On November 5, the HarmonyOS Office Industry Summit was held in Wuhan. Huawei announced a figure: as of October 2026, cumulative shipments of HarmonyOS PCs had exceeded 1 million units, and starting from the first batch going on sale in June 2025, it took less than a year and a half. Also released the same day was HarmonyOS PC Enterprise Edition, covering zero-touch deployment, unified device management and control, tiered data protection, and security auditing—terms most familiar to enterprise IT.
The next day, November 6, the General Office of the Ministry of Industry and Information Technology issued the 'Notice on Strengthening Network Access Management for AI Agent Terminal Devices' (MIIT General Office Information Management [2026] No. 42). Viewed together, the two point to the same thing: the 'terminals with agents installed' in enterprises are changing from a device that is fixed once purchased into an asset whose capabilities will continue to change over its holding period.
The impact of this on CIOs is much more concrete than "whether AI can be used"—it touches the two oldest foundations: fixed asset ledgers and change management.
I. This notice stretches “network access” into four stages
In the past, network access management regulated hardware: communication performance and basic security—once testing was completed and certification issued, that was the end of it. This time is different. The notice defines an agent as 'an intelligent system with autonomous perception, memory, decision-making, interaction, and execution capabilities,' and defines an agent terminal as 'telecommunication terminal devices such as mobile phones, tablets, and wearable devices with agents pre-installed,' then, along the product lifecycle, stretched the regulatory chain into four stages.
| segment | Regulatory requirements (key points of the original notice) | Responsible entity |
|---|---|---|
| Adaptation Verification | Agent developers shall strengthen terminal adaptation verification, and strengthen the management of permission invocation, communication capabilities, network and data security, user rights and interests, and task execution; publish the adaptation verification list on the product settings page, specifying the terminal models and operating system information for which adaptation has been completed; and submit the adaptation verification status to the application distribution platform before listing. | Agent Developer |
| Network access testing | Terminals with pre-installed intelligent agents must carry out adaptation verification in accordance with standards during network access testing; conduct security assessments of fraud-related risks and pre-emptive evaluations of anti-fraud capabilities in accordance with the law. | Terminal manufacturing enterprise |
| Live network upgrade | For agent upgrades pushed via OTA, a plan must be submitted (upgrade time, scale, user groups, business scenarios, service content, business model, network and data security measures, anti-fraud measures); after the upgrade is completed, a report must be submitted; only after the Ministry of Industry and Information Technology organizes expert evaluation and solicits opinions may services be formally provided to users | Terminal manufacturing enterprise |
| Distribution Management | App distribution platforms shall encourage developers to proactively declare, by electronic signature, whether they consent to agent invocation; where consent has not been declared, agents must not forcibly invoke or access applications | Distribution Platform + Developers |
Beyond the four tasks, there is a more important sentence in the safeguard measures: organize the development of a compatibility filing database for agent versions and terminal models, and accelerate the development of a trusted identity system and management platform for agents. The filing database is a list that can be looked up, and the identity system is a verifiable identifier—once these two take shape, “which version of which agent is running on this device” will no longer be just a verbal promise.
II. Why the regulatory chain must be extended: three unavoidable physical facts
Extending regulation across four stages is not because regulators prefer process, but because the way on-device agents operate is different from any previous type of enterprise software.
First, capacity will change during the holding period.
Once an ERP system is installed, its functional boundaries are determined by the version, and upgrades require the enterprise's own approval. On-device AI agents are not like this: once an OTA is pushed, the model changes, the skills increase, and what can be invoked changes. Liu Xingliang, dean of the DCCI Internet Research Institute, said directly in an interview with CNR: "Once a phone is sold, responsibility must also upgrade along with it." This statement also holds on the enterprise side—the security assessment you conducted three months ago assessed the version from three months ago.
Second, permissions will cross app boundaries
The notice specifically mentions that "without declared consent, agents must not forcibly invoke or access applications." This scenario is very common in enterprises: an agent installed on a tablet can read contacts, read documents, access the calendar, and even click through an approval on your behalf. Is it ultimately "an application" or "an identity with permissions"? Traditional endpoint management manages it as an application, and the permission model does not match.
Third, combinatorial explosion
Device model × operating system version × agent version—multiply these three dimensions, and the test matrix quickly exceeds what manual effort can cover. Liu Xingliang's follow-up question is worth copying into procurement documents: "If a task can be completed on one phone model, can it still be executed reliably when switched to another model or operating system version? Are the permissions appropriate, is the data secure, and do the execution results meet user expectations?" His judgment is that agent products need to move from "a successful demo once" to "continuous reliability on explicitly supported devices."
