UK stops short of AI rules in Cyber Security Bill

UK officials have declined to commit to AI-specific measures in the Cyber Security and Resilience Bill, despite ministers saying they will legislate wherever necessary, The Register reported on 15 October 2026.

At a Business, Innovation, Science and Trade Committee hearing on Tuesday, Alexandra Jones, director general for growth, international, science and technology at the Department for Business, Innovation, Science and Trade, told MPs the government was still weighing amendments. She said officials were "proposing… to use the Cyber Security Bill to consider changes to improve preparedness for AI, cyber, and loss of control risks", including how serious incidents and near misses are identified and reported, and how AI-driven disruption across organisations is contained.

The committee chair, Liam Byrne, interrupted to say that was not how legislation works. "You can't consider something in a bill. You have to legislate for something in a bill," he said, according to the report. Asked directly about legislative changes, Jones said the government was "looking at" amendments and "developing the policy to look at whether we use the Cyber Bill to do that".

Jones also said recent machinery-of-government changes had moved responsibility for the Cyber Security and Resilience (Network and Information Systems) Bill to the Department for Digital, Culture, Media and Sport, even though her own brief covers AI and emerging technologies policy.

The hesitation sits awkwardly against ministerial language. AI minister Kanishka Narayan, who sits in the Cabinet Office, announced plans this week to "step up national defences against growing AI risks". He said the government would "use every power at our disposal" and "legislate wherever necessary", but would also rely on scientific expertise, technological capabilities and institutions rather than law alone.

The backdrop is a set of warnings about autonomous AI attacks. Anthropic research published on Monday examined whether AI models could copy themselves between devices and run on compromised hardware, and forecast that small models could be months away from operating as self-replicating worms on vulnerable smart devices. The Register notes that the forecast extrapolates from improving model capabilities rather than demonstrating a working worm spreading across real internet-connected devices. Consultancy Booz Allen Hamilton has separately warned that autonomous AI systems are capable of finding and attacking critical operational technology and industrial equipment, and of cutting off access to water, power and other essentials.

The committee has also heard from AI risk researchers who said model developers cannot be trusted to regulate themselves, and that international rules would have to overcome entrenched political differences. Daniel Kokotajlo, executive director of the nonprofit AI Futures Project, described his organisation's proposal as a "least bad plan": no recursive self-improvement, far more transparency into the industry, and a lot more regulation so that development proceeds with appropriate caution. He added that the plan "still has problems, and it would still be pretty scary to do".

Byrne summarised the evidence bluntly, saying witnesses had told the committee that safety culture across the industry is catastrophic, that competitive dynamics between companies are making the risks worse, and that the companies cannot be trusted to self-regulate.

The UK takes a decentralised, sector-specific approach to AI oversight. The Information Commissioner's Office, for example, has published principles describing how it will apply data protection law to AI. By contrast, the EU's AI Act entered into force in August 2024 and is switching on new powers in stages. The United States has no federal AI legislation, although some states are introducing their own laws.