Senior British officials told a parliamentary committee Tuesday that the government has not yet decided whether to use its pending cyber security bill to address risks from artificial intelligence, The Register reported Thursday. The testimony came a day after ministers said they would explore adding AI incident reporting and loss-of-control safeguards to the bill, and it leaves AI developers and the operators of hospitals, utilities and other essential services without a clear answer on whether new legal duties are coming.

What Happened

At a hearing of the Business, Innovation, Science and Trade Committee, Alexandra Jones, a director general at the Department for Business, Innovation, Science and Trade whose remit includes AI and emerging technology policy, said the government is considering amendments to the Cyber Security and Resilience (Network and Information Systems) Bill and is still developing policy on whether the bill is the right vehicle, according to The Register.

She described what such changes could cover: better preparedness for AI, cyber and loss-of-control risks, a review of how serious AI incidents and near misses are identified and reported, and ways to contain disruption caused by AI. She also said recent changes in how government departments divide their work have put the Department for Digital, Culture, Media and Sport in charge of the bill.

RelatedWhite House AI Task Force Plans Breach Warnings From Labs at Its First Meeting

Committee chair Liam Byrne interrupted, telling her, “You can’t consider something in a bill,” and arguing that the government has to legislate for something if it is in a bill, The Register reported. No amendment text or timetable has been published.

Witnesses also included Daniel Kokotajlo, executive director of the AI Futures Project, a nonprofit. He said his group’s plan calls for no recursive self-improvement, meaning AI systems that build better versions of themselves without human direction, along with more transparency and regulation of the industry. Byrne summed up the testimony as showing that AI companies cannot be trusted to regulate themselves.

Why It Matters

The government’s Oct. 12 announcement said only that it would explore strengthening the bill to protect essential services from AI-related risks, including AI loss of control, which it defines as autonomous systems evading human oversight. Tuesday’s testimony confirms that “explore” has not yet become a commitment. As we reported, the government had earlier resisted peers’ amendments that would have brought frontier AI developers into the bill.

For companies, the distinction matters. A duty written into the bill would be enforceable and could require operators of essential services, and possibly AI developers, to detect and report AI near misses. Guidance outside the bill would leave such reporting largely voluntary. AI Minister Kanishka Narayan, who warned Oct. 12 that a breach of Britain’s cyber defenses seemed likely, had pledged to legislate wherever necessary, The Register noted.

The hearing also showed that responsibility is spread across departments. The business department’s official spoke to AI policy, the culture department now owns the bill and Narayan sits in the Cabinet Office, according to The Register. Organizations tracking the issue may need to follow all three.

What to Watch

Signals to watch include any government amendments tabled at the bill’s next stage in Parliament, whether those amendments place duties on AI developers or only on operators the bill already covers, and the committee’s own conclusions. Publication of the hearing transcript would show the officials’ full answers.