1.2 trillion yuan
2025 scale of China's artificial intelligence core industry (media citation basis, not data from this MIIT notice)
100 million+ units
Shipments of various smart terminals in the first half of 2026 (media-cited figures; no official breakdown available)
Terminal model × operating system version × agent version, forming a combination matrix for enterprise testing and filing
A note on definitions:The two figures above come from a Sina Finance industry observation article on November 8; the statistical agency and statistical scope are not specified, so they can only serve as order-of-magnitude references and cannot be written into procurement calculations. Another set of figures from the same day must have its attribution clarified: HarmonyOS PCs' cumulative shipments of 1 million units, 21,000 ecosystem applications, and the enterprise edition's 'zero-touch deployment efficiency increased 10 times' are all the vendor's own statements by Huawei at its November 5 summit; the implementing entity is the enterprise itself, and they have not been reviewed by a third party. Regulatory requirements are facts, vendor capabilities are claims, and the two cannot be placed in the same column.
III. The real gap on the enterprise side: the ledger assumes 'capabilities remain unchanged'
If you look at how most enterprises manage their fixed assets and IT assets today, you will find a default premise: an asset's specifications are determined at the time of purchase, and thereafter it only depreciates and does not change. So the ledger fields are model, serial number, purchase date, original value, using department, and depreciation period. This set of fields was designed for "things that do not change."
Agent endpoints break this premise. On the same device, it is version A in the first year and OTA-updated to version B in the second year; in between, models may have been swapped, skills added, and permissions expanded. The asset's book value is declining, while its actual capabilities are changing—and the direction of change is not necessarily approved by the enterprise.
| Ledger dimension | Traditional terminal (capabilities unchanged) | Agent Terminal (Variable Capabilities) |
|---|---|---|
| Identifier | Asset Number + Serial Number | Asset ID + Serial Number + Agent Identity Identifier |
| 版本 | Operating system version (upgrades go through a change request) | Operating system version + Agent version + Adaptation filing number |
| Permissions | Account and Role | Accounts and roles + Callable applications list + Authorization statement status |
| Change | Hardware repair, system reinstallation | OTA capability upgrade, model replacement, and new skill additions |
| Retirement | Data erasure, asset disposal | Data erasure + agent deregistration + identity and credential reclamation |
The biggest difference is in the fourth line. Hardware repairs must go through work orders, and system reinstallation must go through change management, but a single OTA often doesn't even get a notification in many enterprises—it is treated as “the vendor sent out an update.” Yet under regulatory definitions, this is already a matter that requires submitting a plan, submitting a report, and expert assessment. If enterprise-side change management still stops at the two levels of “hardware and systems,” an awkward situation will arise: Regulators have records, the enterprise does not; when something goes wrong, the vendor can be traced, but whether the enterprise itself approved it cannot be found.
"Once a phone is sold, responsibility must also upgrade along with it." — Liu Xingliang, Director of the DCCI Internet Research Institute, CNR, 2026-11-07. This statement also holds true in reverse for enterprises: what you buy back is not a device, but a capability that changes on its own.
This thread continues from the hard constraint set out in October. The mandatory national standard plan for 'Basic Security Requirements for Agent Applications' (plan number 20263116-Q-252) issued by the National Standardization Administration in October set three gates for software-side agents: controllability, full-process traceability, and digital passports. This network access notice governs the terminal side—the same logic extends from software to hardware, and from 'what it can do' to 'which device it is installed on, which version it runs, and who approves its upgrades'.
An easily overlooked detail: The notice requires agent developers to "publicly display the adaptation verification list to users on the product settings page." This seems to protect consumers, but for enterprise procurement it is a ready-made due diligence tool—before signing a contract, asking the other party to hand over this list and the adaptation filing status is far more useful than hearing once that "our compatibility is very good."
IV. Four Practical Recommendations for CIOs and Digital Leaders
First, add three columns to the ledger, not three systems. In the existing fixed asset or ITAM ledger, add three columns: “Agent Version,” “Adaptation Filing Number,” and “Authorized Invocation List,” and have the endpoint management platform automatically write them back monthly. The cost of adding columns is almost zero; the hard part is automatic updating—first confirm whether MDM can read the agent version, and if it cannot, solve that first.
