China's TC260 has released AI Safety Governance Framework 3.0, a non-binding third edition that adds a regulatory sandbox chapter exploring a limited liability exemption and an annex on managing AI agent risk

One release date, one cover month, and no effective date

The CAC notice is dated 14 September 2026 at 19:40 and is sourced to TC260. Its first paragraph reports that on 14 September, at the opening ceremony of the 2026 National Cybersecurity Publicity Week, the committee released Framework 3.0, and it links the PDF directly. The PDF cover itself says only 2026年9月, September 2026. We treat 14 September as the release date on the strength of the notice and the cover month as the document's own date.

Nothing in the framework takes effect. It is a governance framework and a set of safety guidelines prepared, in the preface's words, by TC260 under the guidance of the Cyberspace Administration of China, working with professional bodies, research institutes and companies. The preface says it was drawn up on the basis of Framework 1.0 (2024) and Framework 2.0 (2025) and that it continues the same core logic of risk classification, technical response and comprehensive governance. We searched the Chinese text for a repeal or replacement clause and found none. 3.0 is a new edition building on the earlier two, and that is as far as the document goes.

So the stage flag for every operative sentence below is the same: these are things the framework says should be done, explored or established. None of them is an obligation that this document imposes on anyone.

What is new against Framework 2.0, and what is carried over

We compared the Chinese tables of contents and the relevant sections of the 2.0 PDF released in September 2025 with the 3.0 text. Two things are structurally new. Section 4.3, titled constructing a flexible, dynamic and controllable sandbox regulatory environment, has no counterpart chapter in 2.0, although 2.0 did mention sandbox simulation as a testing technique at its item 6.1.11. Annex 2, the agent risk management framework, is also new as an annex. Both editions have three annexes: 2.0 carries risk grading, trustworthy AI principles and a terminology annex, while 3.0 carries risk grading, agent risk management and trustworthy AI principles, so the agent annex replaces the terminology annex in the line-up.

The rest of the headline material is inherited. The five-tier risk grading, low, general, relatively major, major and especially major, sits in Annex 1 of both editions. The trustworthy AI principles that were Annex 2 in 2.0 are Annex 3 in 3.0, revised and renumbered. The call in 3.0 section 4.4.1 for AI systems used in critical information infrastructure to be registered and filed, and for them to have protection capabilities matched to their security needs, appears in 2.0 at section 5.5. The call in 3.0 section 4.4.4 for open-source model providers and communities to make clear the prohibited conduct for downloading and using open-source models appears in 2.0 at section 5.4. The four sets of safety guidelines by role, research and development, construction and deployment, operation and management, and access and use, were sections 6.1 to 6.4 in 2.0 and are sections 5.1 to 5.4 in 3.0.

This matters because the sweep material that reached us presented several of those inherited items as new. They are not. A reader who already mapped Framework 2.0 in 2025 has two things to read closely in 3.0, the sandbox chapter and Annex 2, and a set of revisions to check elsewhere.

Section 4.3.3 in the framework's own words

The Chinese text of 4.3.3, printed pages 22 to 23, reads: 4.3.3 探索规范责任豁免制度。对沙箱测试中无主观过错且风险处于可控范围内的行为，探索责任豁免机制。对危害国家安全、侵犯人身权益、造成重大损害或者故意实施的违法行为，不因进入沙箱而免除依法应当承担的责任。

Our translation: 4.3.3 Explore a standardised liability exemption system. For conduct in sandbox testing that involves no subjective fault and whose risk remains within a controllable range, explore a liability exemption mechanism. For unlawful acts that endanger national security, infringe personal rights and interests, cause major damage, or are committed intentionally, the liability that is to be borne according to law is not excused by entry into the sandbox.

The framework's own English rendering, on printed page 90 of the same PDF, puts it this way: "A mechanism for liability exemption should be explored for conduct during sandbox testing where there is no subjective fault and the associated risks remain controllable. For illegal acts that endanger national security, infringe upon personal rights and interests, cause major harm, or are committed intentionally, liability that should be borne according to law shall not be exempted due to entering the sandbox." We cite it as the framework's English text, not as an independent source.

Three features of the sentence carry the weight. The verb is 探索, explore, used twice; the framework does not establish, grant or promise an exemption. The eligibility test has two limbs that both have to be met, no subjective fault and risk within a controllable range, and the text does not define either. The exclusions are four: harm to national security, infringement of personal rights and interests, major damage, and intentional unlawful conduct. Whatever a future sandbox rule does with the first two limbs, the document already says those four categories stay outside it. Calling this a safe harbour or a no-fault immunity would go past the words on the page.

The rest of the sandbox chapter: rules, admission, data

Section 4.3.1 calls for sandbox regulatory rules that combine industry classification with risk grading. It lists what those rules should settle: who the sandbox applies to, the scope of testing, the allocation of rights and responsibilities, and exit conditions. It says entry standards and testing requirements should be drawn up separately for sectors such as finance, education, broadcasting and television, and health, and that monitoring and intervention should vary with a project's risk grade. The framework supplies none of those rules itself.

