder, tells the factory that it has been removed from the approved-supplier list.
The framework calls for complaint and feedback mechanisms. For this supplier, the practical question is whether those mechanisms work without an account: can it reach someone with the authority to correct the record, explain the mistake and repair the relationship?
It should not have to understand the manufacturer’s AI architecture to find that person, nor should it have to wait while the model developer, the cloud provider and the procurement team work out who is responsible.
The person who authorises an agent’s permissions may not be the one able to correct its errors. Accountability for those outcomes should therefore be assigned when the permission is granted.
Permissions can be delegated. Accountability has to be assigned.