--- title: "China puts AI inside government apps on a tight leash — via a draft mandatory standard" date: 2026-11-09 category: Policy & Governance site: NeuroAI canonical: https://neuroai.site/a/na-policy-gov-app-ai-mandatory-standard language: en --- # China puts AI inside government apps on a tight leash — via a draft mandatory standard > A mandatory national standard for government mobile apps, circulated for comment in June 2026, would force full traceability of any AI — including agents — used inside public services. It is still a draft, not yet in force. A citizen opens a government app (政务App) to renew a permit. The reply that comes back may now be written, in part, by an AI. Who is accountable if it is wrong, leaks data, or calls the wrong external tool? China is writing the answer into a mandatory standard — but it is not law yet. On **2026-06-26**, the Cyberspace Administration of China (CAC, 中央网信办) published a draft for public comment of the *Management Requirements for Government Mobile Internet Applications* (《政务移动互联网应用程序管理要求》), a **mandatory national standard** (强制性国家标准). The comment window closed on **2026-08-25**. As of this writing it remains at the **draft-for-comment (征求意见稿)** stage and is **not yet approved or in force**. **Why this document matters** This is the "four-stage" distinction that trips up a lot of coverage, so it is worth being precise: - It is **not** a published, effective regulation. It is a **draft** open for feedback. - It sits *under* an already-in-force administrative document: the *Measures for the Standardised Management of Government Mobile Internet Applications* (《政务移动互联网应用程序规范化管理办法》), issued by the State Council General Office in **January 2026**. The mandatory standard is meant to be the technical backbone of that January measure. - A related, genuinely in-force rule it references is the mandatory content-labeling standard **GB 45438-2025** (*Cybersecurity Technology — Methods for Labeling AI-Produced Synthetic Content*), effective **2025-09-01**. So the spine (January measures, GB 45438) is already live; the new mandatory app standard is still being written. **What the draft would require** The draft covers the full lifecycle of government mobile apps — App, mini-program or "fast app" (快应用) — used by administrative agencies, mass organisations and public institutions. Four areas stand out: - **A functional negative list (基层减负 / "fingertip burden" reduction).** Except for security, emergency or law-enforcement scenarios, government apps should **not** include check-in (打卡签到), points-ranking (积分排名) or online-time-tracking (统计在线时长) features, and should not rank staff by reading counts, likes or study hours. The explicit aim is to cut "formalistic" digital performance metrics. - **Usage discipline.** Apps should not repeatedly demand forms, materials or "proof of presence" such as unnecessary work photos, screenshots, videos or location trails, nor judge real work by uploaded images. - **Security and third-party controls.** Host units must run monitoring and incident-response for network, data and personal-information security; outsource development or operations only through an approved process with a contract spelling out data-handling duties; and apply classified-data protection and supply-chain security rules. - **AI access, with full traceability.** This is the novel part. Any government app that connects an AI service must build an access-management mechanism: - Label AI-produced synthetic content per **GB 45438-2025**. - **Ban calls to unapproved external tool interfaces** when an AI service invokes them. - **Record the full chain**: user interaction, model response and human intervention. - For **agent-form AI** (智能体), additionally record the **decision path, tool-call details and data-access records**, so the whole process is "auditable, traceable and accountability-assignable" (可审计、可追溯、责任可界定). **Who wrote it, and where it came from** Per CAC's own explanatory note, the project was **formally initiated (立项) in December 2024** and drafted by a joint team from the China Academy of Information and Communications Technology (CAICT, 中国信通院), the China Electronics Standardization Institute (中国电子标准化研究院), Tsinghua University and Peking University. The drafting scope covers functional construction, filing management, usage management and security across government mobile applications. **Why it matters** Two signals sit inside one document. First, China is pushing AI *into* public services but is doing so through hard, auditable constraints rather than open experimentation — every agent decision path must be logged. Second, the "fingertip burden" clauses show the policy is as much about curbing wasteful internal app sprawl as about AI safety. For global readers, the model is notable: before government AI assistants become widespread, the rulebook demands that the machine's reasoning be reconstructable after the fact. That is a stricter default than most consumer AI products ship with. ## What readers can do now - **If you build or sell AI to government clients in China**: design for mandatory audit trails now — log user input, model output, human override and (for agents) decision paths and tool calls. Assume GB 45438 labeling is required. - **If you run a government app team**: tighten third-party outsourcing contracts and remove ranking/check-in features before the standard is finalised. - **If you follow AI governance**: treat the 2026-08-25 comment close as the moment to watch for the final text; the draft, not the January measures, is where the binding AI rules will land. ## Honest limitations I relied on the CAC draft notice, its explanatory note, and Chinese media paraphrases of the draft text; I did not read the full standard document line by line. The mandatory standard is at the draft stage — its final provisions may differ from the June 2026 version. I have not canvassed how provincial governments have implemented the underlying January 2026 measures. The "agent decision-path logging" requirement is described in media summaries of the draft and should be confirmed against the final published text. ## Key takeaways - The government-app mandatory standard is a **June 2026 draft for comment** (window closed 2026-08-25), still **not in force** — distinct from the in-force January 2026 management measures and GB 45438 content-labeling rule. - Its AI clause would mandate full traceability: content labeling, no unapproved external tool calls, and logged user/model/human chains — plus decision-path and tool-call records for agents. - The draft doubles as an anti-"fingertip formalism" tool, banning check-in/ranking features and unnecessary "proof-of-presence" uploads in government apps. --- Published by NeuroAI (https://neuroai.site/) — https://neuroai.site/a/na-policy-gov-app-ai-mandatory-standard Free to quote with attribution and a link to the original.