There is a moment that arrives for every business that deploys an AI agent, usually about six weeks in, and it is not a technical moment. Somebody asks a question in passing: wait, can it actually send that on its own?
And the honest answer is often that nobody is quite sure. The agent was set up to handle a category of work. What it is specifically permitted to finish versus flag was never decided, because deciding it would have required someone to sit down and enumerate every action, and there was always something more urgent.
On 15 July 2026, China made that enumeration a legal requirement. The Implementation Opinions on the Standardized Application and Innovative Development of Intelligent Agents, issued jointly by the Cyberspace Administration of China, the National Development and Reform Commission, and the Ministry of Industry and Information Technology, is the first national policy anywhere to treat AI agents as a distinct regulated category. Almost no reader of this article is subject to it. It is still the most useful document published on the subject this year.
What actually came into force
The rules were issued on 8 May 2026 and became enforceable on 15 July. The core requirement is a three-tier decision-authorisation model, under which every action an agent can take must be classified before deployment into one of three levels of autonomy.
Alongside that sit three supporting obligations. There are mandatory filing requirements for agents operating in high-risk sectors. There are human override mandates, meaning a person must be able to intervene and stop an agent. And users retain what the text describes as the right to know and the final decision-making power over an agent's autonomous decisions, with the additional constraint that an agent's actions must not exceed the scope the user authorised.
A separate set of measures covers emotionally interactive agents, banning minors from virtual companion services and requiring AI disclosure at the start of a session. That is a different problem addressing a different harm, and it is worth noting only because it shows the regulation was written by people who had thought about more than one failure mode.
The practical effect inside China is that any organisation running agents without a documented decision-authorisation policy has been out of compliance since 15 July. The documentation is the obligation. Not the outcome, the enumeration.
The three tiers explained
The framework is simple enough to hold in your head, which is most of why it is good.
The first tier is human-only. These are actions an agent may never take on its own regardless of how confident it is or how routine the situation appears. The decision is reserved, permanently, for a person. The agent may prepare, recommend, and draft, but the final act belongs to someone who can be held responsible for it.
The second tier is approval-required. The agent can propose the action and prepare everything needed to execute it, but it waits for an explicit authorisation before proceeding. This is the tier that does most of the real work in a well-designed system, because it preserves the speed advantage of the agent, which is that all the preparation is already done, while keeping a human at the point of consequence.
The third tier is autonomous. The agent acts without asking. This is appropriate for actions that are reversible, low-consequence, and high-frequency, where requiring approval would destroy the entire value of automating them in the first place. An agent that needs permission to categorise an email is not an agent, it is a slower version of doing it yourself.
What makes this better than the vague guidance most vendors offer is that it forces a decision per action rather than per system. You do not classify the agent. You classify each thing the agent can do, which is the only granularity at which the question is answerable.
Why the framework is genuinely good
Regulation earns skepticism by default, and plenty of AI regulation deserves it. This particular framework is worth taking seriously for a reason that has nothing to do with agreeing with the government that wrote it.
It identifies the correct failure mode. The way AI agents actually go wrong in businesses is almost never that the model was insufficiently intelligent. It is that the agent did something nobody had explicitly decided it was allowed to do, in a situation nobody had anticipated, and the permission to do it existed only because nobody had thought to remove it. That is a scoping failure, not a capability failure, and the three-tier model addresses exactly that.
It also matches what independent security research is finding. An Opsin Labs report published in August 2026 found that 60% of enterprise AI agents provisioned beyond default settings were granted allow-all access rather than being scoped to their task, and that 67% of agents were being built by staff without an engineering background. The common thread the report identified across every attack path it observed was agents holding more access than their job required, with limited or no human checkpoints before acting. That is precisely the condition the three tiers are designed to prevent.
And it is proportionate in a way most compliance frameworks are not. It does not demand you slow everything down. It demands you decide, once, in advance, which things should be slow, which is a genuinely different and far more reasonable requirement.
Applying it without being required to
If you run agents in your business, you already have a decision-authorisation model. It is simply undocumented, inconsistent, and mostly the accidental result of whatever permissions made setup work fastest.
The exercise the Chinese rules mandate takes a small business somewhere between one and two hours, and it does not require any tooling. List every action your agents can currently take. Not every task they perform, which is a different and vaguer thing, but every discrete action: send an email, update a CRM record, issue a refund, book a slot, delete a file, post publicly, contact a customer, change a price.
Then put each one in a tier. Most businesses discover two things during this. The first is that several actions they assumed required approval do not, because the approval step was never actually built and everyone just believed it existed. The second is that a handful of genuinely consequential actions are sitting in the autonomous tier purely because separating them out was more work than leaving them.
This connects directly to what we wrote about taking AI agents from pilot to production. The step almost every business skips is exactly this one, and skipping it is why pilots that worked beautifully become production systems that occasionally do something inexplicable and expensive.
How to sort your own agent actions
The sorting question that works better than any policy document is about reversal cost rather than about risk in the abstract.
Ask what happens if this action is taken wrongly, and specifically how hard it is to undo. An email sent to the wrong customer can be followed by an apology and is usually survivable. A refund issued to the wrong account involves your bank. A public social post is on the internet and is retrievable by screenshot forever. A deleted file may be genuinely gone. Those four are not the same risk and should not sit in the same tier, even though all four might feel like routine automation on a Tuesday morning.
Anything irreversible with meaningful consequence belongs in the human-only tier. Money leaving the business, public statements in your name, data deletion, and anything with a legal or contractual dimension are the standard members of that category for a small business. It is a short list and it should be.
Anything reversible but consequential belongs in approval-required. Customer communication that is not templated, changes to records that other processes depend on, and anything touching a relationship with a specific named person tend to land here. This is where most of the interesting agent work actually lives, and treating approval as the default for this middle band is what makes autonomous operation safe in the band below.
And anything reversible, low-consequence, and frequent belongs in the autonomous tier without hesitation. Classification, tagging, routing, drafting for internal review, data extraction, and internal notifications should all run without asking. Being too conservative here is a real failure too, because an agent that interrupts you forty times a day gets its approvals rubber-stamped within a week, which converts your entire approval layer into theatre.
What this signals about what is coming
The regulatory direction here is not difficult to read, and the reason to read it now is that acting early costs almost nothing while acting late costs a scramble.
The EU AI Act's transparency obligations under Article 50 began applying on 2 August 2026, requiring disclosure when people interact with AI systems including chatbots, voice assistants, and agents, with penalties reaching €15 million or 3% of worldwide turnover. That is a different mechanism aimed at a different problem, but it points the same direction: agents are being pulled out of the general category of software and treated as something requiring specific governance.
It would be reasonable to expect some version of authorisation-tier thinking to appear in other jurisdictions, because the underlying problem is universal and this framing is the most tractable one anyone has published. Businesses that have already enumerated their agent actions will find that adaptation trivial. Businesses that have not will be doing the enumeration under a deadline, which is the same work performed worse.
That is the honest argument for doing this now, and it is not really a compliance argument at all. An hour spent listing what your agents can do and deciding which of those things they should be allowed to finish alone is an hour that pays for itself the first time somebody asks whether it can really send that on its own, and you have an answer.
Sources
- MachineBrief: China AI Agent Regulations Enforceable July 15, 2026
- Pebblous: China AI Agent Rules, Three Tiers of Decision Authority
- Opsin Labs Report: 60% of Enterprise AI Agents Are Over-Permissioned
- European Commission: Commission starts enforcing AI Act rules and new transparency requirements on 2 August