China's TC260 drafts Security Guidelines for Intelligent Agent System Development

China's National Cybersecurity Standardization Technical Committee issued draft Security Guidelines for Intelligent Agent System Development for public consultation, which closed 2 Oct.

The committee, known as TC260, released the draft on 18 Sept. 2026 as the public comment window for the standard that will shape security expectations for AI agent systems.

What it is

The draft is a technical guideline, not a law, issued by China's lead cybersecurity standards body for the development lifecycle of AI agent systems.

The draft covers security considerations throughout the development process, including system design, implementation, testing and release.

What it requires

It provides a basis for addressing risks linked to autonomous actions, tool use, system access and data security.

In particular, businesses should consider how to limit an agent's permissions, supervise high-risk actions and keep records of its activities.

The important question is no longer just whether an AI model produces reliable answers, but whether the business can control what the AI system is allowed to do.

What security leaders should do

Security leaders who run or sell AI agent products into mainland China should treat the draft's themes of permission limits, high-risk action supervision and activity logging as a preview of what a future mandatory standard could demand. Teams should inventory where their agents take autonomous actions, call external tools, or reach into other systems and data, since those are the exact risk categories the draft addresses. Because the guideline is currently non-binding, organizations have a window to pilot least-privilege agent permissions, human sign-off on high-risk actions, and durable activity logs before any compulsory version arrives. Legal and compliance teams should also track whether this agent-specific draft is later folded into binding Chinese cybersecurity rules, given how the country has previously converted draft guidance into mandatory national standards.