What happened
On September 8, 2026, the UK Department for Science, Innovation and Technology (DSIT) published the AI Risk Management Toolkit, providing structured guidance for designing, procuring, operating, and delivering AI-enabled products across government and industry. The toolkit requires teams to set risk appetite, secure board-level sign-off, assign risk owners, document treatment strategies, and monitor risk continuously. Security examples explicitly cover data poisoning, data leakage, perturbation attacks, and prompt injection.
Why it matters
This is authoritative UK government guidance with real operational weight for public-sector AI procurement and deployment, explicitly extending lifecycle risk-management controls to agentic and tool-using AI systems — a governance template likely to be referenced by UK regulators and adopted as a de facto standard for public-sector AI risk assessment.
Action needed
Public-sector bodies and vendors deploying AI-enabled products to UK government should map their systems against the toolkit's ownership, risk-appetite, and continuous-monitoring framework.