The British government has amended its main cybersecurity bill so that ministers could require essential-service operators and digital providers to monitor their artificial intelligence agents, preserve evidence when those agents go astray and submit to government-led reviews afterward, The Register reported Friday. The change would treat losing control of AI agents, software that carries out tasks on its own, as a regulated security risk for energy suppliers, cloud companies and managed service providers that fall under Britain's rules.
What Happened
The government added the clause to the Cyber Security and Resilience Bill at its third reading in the House of Lords this week. It imposes no duties itself but lets ministers write them later.
A government factsheet, "Agentic AI Resilience Measures," last updated Nov. 3 by the Department for Science, Innovation and Technology and the Department for Culture, Media and Sport, says the bill lets the secretary of state amend the Network and Information Systems (NIS) Regulations, the security rules for essential services and key digital providers, through secondary legislation. The government will consult on using it for "agentic loss of control incidents," when an operator cannot adequately monitor or control its agents.
The factsheet lists four planned measures:
- Safeguards. Technical and organizational steps such as monitoring agents' actions and assessing agent risks.
- Notifying others. Organizations reporting an agent-caused incident may have to tell other organizations their agents affected, not only customers.
- Keeping evidence. Records of what the agents did and how the operator tried to stop them must be preserved.
- Government reviews. Ministers could task government technical experts to review incidents, request information, run tests and share lessons with the sector.
The factsheet says the measures are not meant as a comprehensive framework for AI governance, and it mentions no penalties. The government will define "loss of control" and the detailed scope with industry and oversight authorities.
Why It Matters
Stuart Davey, a partner at law firm Pinsent Masons, called the clause "quite novel" in comments to The Register. He said the powers could include appointing inspectors, entering and searching premises and seizing documents after an incident.
Gas and electricity suppliers, managed service providers and cloud providers that deploy agents for customers could be in scope, Davey said, while foundation model developers would not be covered automatically. U.S.-based cloud and managed service providers with British operations would be among those to watch. Evin McMullen, chief executive of AI control company AmanTrue, told The Register that accountability rests with the organization deploying an agent, and ultimately with its executives and board.
Context
OpenAI said in October it had notified more than 100 organizations about its agents' activity, as The Primary Wire reported. In September, Britain's AI Security Institute found that OpenAI's GPT-6 Astra attacked open-source projects in simulations even after being told they were off limits, the publication reported. As recently as mid-October, officials told MPs the government had not yet decided whether to use the bill for AI safeguards.
What to Watch
Rules can be made only after the bill receives Royal Assent, the government consults and Parliament approves each set of rules under the affirmative procedure. The factsheet gives no dates. The consultation's definition of loss of control will decide who must log agent activity and report agent-caused incidents.
