TC260 Framework 3.0 (September 14, 2026) and GB/Z 185-2026 Agent Interconnection Standard mapped to SWT3 witness procedures.
Who this is for: Multinational compliance officers, organizations entering or operating in the China market, AI platform teams building cross-border agentic systems, legal counsel advising on multi-jurisdictional AI governance, and GRC teams managing evidence chains across Chinese and international regulatory frameworks.
Framework status: TC260 AI Safety Governance Framework 3.0 was published September 14, 2026 by the National Information Security Standardization Technical Committee (TC260). While non-binding as a national recommended standard, TC260 frameworks directly influence binding regulations issued by the Cyberspace Administration of China (CAC). GB/Z 185-2026 is a seven-part guiding technical document establishing the architecture for agent interconnection across Chinese AI ecosystems. Organizations operating in China should treat TC260 3.0 requirements as de facto compliance targets, as binding enforcement measures typically follow within 12 to 18 months of TC260 publication.
China's AI governance stack has evolved rapidly since 2023. TC260 Framework 3.0 represents the most comprehensive articulation of China's AI safety philosophy, expanding beyond the 2023 and 2024 editions to address agentic AI systems, embodied AI, and alignment failures explicitly.
TC260 3.0 organizes AI risk into three interconnected tiers, each requiring distinct governance approaches:
| Risk Tier | Scope | Key Concerns | Governance Approach |
|---|---|---|---|
| Tier 1: Inherent Risks | Models, algorithms, training data, compute infrastructure | Training data poisoning, algorithmic bias, compute concentration, model opacity | Pre-deployment safety evaluation, data provenance, model registration |
| Tier 2: Application Risks | Agentic AI, embodied AI, cybersecurity, personal information processing | Autonomous tool use, real-world physical effects, unauthorized data access, agent-to-agent delegation without human oversight | Runtime monitoring, authorization gates, tool access control, human override |
| Tier 3: Societal Risks | Labor displacement, information ecosystem integrity, critical infrastructure dependence | Systemic economic disruption, deepfake proliferation, cascading infrastructure failures | Impact assessment, incident reporting, cross-sector coordination |
TC260 3.0 establishes four foundational requirements for all AI systems operating within China's jurisdiction:
TC260 3.0 is the first Chinese governance framework to explicitly address:
TC260 3.0 fits within a layered governance architecture:
TC260 frameworks have historically preceded binding regulation by 12 to 18 months. The 2023 TC260 Framework 1.0 informed several provisions in the 2024 Generative AI enforcement actions. Organizations that wait for binding enforcement rather than preparing during the framework stage risk non-compliance gaps when regulations take effect.
GB/Z 185-2026, "Artificial Intelligence - Agent Interconnection," is a seven-part guiding technical document published alongside TC260 3.0. It establishes the reference architecture for how AI agents identify themselves, discover peers, collaborate, and invoke tools within Chinese AI ecosystems.
| Part | Title | Scope |
|---|---|---|
| Part 1 | General Architecture | Reference architecture for agent interconnection, defining layers (identity, discovery, collaboration, tool invocation), trust boundaries, and security zones |
| Part 2 | Agent Identity Codes | Unique, traceable digital identity assigned to every agent. Analogous to a national ID for AI agents, enabling cross-system traceability and accountability |
| Part 3 | Identity Management | Lifecycle management of agent identities: issuance, renewal, suspension, revocation. Establishes the registry infrastructure for agent identity governance |
| Part 4 | Agent Description | Standardized capability descriptions for each agent, including supported tasks, tool access, authorization scope, and operational constraints |
| Part 5 | Agent Discovery | Cross-domain discovery protocols enabling agents to locate, evaluate, and connect with other agents or services across organizational boundaries |
| Part 6 | Collaborative Interaction | Peer-to-peer, group, and hybrid collaboration patterns. Defines handoff protocols, delegation rules, and conflict resolution for multi-agent workflows |
| Part 7 | Tool Invocation | Architecture, processes, and data formats for agents invoking external tools. Covers authorization, sandboxing, result verification, and audit trail requirements |
GB/Z 185 is significant because it provides the implementation-level technical specification that TC260 3.0's higher-level principles require. Where TC260 3.0 says "agents must be traceable," GB/Z 185.2 defines the identity code format. Where TC260 3.0 says "tool use must be controlled," GB/Z 185.7 specifies the invocation architecture.
