UK weighs tougher safeguards against loss of control over AI, including changes to its Cyber Security and Resilience Bill

The UK government on 12 October 2026 set out a package of measures addressing the risks of advanced artificial intelligence. It includes possibly tightening cyber resilience rules, a plan for responding to incidents involving AI agents, and an expansion of programmes that use AI to patch vulnerabilities in state systems.

What the government announced

AI Minister Kanishka Narayan presented the package in a speech at Base One, the science and tech incubator of Imperial College London. He called for a whole-society approach, warning that failures or misuse of increasingly autonomous systems could have far more serious consequences.

According to the government's statement, ministers will consider strengthening the Cyber Security and Resilience Bill and the wider regime so that essential services such as hospitals and utilities are better protected from emerging AI risks. That includes "loss of control" scenarios, in which autonomous systems evade human oversight. For now this is a proposal under consideration: the government says the details of any measures will be worked out with parliamentarians, technical experts and operators, and the final scope of the changes has not been settled.

And if you cannot adequately control the risks, do not release the system. - Kanishka Narayan, UK AI Minister

AI agents and incident response

The NCSC and the AI Security Institute are working on how to respond to incidents involving agents, meaning systems that carry out complex tasks with little human supervision. The government cautions that a major incident could unfold faster and spread wider than the situations the state usually prepares for, so new expertise will be needed.

The government will also look at how to identify and report near misses, and how to share lessons quickly. The details are to be developed together with parliamentarians, technical experts and the operators who will have to deliver them.

AI defending state systems

The government will extend two pilots in which advanced AI supports cyber defence. According to the statement, they helped find and fix more than 1,000 potential vulnerabilities in government systems and detect possible threats.

One of the pilots was described in June 2026 by the Department for Science, Innovation and Technology (DSIT) together with the NCSC. The Government Cyber Coordination Centre ran weekly hackathons in which models scanned public government code repositories. Teams built their own tools, including a six-stage agent chain and five dedicated Claude Skills. The result was 407 findings, including critical weaknesses. According to the case study, all critical issues were fixed and no exploitation was detected. The cost was £13,000 in tokens, across nine organisations over one month. A second phase is to cover more departments and models, as well as closed-source systems.

I want Britain to become one of the hardest countries in the world to attack using artificial intelligence. - Kanishka Narayan, UK AI Minister

Model testing and verification

Scientists at the AI Security Institute are rigorously testing the latest generation of advanced models, following work with leading developers and the US government. The government also promises support for AI verification, meaning checks on whether claims about how systems are built, tested and assessed hold up. Details are due in the coming months.

Narayan said the government will legislate wherever necessary. He also urged model developers to listen to warnings from their own scientists and to investigate unexpected behaviour. Whether the announcements will translate into concrete changes to the Cyber Security and Resilience Bill, which is still making its way through the legislative process, remains an open question.