Implementation Opinions on the Standardized Application and Innovative Development of Intelligent Agents
For three years, "AI" has mostly meant something that talks. You ask, it answers. The next wave does not answer, it acts.
It books the flight, moves the money, files the form, closes the ticket, on your say-so and sometimes without checking back first. Which raises the obvious question. Once software starts doing things in the world, who is accountable for what it does?
China is the first country to write down an answer. On 8 May, its three most powerful tech regulators jointly issued a national rulebook for AI agents. If you saw the English coverage, you read that Beijing wants to "boost" agents and put them to work across the economy. True enough. But that is roughly half of what the document says, and it is the reassuring half. The other half, never translated, is where the state gives every agent a registered digital identity, sorts them by risk, and keeps itself able to trace them and switch them off.
This issue reads the whole document, in the language it was written in.
Parallel Frontier is a biweekly intelligence report on China's and Russia's AI ecosystems, read in the original. Each issue works a single primary source in the language it was written in, for people who follow these systems professionally and need the source, not a recap. The name nods to 平行智能 ("parallel intelligence"), a real term in Chinese AI research.
On 8 May 2026 the CAC, NDRC and MIIT jointly issued the Implementation Opinions on the Standardized Application and Innovative Development of Intelligent Agents (智能体规范应用与创新发展实施意见), China's first policy framework treating agents as a distinct governance object rather than an application layer on top of generative AI. (原文 / full text, cac.gov.cn and CAC press Q&A.) It defines an agent as a system capable of "autonomous perception, memory, decision-making, interaction, and execution" (自主感知、记忆、决策、交互、执行), and organises into four blocks of measures, Parts II through V: development foundations, a security baseline, 19 application scenarios, and ecosystem-building.
Three features of the text are doing the real work. First, Section 4 plans an "intelligent internet" (智能互联网). It describes agent registration platforms that would issue each agent a managed digital identity (数字身份), a searchable discovery layer, and a machine-readable declaration of what each agent is allowed to do, backed by research into agent identity systems, trusted interconnection, compliant payments and automated conflict resolution. The edifice is to be built "riding IPv6", meaning on top of China's national next-generation-addressing rollout, whose 128-bit address space is large enough to give every agent a unique, globally routable address. That is the precondition for everything else. An agent you can address individually is an agent you can register, look up, meter, log and switch off. IPv4's address scarcity makes per-agent identity impractical. IPv6 makes it native, which is why the "intelligent internet" is pinned to it rather than mentioned in passing.
Second, Section 3 commits to a standards system built on an Agent Interoperability Protocol (AIP), pledging to "actively participate in international standards" while flagging mandatory domestic standards for healthcare, transport, media (媒体) and public security. Third, Section 6 sets decision-authority tiers (决策权限): actions reserved to the user, actions requiring the user's authorisation, and actions the agent may take autonomously, with the user retaining a "right to know" and "ultimate decision-making authority" (最终决策权). Governance is then tiered by scenario risk (Section 11, 分类分级治理). Sensitive-sector agents face filing, testing and product-recall powers, while entertainment and office use get lighter self-assessment and platform governance.
Two sections push past registration into behaviour. Section 14 (失信惩戒) brings the social-credit system's language of credit evaluation and untrustworthiness discipline to agent developers, platforms and service providers. Section 28 tasks the agents themselves with public-opinion guidance, sentiment channeling and automated content review.
The instinct to read this as a control document misses half of it. The binding lineage runs back to the State Council's August 2025 "AI+" Initiative, whose phased target is 70% adoption of next-generation terminals and agents by 2027. That is why the issuers are CAC and NDRC and MIIT, content control fused with macro-planning and industrial policy. The document's own framing is "coordinate development and security". The operative posture, in practice, is closer to deploy first, govern along the way. This is the cloud-governance playbook, not the VPN one. With cloud, the state wanted more adoption, not less, but wanted it legible, and assembled visibility (CSL), classification (MLPS 2.0), critical-infrastructure designation, and data rules (DSL/PIPL) as the rails. Agents get the same treatment one layer up. Section 4's registry is the legibility layer, Section 11 the classification layer, Section 14's voluntary "credit evaluation" the disciplinary layer. The throughline is older than cloud. Real-name registration migrated from phones to social media to payments, and Section 4 reads as the same logic reaching autonomous software. Note also the standards-sovereignty thread (Sections 3, 34 and 38): compatibility with domestic chips and OS, open-source cultivation, and a bid to shape global AIP rather than inherit it, directly competitive with the Linux Foundation's agentic-interoperability body.