Section 4.3.2 describes dynamic testing and flexible admission. Testing periods, scope and application scenarios should be adjusted as the technology iterates and testing progresses, with real-time monitoring, staged evaluation and rule adjustment running through the whole test. The main admission criteria named are technological innovativeness, controllability of risk and social value, with an appropriate tilt toward start-ups, small and medium-sized enterprises and public service projects. No testing duration is given.

Section 4.3.4 asks for a sandbox test data sharing platform that integrates government data and public industry data to give admitted firms compliant test data, and for rules on certifying test results and recognising them across departments so that sandbox results feed into later procedures without repeat testing. Again, these are things the text says should be built. The document does not say any of them exist.

Annex 2 reads like a control checklist for agent builders

Annex 2 opens by saying agents have carried AI from answering questions to executing tasks, that their high autonomy and high privileges bring risks of privacy leakage, unauthorised operations and loss of behavioural control, and that the annex proposes prevention measures for developers, providers and users of agent applications to reference. Part one walks the agent lifecycle from design and development through installation, instruction input, reasoning and planning, invocation and execution, memory, output and decommissioning, plus a residual group, and names the failure modes at each stage: prompt injection hidden in documents, emails, web pages, logs or messages; context overflow; goal hijacking; tool poisoning, tool privilege creep and tool selection bias; memory pollution and memory theft; and leftover permissions and credentials after shutdown.

Part two is where the operational content sits, in seven groups, and everything in it is reference material the annex offers to developers, providers and users; nothing in it is enforceable through this document. On identity and permissions it says each agent should carry a unique identifier, that instances of an agent application should not share one, that an agent should receive only the minimum permissions needed for the current task, and that credentials should be revoked immediately when a task ends or the agent is retired. On human approval it says a list of high-risk operations should be drawn up and handed to the user to take over before execution, that deleting files, sending data and changing system configuration should get a second confirmation or human approval with rollback available, and that when the approval system fails, the user does not respond or no approval rule exists, the default is to refuse the operation.

The same reference-only status applies to the remaining groups. On tools and supply chain it says an agent should check a tool's version, description file, parameter definitions and metadata before calling it and should not call publicly known malicious tools, and that skills from reliable, security-tested sources should be used by preference, with risk precautions taken before any untested skill is used. On runtime it says credentials and keys should in principle not be written to memory, that code execution and tool calls should run in sandboxes or containers, and that step counts, call frequency, execution time and resource use should be bounded. On monitoring it asks for full logging of file operations, command execution, network connections, skill calls and payment transactions, data collected or generated within China to be stored within China, a standing red-team programme, and a security impact assessment with regression testing whenever the model, agent framework, tools, permissions or security policy change materially. On retirement it asks for a full shutdown including revocation of third-party authorisations and cancellation of subscriptions and auto-renewals, a backup of records still needed, and a clean-down of files, knowledge bases, plug-ins, skill configurations and account credentials. Each of these is a recommendation in a non-binding annex, not a requirement.

Two related items in the main guidelines belong with this. Section 5.1.12 asks developers to set reasonable boundaries on agent behaviour and to attach a human approval mechanism to operations that could cause serious harm. Section 5.3.6 asks operators to keep application run logs, covering system and user behaviour, for not less than six months and to audit them regularly. The annex closes by saying agent cognition and action are still iterating quickly and that the risk framework will keep being upgraded. None of this is enforceable through this document, and Annex 2 says twice that it is offered for reference.

What we did not verify

What we opened: the bilingual Framework 3.0 PDF served from cac.gov.cn, read in the Chinese text for the cover, the table of contents, the preface, sections 4.1 to 4.5, sections 5.1.12, 5.3.6 and 5.3.19, Annex 1, all of Annex 2 and the opening of Annex 3, and read in the framework's own English text for section 4.3; the CAC notice of 14 September 2026; and, for the comparison, the Chinese table of contents and sections 5.4, 5.5, 6.1.11 and Annex 1 of the Framework 2.0 PDF released in September 2025.

What we did not open: Framework 1.0; any TC260 or CAC statement about how or whether sandbox rules under section 4.3 will be drafted; the separately consulted draft national standard on AI application security classification and grading, which Annex 1 does not issue or finalise; the Global AI Governance Initiative and the Global AI Governance Action Plan the framework cites; and any PRC law under which the liability preserved by 4.3.3 would actually be borne.

What we refuse to claim: we do not say Framework 3.0 supersedes or repeals 2.0, because we found no such clause. We do not say a sandbox exemption, safe harbour or immunity is available, because 4.3.3 says explore and names no procedure or body. We do not say the five risk tiers, the critical information infrastructure filing language, the open-source prohibited-use language or the trustworthy AI principles are new, because they are in 2.0. We do not say the framework is binding, that it took effect on 14 September, that it sets a filing deadline or penalty, or that firms outside China acquire duties from it. We do not say who will run a sandbox, how long a test would last or how an exemption would be adjudicated, because the document does not. Where the word must or shall appears above, it is inside the framework's own English rendering.

Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.

Related briefings

• TC260 draft national standard on AI application security classification and grading
• CAC, NDRC and MIIT implementation opinions on AI agents
• TC260 practice guide on secure deployment and use of AI agents
• Asia-Pacific AI regulation tracker
• AI Regulation News hub