Can an AI agent call every app on a phone? China’s new network-access notice puts consent and compatibility first
China's telecom regulator has issued a four-part control framework for phones, tablets and wearables with pre-installed agents. Developers must document compatibility; manufacturers must report major and over-the-air changes; and app platforms are told not to let agents force access without a developer declaration.
The short version
- What happened
- The notice covers phones, tablets and wearables with pre-installed agents and requires compatibility verification, fraud-risk assessment and product consistency around network-access approval.
- Who it affects
- Phone, tablet and wearable users may gain clearer compatibility and app-access boundaries, but the notice does not show how understandable disclosures will be.
- What remains unproven
- The sources are official policy documents, not evaluations of whether the controls reduce fraud, privacy loss or erroneous actions.
Keep in mind
The sources are official policy documents, not evaluations of whether the controls reduce fraud, privacy loss or erroneous actions.
No public test protocol, implementation denominator, review-time target or standalone penalty schedule is included.
The stated scope is pre-installed agents in telecom terminals such as phones, tablets and wearables, not every agent service.
Several requirements depend on standards and administrative practice the announcement does not reproduce.
The Impact of AI translated the Chinese sources; operative interpretation should be checked against the original and later guidance.
Multi-source analysis · 2 linked sources. Primary analysed source date: 6 November 2026.
Read the full report · 8 min The evidence, methods, implications and limitations
The answer: an agent does not get an automatic right to operate every app
China's Ministry of Industry and Information Technology has issued an official notice for what it calls intelligent-agent terminal equipment: phones, tablets, wearables and other telecom devices that arrive with an agent already installed. The document defines an agent as a system able to perceive, remember, decide, interact and execute. Its central idea is that action-taking must be tied to verified device compatibility, declared app permissions and the existing network-access regime rather than treated as a general licence to operate across a user's device.
The most direct user-facing provision concerns app calls. Distribution platforms are told to encourage app developers to state with an electronic signature whether they agree to their app being invoked by an agent. Without that declaration, the agent must not force the call. Platforms must show which terminal models and operating systems have passed compatibility verification, avoid offering agents to incompatible devices, inspect agents already listed and set correction or removal steps where verification is missing.
This is consequential because phone agents are moving from answering questions to taking actions: opening services, sending information, booking, purchasing or controlling another application. The notice does not prove that current agents have caused a measured level of harm. It instead creates a regulatory checkpoint before wider action-taking becomes routine. The distinction matters: the ministry has issued operational requirements, but it has not published outcome evidence showing that the framework prevents mistaken actions, fraud or privacy loss.[1][2]
What developers and device makers must show
Agent developers are instructed to test the fit between agent and terminal, including permission calls, communications capability, network and data security, user rights and task execution. They must publish a compatibility list in product settings, naming terminal models and operating-system information that have passed. Before an agent is placed on an app platform, its developer must submit the verification position. That creates a visible claim, although the notice does not prescribe a public results format or minimum test count.
For devices seeking network access, pre-installed agents must undergo compatibility verification under relevant standards. The process is also meant to include telecom-fraud risk assessment and advance evaluation of anti-fraud capability. Agents should carry a unique identity code by reference to national interconnection standards. Device makers must keep the shipped product consistent with the configuration that obtained a network-access licence and report major changes to MIIT, with renewed testing where required.
The controls divide responsibility across model developer, terminal producer and app platform. That matters because a harmful action may result from a model decision, operating-system permission, app interface or changed software version. The notice does not resolve every liability question, but it makes it harder for one participant to say that permissions and compatibility belonged entirely to someone else. Companies will need version records, test evidence and a dependable link between an agent build and the devices and apps on which it may act.[1]
The distinction that matters
The four control points
The notice distributes checks across the agent, device, software update and app platform.
Agent
Verify permissions, security and task execution
Publish supported device and OS list
Device
Complete network-access and fraud-risk checks
Keep shipped configuration consistent
Update
Submit OTA plan and completion report
Expert review before formal service
App platform
Record developer consent and compatibility
Rectify or remove unverified agents
Over-the-air updates become a regulatory checkpoint
The notice treats an over-the-air update as more than routine delivery when it changes an installed agent. A terminal producer planning an OTA agent upgrade is told to submit a plan to MIIT identifying timing, scale, affected users, business scenarios, service content, business model, network and data-security measures and anti-fraud controls. After the upgrade, the producer must submit a completion report. Formal service to users follows MIIT-organised expert assessment and the solicitation of opinions.
The public text does not explain how long assessment should take, what evidence experts will demand, whether limited pilots can proceed, or how emergency security patches will be handled. Those details will determine whether the regime acts mainly as documentation, a real pre-release safety gate, or a delay in feature availability. For users, the possible benefit is that a device cannot silently gain much broader action-taking powers through an update that nobody outside the supplier has reviewed. The cost could be slower or uneven rollouts.
What is missing is implementation data: the number of upgrades submitted, the proportion returned for changes, average review time, defects found after release and whether fraud or privacy incidents fall. None appears in the announcement. Compliance forms are not a safety denominator. The useful denominator is agent actions and affected users, separated by device, software version and task consequence.[1][2]
What the notice does—and does not—establish
The MIIT office notice is grounded in China's cybersecurity, data-security, personal-information, anti-telecom-fraud, telecommunications and network-access rules. It is not a peer-reviewed safety study and not itself a technical test standard. The policy explainer describes four linked tasks: adaptation, network-access management, upgrade management and distribution management. Some provisions use mandatory language, while some standards references are softer. The practical force of each element will depend on licensing, platform enforcement and further guidance.