The registry's premise is that an agent has a stable, declarable identity and a fixed capability set that can be registered, discovered and trusted. Deployed agentic systems strain that premise. Capability is a function of the tools and context wired in at runtime, not a fixed property. The same weights behave very differently behind different scaffolds, and open-weight agents fork, compose and recombine faster than any filing cadence. Section 7's reach for blockchain-based behavioural traceability is aspirational against agents whose action space is emergent rather than enumerated. The Section 6 decision-authority tiers are the most technically serious move. They map onto the "meaningful human control" debate, but "user authorisation" degrades quickly when an agent chains dozens of sub-actions per task. Consent at dispatch is not oversight at execution. The Chinese read is arguably sharper than the Western one in one place. The policy's working assumption that loss-of-control scenarios depend on "unlimited resources and permissions," and that compute quotas, credit ceilings and kill-switches impose hard constraints, is a reasonable engineering bet for near-term deployed systems, even if it under-weights the harder cases.
For labs: the differentiator in sensitive sectors shifts from model capability to compliance architecture, testing documentation, traceability, third-party evaluation. For policy shops: this is the first state attempt to govern an agent ecosystem before it is economically load-bearing. The registry is the artefact to watch, not the rhetoric. For Western regulators: the standards bid means agent interoperability is now contested terrain, not a purely technical one. Indicators to watch: (1) first agent registration platform pilot or standard from CAICT/TC260, (2) first mandatory agent standard drafted in healthcare or public security, (3) any PRC AIP submission to IETF/W3C, and (4) first enforcement or recall action under Section 11.
内外有别 (nèi wài yǒu bié), "inside and outside are treated differently," is a standing principle of Chinese external communication. The account prepared for foreign audiences need not match the one circulated at home. This document is a clean case, and it is the kind of thing this publication exists to catch.
The full 38-point text of the Implementation Opinions was published in Chinese only, on cac.gov.cn. The sole English the state produced is a roughly 250-word Xinhua wire brief, carried near-verbatim across gov.cn English, China Daily, China.org.cn and english.news.cn. No official full English translation appears to have been published. So the question is not how the text was translated. It is what was allowed to cross over at all.
The English brief keeps the growth story intact: the "AI+" linkage, the four principles (including the reassuring phrase "safety and controllability"), the 19 application scenarios across research, industry, consumption, welfare and governance, and the innovation-ecosystem pillar. A foreign investor or ministry reading it comes away with a single message. China is going big on AI agents, across the whole economy.
What stayed in Chinese was the entire governance architecture. The English renders the whole of Part III, the security-and-control half of the document, as one sentence. The document "calls for ensuring safety and security." Everything underneath it disappears.
- Section 4 智能互联网, the "intelligent internet", with agent registration platforms, 数字身份 (digital identity) for agents, capability declarations, the AIP interconnection protocol, compliant payments, IPv6. The load-bearing part of the whole document, absent outward.
- Section 6 决策权限, the three-tier decision authority and the user's 最终决策权 ("ultimate decision-making authority").
- Section 11 分类分级治理, filing, testing and product-recall for agents in sensitive sectors.
- Section 14 失信惩戒, credit evaluation and untrustworthiness-discipline, the vocabulary of the social-credit system, extended to agent developers, platforms and service providers.
- Section 28, agents for 舆论引导 ("public-opinion guidance"), 情绪疏导 (sentiment channeling) and 智能审核 (automated content review).
- The mandatory standards for the media sector (媒体) in Section 3, and the 70% adoption target itself, neither of which the brief mentions.
We assess that the selection, not merely the brevity, is the signal. A 250-word brief that found room for all 19 commercial scenarios but not one word on a national agent registry, decision-authority limits, recall powers or social-credit discipline is not simply short. It is curated. The outward text keeps the reassuring adjective, "safe and controllable," and drops every mechanism that gives the adjective teeth. The inward text is where the teeth are.
Full English translations of Chinese regulations are rare in general, and their absence here could be read as ordinary triage rather than intent. That null hypothesis is worth holding. But triage does not explain the shape of the cut. Length-cutting trims detail evenly, whereas here the cut falls cleanly along one seam, development kept, control removed. We judge it probable that this reflects the ordinary 内外有别 reflex rather than a decision taken specially for this document, which makes it more telling, not less. The governance layer goes quiet outward by default.