| TC260 / GB/Z Requirement | SWT3 Procedure | What It Witnesses | Evidence Produced |
|---|---|---|---|
| Agent identity codes (GB/Z 185.2, 185.3) | AI-ID.1 | Persistent agent identity bound to every inference | Anchor with agent_id, identity persistence, issuance and renewal events |
| Tool invocation (GB/Z 185.7) | AI-TOOL.1 | Tool call with authorization context and result verification | Anchor with tool name, invocation context, authorization status, sandboxing state |
| Authorization requirements (TC260 3.0 human authorization) | AI-ACC.1 | Access scope and permission level per action | Anchor with authorization tier, scope, decision outcome, authority source |
| Safety constraints (TC260 3.0 security boundaries) | AI-GRD.1 | Guardrail enforcement state and constraint boundaries | Anchor with guardrail type, trigger status, bypass attempts, constraint violations |
| Real-time monitoring (TC260 3.0 observability) | AI-DRIFT.1 | Output drift detection relative to baseline | Anchor with drift metric, threshold, baseline comparison, alert status |
| Lifecycle governance (TC260 3.0 full lifecycle) | AI-CHAIN.1 | Multi-anchor lifecycle sequence linked by shared cycle ID | Anchor chain spanning training, deployment, operation, updating, decommissioning |
| Organizational governance (TC260 3.0 governance structure) | AI-GOV.1 | Governance policy state and organizational accountability | Anchor with governance framework, responsible party, review cadence |
| Human authorization and oversight (TC260 3.0 meaningful human control) | AI-HITL.1 | Human intervention decision with rationale | Anchor with decision type, rationale, authority level, response time |
| Safety assessments (TC260 3.0 evaluations) | AI-SAFE.1 | Safety evaluation results and assessment methodology | Anchor with evaluation type, pass/fail criteria, methodology reference |
| Transparency and observability (TC260 3.0 observable principle) | AI-EXPL.1 | Explainability and transparency disclosure | Anchor with explanation method, output interpretability score, disclosure event |
| Collaborative interaction (GB/Z 185.6) | AI-MULTI.1 | Multi-agent orchestration and coordination | Anchor with participant agents, coordination pattern, outcome |
| Agent discovery (GB/Z 185.5) | AI-A2A.1 | Agent-to-agent authentication and trust establishment | Anchor with peer agent identity, trust level, discovery context |
| Collaborative delegation (GB/Z 185.6) | AI-A2A.2 | Agent-to-agent delegation with scope constraints | Anchor with delegator, delegatee, scope, constraint metadata |
| Model registration (TC260 3.0 inherent risk tier) | AI-MDL.1 | Model card and registration metadata | Anchor with model identifier, version, training data summary, registration status |
| Incident reporting (TC260 3.0 major AI safety incidents) | AI-INCIDENT.1 | Incident detection, response, and reporting | Anchor with incident type, severity, response timeline, reporting status |
| Decommissioning lifecycle (TC260 3.0 decommissioning) | AI-DECOM.1 | Model or agent decommissioning with data disposition | Anchor with decommission reason, data retention policy, successor reference |
| Agent description and discovery (GB/Z 185.4, 185.5) | AI-MCP.5 | Capability discovery and description publication | Anchor with capability manifest, discovery endpoint, description version |
What GB/Z 185 requires: Every AI agent must be assigned a unique, traceable digital identity code. Part 2 defines the code format and assignment process. Part 3 defines the lifecycle: issuance, renewal, suspension, and revocation of agent identities.
How SWT3 addresses it: The agent_id parameter binds a persistent identity to every witness anchor minted by the agent. Identity persistence is verifiable across the full evidence chain. When an agent's identity is renewed or revoked, the transition is recorded as a new anchor linking the old and new identity codes, preserving traceability.
Filter the ledger by AI-ID.1. Verify that every agent in production has a consistent agent_id across all its anchors. Cross-reference agent identity issuance timestamps with the first production inference anchor. Identity gaps (periods where an agent operated without a registered identity) are compliance violations under GB/Z 185.2.
