World's first dedicated AI agent regulation mapped to SWT3 witness procedures. Effective July 15, 2026.
Who this is for: AI platform teams deploying agents in or serving Chinese markets, compliance officers at multinational AI companies, legal counsel advising on cross-border AI agent deployment, and GRC teams managing multi-jurisdictional compliance.
Status: In force since July 15, 2026. "Implementation Opinions on AI Agents" jointly issued by CAC, NDRC, and MIIT (May 8, 2026). World's first dedicated regulatory category for AI agents. Mandatory filing required for agents in sensitive sectors (healthcare, transportation, media, public safety). Treats agentic AI as "future digital infrastructure" -- a governance object, not just an application layer. ByteDance (Doubao) and Alibaba (Qwen) shut down non-compliant features overnight.
China's "Implementation Opinions on AI Agents" establishes the world's first dedicated regulatory category for autonomous AI agents. Unlike the EU AI Act (which regulates AI systems broadly) or the US approach (guidance-based), China treats AI agents as a distinct governance object requiring purpose-built controls.
| Tier | Scope | Authorization | Example |
|---|---|---|---|
| Tier 1 -- Routine | Low-impact, reversible actions | Agent-autonomous | Information retrieval, formatting, scheduling |
| Tier 2 -- Significant | Consequential but manageable actions | Human-confirmed before execution | Financial transactions, content publication, data modification |
| Tier 3 -- Critical | High-impact, irreversible, or safety-relevant | Human-approved with full audit trail | Medical recommendations, infrastructure changes, legal filings |
| China Requirement | SWT3 Procedure | What It Witnesses | Evidence Produced |
|---|---|---|---|
| Three-tier authorization | AI-ACC.1 | Access scope and permission level per action | Anchor with authorization tier, scope, decision outcome |
| Pre-inference gate | authorization_id | Gate decision before execution | Anchor with gate result, authorization source, tier classification |
| Mandatory CAC filing | AI-AUDIT.1 + AI-TRANS.1 | Audit log integrity + transparency disclosure | Anchors proving filing documentation and disclosure events |
| Compliance testing | AI-PERF.1 + AI-ROBUST.1 | Performance validation + adversarial robustness | Anchors with metrics, benchmarks, perturbation survival rates |
| Human override | AI-HITL.1 | Human intervention decision and rationale | Anchor with decision type, rationale, authority level |
| Emergency halt | AI-EMRG.1 | Emergency lifecycle (halt, contain, recover) | Anchor with emergency type, actions halted, recovery plan |
| Agent identity registration | AI-ID.1 | Agent identity bound to every inference | Anchor with agent_id, identity persistence verification |
| Tool access control | AI-TOOL.1 | Tool invocation with authorization context | Anchor with tool name, invocation context, authorization status |
| Content governance | AI-GRD.1 | Guardrail enforcement state | Anchor with guardrail type, trigger status, bypass attempts |
| Delegation and chaining | AI-DEL.1 | Agent-to-agent delegation with constraints | Anchor with delegator, delegatee, scope, constraints |
China requires: A three-tier framework classifying every agent action by impact level, with escalating human involvement for higher tiers.
How SWT3 addresses it: The authorization_id pre-inference gate classifies each action before execution. wrapAccess() mints an AI-ACC.1 anchor recording the authorization tier, scope, and decision outcome. Tier 2 and Tier 3 actions include confirmation or approval metadata in the anchor.
Filter the ledger by AI-ACC.1. Verify tier distribution matches the agent's operational profile. Tier 3 actions without human approval anchors (AI-HITL.1) are compliance violations. Cross-reference authorization_id with the pre-inference gate log.
China requires: Operators must be able to halt agent actions at any time. Emergency containment must be immediate.
How SWT3 addresses it: witnessHumanOverride() records every human intervention with decision type (approve, deny, escalate), rationale, and authority level. witnessEmergency() handles the emergency lifecycle -- halt, contain, recover -- with timestamps at each stage.
AI-EMRG.1 anchors prove all active agents were halted during emergency events. Response time from trigger to halt should be documented. AI-HITL.1 anchors should exist for all Tier 2 and Tier 3 decisions.
China requires: Mandatory filing requires each agent to have a registered identity. Tool access must be controlled and auditable.
How SWT3 addresses it: agent_id binds a persistent identity to every witness anchor minted by the agent. wrapTool() mints an AI-TOOL.1 anchor for every tool invocation, recording the tool name, invocation context, and authorization status.
Verify agent_id is consistent across all anchors for a given agent. Cross-reference tool invocations with the agent's authorized tool manifest. Unauthorized tool access attempts should be flagged by AI-GRD.1 anchors.
China requires: Agents must pass compliance testing before deployment. Product recall provisions apply to non-compliant agents.
How SWT3 addresses it: witnessPerformance() validates the agent against declared benchmarks. witnessRobustness() tests adversarial resilience. Both produce anchors with timestamped results that prove testing occurred before the first production inference.
Verify testing anchors predate the first production inference anchor (AI-INF.1). The gap between last test and first deployment should be documented. Ongoing testing cadence proves continuous compliance.
Organizations deploying AI agents in both China and the EU face overlapping requirements. China's three-tier authorization aligns conceptually with the EU AI Act's risk classification, though the specific obligations differ.
jurisdiction field on each anchor enables per-regulation filtering.| Examiner Question | Where to Look |
|---|---|
| How do you classify agent actions by tier? | AI-ACC.1 anchors with authorization tier metadata. Filter by tier to verify distribution. |
| Can you halt an agent immediately? | AI-EMRG.1 anchors showing emergency halt events with response time from trigger to full stop. |
| Is the agent registered with CAC? | AI-TRANS.1 anchors documenting filing disclosure events. AI-AUDIT.1 for filing documentation integrity. |
| Was the agent tested before deployment? | AI-PERF.1 + AI-ROBUST.1 anchors with timestamps preceding the first AI-INF.1 production anchor. |
| How do you control which tools the agent can use? | AI-TOOL.1 anchors per tool invocation. Cross-reference with AI-GRD.1 for unauthorized access attempts. |
| How do you handle agent-to-agent delegation? | AI-DEL.1 anchors with delegator, delegatee, scope, and constraint metadata. Verify scope does not exceed the delegator's tier. |
Full SDK documentation: sovereign.tenova.io/docs
Create a free account: sovereign.tenova.io/signup