Anyone assessing Chinese AI policy from English-language sources is not reading a shorter version of the same document. They are reading a different document, one from which the sovereignty and control architecture has been structurally removed. The registry, the identities, the recall power and the credit discipline are not hidden. They are simply on the other side of a language line. Crossing that line is the whole job.
Eight weeks in, the lab response is most notable for its quiet. No frontier lab (Alibaba/Qwen, DeepSeek, Zhipu, Moonshot, ByteDance, Tencent) has issued a prominent formal response. The visible reaction has come from official interpreters, capital markets and smaller vendors, not from the majors. Read that as response-by-participation rather than proclamation. The big labs are expected to engage through standards committees and product, and to make their aligned statements at WAIC in late July. This section fills from direct monitoring. Below is the standing read and what each item is waiting on.
The earliest substantive readings came from CAICT, whose director Yu Xiaohui published an official interpretation, and from Tsinghua's Xue Lan, both framing the directive as de-risking the market for developers. No frontier lab has matched them on the record. So what: when the ecosystem's official voices move before its commercial leaders, the message being sent is "compliance is settled, build accordingly," not "industry is still negotiating the terms." Watch: the first on-record statement from a top-five lab, and whether it endorses the directive's framing or hedges.
Agent-concept equities reacted within the week, with large buyers reported moving into the concept, and smaller vendors used the moment to launch agent platforms at the 2026 Mobile Cloud Conference on 7 to 9 May. So what: the market is pricing the directive as permission to build, consistent with the adoption-first reading in Key Judgment 3. Watch: whether frontier-lab product cadence, new agent frameworks and platform launches, accelerates into WAIC.
The sharpest lab-response signal is technical. Does any lab build to the directive's Agent Interconnection Protocol (AIP) and the Section 4 registry concept, or keep shipping on the US-origin MCP and A2A protocols? Nothing decisive yet. So what: protocol choice is where the standards-sovereignty contest in Key Judgment 5 becomes concrete or stalls. Watch: any AIP support, registry or identity hooks, or permission-tier and logging features (Sections 6 and 7) appearing in Qwen-Agent, Coze, Bailian or Qianfan release notes on ModelScope and GitHub.
Standing monitoring scaffold (primary-source, Chinese-first).
- Standards and participation: CAICT (caict.ac.cn) white papers, AIIA (aiiaorg.cn) working-group rosters, TC260 (tc260.org.cn) draft standards and drafting-unit (起草单位) lists. A lab's name on an AIP drafting committee is the hardest response signal available.
- Corporate: lab WeChat public accounts and newsrooms, earnings calls for the listed majors (Alibaba, Baidu, Tencent, iFlytek, SenseTime, Kuaishou).
- Product: ModelScope (魔搭), GitHub and Hugging Face release notes, agent-platform changelogs (Coze 扣子, Bailian 百炼, Qianfan 千帆 AgentBuilder, Yuanqi 元器).
- Trade press: 量子位 (QbitAI), 机器之心 (Jiqizhixin), 智东西 (Zhidongxi), and 安全内参 (secrss) for the governance cut.
- Event: WAIC (Shanghai, late July) is the next high-yield harvest, on the biweekly cadence.
- English triangulation only: ChinAI, ChinaTalk, Concordia AI, DigiChina, CSET.
- Meta's Manus deal unwound. China blocked Meta's acquisition of Singapore-based agent startup Manus on foreign-investment-review grounds, ordering the parties to reverse it, an early data point on where the foreign-agent line sits.
- Standards-body competition is live. The Linux Foundation has stood up an agentic-AI interoperability/governance association (computation, function-calling, identity, authorisation). Huawei joined as a Gold member alongside Lenovo, context for the Section 3 international-standards pledge.
- Companion-AI rules land first. The 10 April Anthropomorphic AI Interaction Services measures (Order 21) carry a 15 July compliance deadline. Agent-adjacent emotional-dependency concerns (Section 5) are already being enforced through a separate instrument.
- Pace signal. State media flagged 50+ AI standards due by year-end. The agent standards system (Section 3) will be drafted inside that wider push, not on its own clock.
- Estimative language: this publication uses a fixed lexicon of remote (<10%), unlikely (10–35%), roughly even (35–55%), probable (55–75%), likely (75–90%), almost certain (>90%). Confidence (low / moderate / high) describes the strength of the evidence base, not the probability.
- Sources & methods: what I monitor, in which languages, on what cadence, at the About page.
- Corrections policy: errors are corrected in the next issue and in the archive, marked.
- What this is not: real-time news, grand-strategy punditry, or translation-as-a-service. The explanation layer, every two weeks.