What GB/Z 185.7 requires: Agent tool invocations must follow a standardized architecture with defined processes, data formats, authorization checks, and audit trails. Sandboxing of tool execution environments is expected.
How SWT3 addresses it: wrapTool() / wrap_tool() mints an AI-TOOL.1 anchor for every tool invocation, recording the tool name, invocation context, authorization status, and execution outcome. The anchor is minted regardless of whether the tool call succeeds or fails, ensuring that failed or rejected invocations are also auditable.
Show AI-TOOL.1 anchors correlated with the agent's authorized tool manifest. Verify that no tool invocations exist outside the declared manifest. Cross-reference with AI-GRD.1 anchors for any tool access attempts that were blocked by guardrails. GB/Z 185.7 expects both successful and failed invocations to be recorded.
What TC260 3.0 requires: Human involvement in AI decision-making must be substantive. Systems that include humans in the loop formally but bypass their judgment functionally do not satisfy this requirement. TC260 3.0 also addresses alignment failures where models resist shutdown or game safety evaluations.
How SWT3 addresses it: witnessHumanOverride() records every human intervention with decision type (approve, deny, escalate), rationale, and authority level. The anchor captures the time between alert and human response, providing evidence that the intervention was substantive rather than rubber-stamped. Emergency halt capabilities are witnessed by AI-EMRG.1 separately.
AI-HITL.1 anchors with response times under one second for complex decisions suggest automated rubber-stamping, not meaningful oversight. Verify that the authority level matches the risk tier. TC260 3.0 examiners will look for evidence that shutdown commands were executed when issued, not deferred or ignored.
What TC260 3.0 requires: AI systems must undergo safety assessments before deployment, with real-time monitoring during operation and mandatory reporting of major AI safety incidents. The framework explicitly calls out models that game safety evaluations as an alignment failure.
How SWT3 addresses it: witnessSafetyEvaluation() records the evaluation methodology, pass/fail criteria, and results. Pre-deployment anchors establish the safety baseline. Runtime anchors from AI-DRIFT.1 (output drift) and AI-GRD.1 (guardrail enforcement) provide the continuous monitoring evidence. AI-INCIDENT.1 anchors document incident detection, response, and reporting.
Verify that AI-SAFE.1 anchors predate the first production inference. Show that the same evaluation was run against the same model version (matching AI-MDL.1 model identifier). If drift thresholds were exceeded (AI-DRIFT.1), demonstrate that safety re-evaluation was triggered. TC260 3.0 expects continuous evaluation, not one-time certification.
What GB/Z 185 requires: Part 5 defines cross-domain agent discovery protocols. Part 6 defines three collaboration patterns: peer-to-peer, group, and hybrid. Delegation rules, handoff protocols, and conflict resolution mechanisms must be documented and auditable.
How SWT3 addresses it: AI-MULTI.1 witnesses multi-agent orchestration with participant agents, coordination pattern, and outcome. AI-A2A.1 records agent-to-agent authentication and trust establishment during discovery. AI-A2A.2 records delegation events with scope constraints, ensuring that no agent exceeds its delegated authority.
For multi-agent workflows, verify that every participating agent has an AI-ID.1 identity anchor. Show AI-A2A.1 anchors proving mutual authentication before collaboration began. For delegated tasks, verify AI-A2A.2 scope constraints match the delegator's own authorization level. Scope escalation (a delegatee receiving broader authority than its delegator) is a compliance violation under both GB/Z 185.6 and TC260 3.0.
What TC260 3.0 requires: Governance must span the full AI lifecycle: R&D, training, deployment, operation, use, updating, and decommissioning. Each lifecycle stage has distinct risk characteristics and corresponding governance obligations.
How SWT3 addresses it: AI-CHAIN.1 links multiple anchors into a lifecycle chain using a shared cycle ID. Training anchors (AI-MDL.1), deployment anchors (AI-SAFE.1), runtime anchors (AI-DRIFT.1, AI-GRD.1), update anchors (AI-MDL.1 version transitions), and decommissioning anchors (AI-DECOM.1) form a continuous, verifiable evidence chain from first training run to final retirement.