The source supplies no standalone penalty table, complete inspection method or timetable for every supporting standard. Readers should not describe this as proof that every agent on every Chinese phone already passes a uniform safety test. Its scope is also narrower than all AI agents: the notice focuses on telecom terminal equipment with pre-installed agents, naming phones, tablets and wearables. Cloud-only services, enterprise agents, desktop software and robots may fall under other regimes.
A consumer could gain three useful signals: supported-device and operating-system lists, a clearer boundary around which apps permit agent calls, and a review point before a major capability arrives by OTA. Those signals are useful only if understandable and current. A compatibility list buried in settings does not tell someone whether an agent can send a message, move money or share location. Product design still needs action-specific confirmation, usable logs and a route to revoke authority.[1][2]
What would show whether the framework works
The first test is transparency. MIIT or platforms could publish the technical standards used, minimum compatibility cases, identity-code rules, review timelines and aggregate numbers for submissions, corrections and removals. Researchers could test whether public compatibility lists match behaviour across device models, operating-system versions and app updates. A signed developer declaration should not be treated as equivalent to a security assessment.
The second test is incident evidence. Useful measures include accidental app invocations, unauthorised data transfers, fraud attempts blocked or enabled, complaints, post-update regressions and time taken to revoke a compromised agent. Independent tests should include adversarial prompts, deceptive interfaces and conflicts between a user's request and an app's declared permission. Redress matters as much as prevention: people need to know which component acted and who must correct harm.
For now, the assessment is bounded. China has created a more explicit gate around pre-installed phone, tablet and wearable agents: verify compatibility, preserve the licensed configuration, report major changes and require declared app access. That can improve accountability. It does not demonstrate that an agent is accurate, secure or aligned with user intent, and it does not remove the need for clear per-action approval when an automated task could have material consequences.[1][2]
Keep following the evidence
Join The Impact Brief founding list for selected AI reports, their effect on people and the evidence limits. Read a sample first.
Continue the story
Read next
Continue exploring ai agents: compare the finding and its evidence limits.
Can shopping agents verify the total and refund terms on merchant sites?
A company-authored pilot found many merchant pages readable but too incomplete for a hard-budget agent to decide safely. The benchmark is unvalidated, commercially interested and does not measure completed transactions or disputes.
Read the next reportExplore the full source and evidence record
What this means for people
- Phone, tablet and wearable users may gain clearer compatibility and app-access boundaries, but the notice does not show how understandable disclosures will be.
- App developers, device makers and distribution platforms each inherit verification duties rather than placing all responsibility on the model provider.
- People harmed by an agent still need action logs, complaint routes and redress; the notice does not publish a complete remedy process.
Global context
China is using telecom network-access approval and app-distribution controls to govern agents embedded in consumer devices. Other regions may rely on platform rules, consumer protection, cybersecurity or AI-specific law. Comparable evidence needs incident, enforcement and redress data rather than document counts alone.
What the evidence does not yet show
- The sources are official policy documents, not evaluations of whether the controls reduce fraud, privacy loss or erroneous actions.
- No public test protocol, implementation denominator, review-time target or standalone penalty schedule is included.
- The stated scope is pre-installed agents in telecom terminals such as phones, tablets and wearables, not every agent service.
- Several requirements depend on standards and administrative practice the announcement does not reproduce.
- The Impact of AI translated the Chinese sources; operative interpretation should be checked against the original and later guidance.
What to watch next
- Detailed compatibility, anti-fraud and agent-identity standards used in network-access testing.
- How MIIT defines a major agent change and handles urgent security patches.
- Whether app platforms expose agent-call permissions in a form users can understand and revoke.
- Aggregate data on reviews, corrections, removals, complaints and post-release incidents.
- Clarification of responsibility when an agent crosses device, model and app suppliers.
Living evidence record
Impact record IAI-1B8S033
Evidence stage
Announced
Confidence
Supported
Reporting basis
Multi-source analysis
Independent or research support
Not yet
Record status
Monitoring
Last checked
7 November 2026
Source trail
2 direct sources across 2 source types.
People impact
Documented in this record.
Uncertainty
Limits and next checks are explicit.
Stages describe the evidence available—not whether a technology is good or bad. See the public method.
Evidence trail
Sources used for this report
Links checked 7 November 2026
Research question, topics and regions
China's official network-access controls for telecom devices with pre-installed AI agents
Topics: AI agents · Smartphones · Wearables · App permissions · Network access · Consumer protection
Regions: China · Asia & Middle East · Global
This report is labelled multi-source analysis. We summarise and analyse source material in our own words; company statements remain attributed claims until independently supported. Translated summaries preserve the meaning of the original source and link back to it. Read our editorial standards.
Reader commentary
What does this mean where you are?
Tell us what you have seen at work, in your community or in everyday life. A question is welcome too. No account is needed; we review notes before publishing them.
Explore commentary across the portal →Published reader notes
0No published reader notes yet. You can start the evidence-led discussion above.
Prefer a private correction or response? Contact the newsroom.