Second, incorporate OTA into change management. Set tiers for capability upgrades: those that only fix defects do not go through approval; those that add callable applications or permissions must go through a change request; upgrades involving meetings, legal, finance, or classified environments must be re-evaluated. Evaluation conclusions must be tied to specific version numbers and cannot merely say 'evaluated'.
Third, add two clauses to the contract. One is the change notification obligation: notify how many days before OTA, inform of version and permission changes, and the enterprise has the right to refuse or postpone; the other is the availability of adaptation filing: at delivery, provide the adaptation verification list and filing status as an acceptance attachment. These two clauses do not add much cost to the supplier, but they will let you check clearly a year later.
Fourth, clarify the boundary between “device-side” and “cloud-side.” On-device local models have been a selling point over the past two years. On the HarmonyOS side, the claim is that “Xiaoyi Huiji” relies on an on-device model for meeting notes, so classified data does not leave the device. This is attractive to government and enterprise customers, but three things must be asked: which version of the on-device model is used, how often it is updated, and whether it is re-evaluated after updates; what data leaves the device, where it goes, and how long it is retained; and how on-device caches and memory are cleared when a device is lost or an employee leaves. Vendors saying “it doesn’t leave the device” is a capability description; what enterprises need is a verifiable handling process.
The most common pitfall: interpreting “endpoint compliance” as “as long as the device passes network access testing, there’s nothing to worry about.” Network access testing verifies the product’s state at that moment, whereas the risk an enterprise actually bears is present every day the device operates on the enterprise network. Compliance is an entry ticket, not an insurance policy.
Return to those two events at the beginning that were one day apart. One was managing 'where it is installed, which version it runs, and who can invoke it'; the other was selling 'full-lifecycle device management and tiered data protection.' Regulation and product moved in the same direction in the same week, showing that this is not a marketing cadence but an inevitable result after on-device agents reach scale.
The practical implication for enterprises is just one sentence: Over the past decade, the core of endpoint management was keeping devices under control; in the next few years, the core will be keeping “the capabilities running on devices” under control. The former relied on asset ledgers and permissions; the latter relies on versions, filings, and change records. None of these three is new; it is just that in the past no one required you to keep accounts for “something that changes by itself.”
Sources: General Office of the Ministry of Industry and Information Technology, "Notice on Strengthening the Network Access Management of AI Agent Terminal Devices" (MIIT General Office Information Management [2026] No. 42, issued on 2026-11-06, full text reposted by China Industry and Information Technology News Network on 2026-11-06); China Industry and Information Technology News Network (2026-11-06); China-Singapore Jingwei (2026-11-06); Economic Daily (2026-11-06); CNR, "The Rules Are Here! How Will the MIIT's Document Strengthening AI Agent Terminal Management Affect User Experience?" (2026-11-07, including an interview with Liu Xingliang, President of the DCCI Internet Research Institute); Economic Information Daily (2026-11-09); Sina Finance Industry Watch, "New Rules for Network Access Management of AI Agent Terminals: How Big Is the Impact on the Entire AI Industry?" (2026-11-08); related reports on Huawei 2026 HarmonyOS Office Industry Summit (2026-11-05, Wuhan): Gfan, PChome, NetEase Technology (all from 2026-11-05 to 11-06). Standardization Administration of China, "Basic Security Requirements for AI Agent Applications" mandatory national standard plan (Plan No. 20263116-Q-252, 2026-10).
Data definitions note: The content of the notice clauses is based on the original text from MIIT and the full reprint on the China Industry and Information Technology News Network; the descriptions of the four stages are summaries of the key points in the original text, not verbatim quotations; "The core AI industry scale exceeded 1.2 trillion yuan in 2025" and "smart terminal shipments exceeded 100 million units in the first half of 2026" come from media industry observation articles, without specifying the statistical agency or scope, and are only for order-of-magnitude reference; "HarmonyOS PCs have cumulatively shipped 1 million units," "21,000 ecosystem applications," "zero-touch deployment efficiency improved 10-fold," and "Xiaoyi Work brings together more than 200 domain experts" are all Huawei manufacturer self-statements and have not been third-party verified; Liu Xingliang's views are quoted from a CNR interview and are the expert's personal judgment. This account published a dedicated article on 2026-10-21 covering the mandatory national standard for agent security (three hard constraints on the software side); this article focuses on the terminal network access side and does not repeat its clause breakdown.
Zodioo Information (Zodioo) · Enterprise Digitalization Observations · 2026-11-10