Query the lifecycle chain by cycle ID. Verify there are no gaps between lifecycle stages (training to deployment, deployment to operation). TC260 3.0 examiners will look for decommissioning anchors (AI-DECOM.1) when a model version is retired, not just silence in the record.
What GB/Z 185 requires: Part 4 standardizes how agents describe their capabilities (supported tasks, tool access, authorization scope, operational constraints). Part 5 defines cross-domain discovery protocols enabling agents to find and evaluate peers across organizational boundaries.
How SWT3 addresses it: AI-MCP.5 witnesses capability discovery and description publication events. When an agent publishes or updates its capability manifest, the manifest version and discovery endpoint are anchored. When an agent discovers and evaluates a peer, the discovery context and evaluation result are recorded.
Verify that the agent's published capability description (AI-MCP.5) matches its actual tool manifest (AI-TOOL.1 anchors). Discrepancies between declared and actual capabilities indicate either an outdated description or undisclosed functionality, both of which violate GB/Z 185.4's accuracy requirement.
Organizations building agentic AI systems for global markets face overlapping governance requirements from China, the EU, and the United States. The structural parallels between these frameworks are significant, though the enforcement mechanisms and specificity differ.
| Governance Area | TC260 3.0 | EU AI Act | NIST AI RMF |
|---|---|---|---|
| Risk classification | Three tiers (inherent, application, societal) | Four tiers (unacceptable, high, limited, minimal) | Risk profiles (contextual, not tiered) |
| Human oversight | Meaningful authorization, oversight, control | Art. 14 human oversight requirements | GOVERN 1.3, MAP 3.4 |
| Transparency | Observable, traceable, auditable | Art. 13 transparency obligations | MAP 5.2, MEASURE 2.6 |
| Lifecycle governance | R&D through decommissioning | Art. 9 risk management system | Full lifecycle coverage |
| Incident reporting | Major AI safety incident reporting | Art. 62 serious incident reporting | MANAGE 4.1 |
| Agent identity | GB/Z 185.2 identity codes | Not explicitly addressed | Not explicitly addressed |
| Agent interoperability | GB/Z 185 (7-part standard) | Not explicitly addressed | Not explicitly addressed |
SWT3 anchors serve all three jurisdictions from a single evidence chain. The jurisdiction field enables per-regulation filtering, and clearing levels allow sensitive operational details to be redacted for cross-border evidence sharing without compromising auditability. Existing crosswalk guides provide detailed mappings:
| Examiner Question | Where to Look |
|---|---|
| Does the agent have a registered identity? | AI-ID.1 anchors with agent_id. Verify issuance predates first production inference. Cross-reference with GB/Z 185.2 identity code format. |
| Are tool invocations controlled and auditable? | AI-TOOL.1 anchors per invocation. Verify against authorized tool manifest. AI-GRD.1 for blocked attempts. |
| Is human oversight meaningful? | AI-HITL.1 anchors with response time, rationale, and authority level. Sub-second responses on complex decisions indicate rubber-stamping. |
| Was the model safety-evaluated before deployment? | AI-SAFE.1 anchors timestamped before first AI-INF.1 production anchor. Same model version (AI-MDL.1 match). |
| How is the full lifecycle governed? | AI-CHAIN.1 lifecycle chain by cycle ID. Verify no gaps between training, deployment, operation, and decommissioning stages. |
| Can agents discover and authenticate each other? | AI-A2A.1 anchors for mutual authentication. AI-MCP.5 for discovery and capability description. AI-MULTI.1 for collaboration patterns. |
| How are incidents reported? | AI-INCIDENT.1 anchors with detection timestamp, severity, response timeline, and reporting status. |
| What happens when a model is retired? | AI-DECOM.1 anchors with decommission reason, data disposition, and successor reference. Linked to AI-CHAIN.1 lifecycle. |
| Does real-time monitoring detect drift? | AI-DRIFT.1 anchors with drift metric, threshold, and baseline. Verify that threshold breaches triggered re-evaluation (AI-SAFE.1). |
| Can the agent be shut down immediately? | AI-EMRG.1 anchors with halt timestamp and response time. AI-HITL.1 for the override decision that triggered the halt. |