The British government said Monday it will explore using the Cyber Security and Resilience Bill to make organizations identify and report serious AI incidents and near misses, and to protect hospitals, utilities and other essential services from AI systems that slip out of human control. For companies that deploy AI agents in critical sectors, it is the clearest sign yet that the U.K.’s largely voluntary approach to advanced AI could turn into legal duties.

AI Minister Kanishka Narayan set out the plan in a speech at Imperial College London’s Base One incubator and paired it with a direct message to frontier AI developers: “if you cannot adequately control the risks, do not release the system.”

What Happened

The press release, issued jointly by the Cabinet Office, the AI Security Institute (AISI), the National Cyber Security Centre (NCSC) and the culture department, lists several strands of work. The government will look at strengthening the bill and the wider regime around it to address “AI loss of control,” which it defines as autonomous AI systems evading human oversight. It will also examine how serious AI incidents and near misses should be identified and reported, so lessons are learned quickly.

RelatedWhite House AI Task Force Plans Breach Warnings From Labs at Its First Meeting

The NCSC and AISI are also working out how to respond to incidents involving AI agents, software that carries out complex tasks with little human supervision, which the release warns could unfold faster and spread wider than other major incidents.

The government also plans to extend two pilots that use frontier AI to defend its own networks. It says they have found and fixed more than 1,000 potential vulnerabilities across government systems. In his speech, Narayan said a central vulnerability-monitoring service had cut the time to fix identified weaknesses from 50 days to eight. A June case study of an earlier hackathon series recorded 407 findings across nine government organizations for about £13,000 in model usage costs.

No funding, amendment text or legislative timetable was published. Details will be worked through with parliamentarians, experts and operators, and the government promised more on “AI verification,” which checks whether developers’ claims about how a system was built and tested hold up, “in the coming months.”

Why It Matters

The announcement shifts the government’s stance on the bill. On Sept. 2, The Register reported that Cyber Minister Baroness Lloyd of Effra had rejected peers’ amendments that would have brought frontier AI developers into its scope, saying the bill is meant to be technology-neutral and pointing instead to AISI’s pre-release testing and a voluntary code of practice. Monday’s package still centers on essential services and incident reporting, and it does not say whether any new duty would fall on developers or only on the operators the bill already covers.

If reporting duties land on operators, hospitals, utilities and their suppliers would need to detect and log AI near misses, not just breaches. Narayan has also told Reuters that Britain would consider regulating advanced models if the current system proved insufficient, the news agency reported Monday.

Narayan also aimed his remarks at boards. He said he wants cybersecurity discussed in every British boardroom “rather than simply delegated to middle management,” and acknowledged that the government’s own cyber defenses will likely be breached at some point. Ministers repeated earlier advice that businesses adopt the government-backed Cyber Essentials standard and sign up for the NCSC’s Early Warning service.

Context

Narayan cited a case in which an OpenAI agent searching for public data on medicine spending found a way around access restrictions on an Australian government website. The Australian government says no personal medical records are known to have been accessed. OpenAI has since apologized to Australia for several such incidents.

Washington is moving in a similar direction. On Oct. 9, the White House’s new AI task force said incident disclosure by AI developers is not optional, though it named no penalties. Separately, Reuters reported Sunday, citing The Telegraph, that the U.S. had dropped its request that American labs withhold unreleased models from AISI's testers.

What to Watch

Amendments to the Cyber Security and Resilience Bill as it continues through Parliament will show whether reporting duties reach AI developers. The government has also promised AI verification plans, an initial view from AISI on technical standards and a National Cyber Action Plan “soon.” Security Minister Dan Jarvis will lead a cross-government program on AI-driven cyber threats, and the government said AI will be central to Britain’s G20 presidency next year.