What happened
On 12 October 2026, AI Minister Kanishka Narayan and Cyber Minister Liz Lloyd announced a suite of measures to protect Britain against AI risks: scaling frontier-AI cyber-defence pilots that have already found and fixed 1,000+ vulnerabilities; exploring strengthening the Cyber Security and Resilience Bill and wider regime so essential services (hospitals, utilities) are protected from AI-specific risks including 'AI loss of control' where autonomous agents evade human oversight; new work to prepare for serious incidents involving autonomous AI agents (with NCSC and the AI Security Institute); and confirmation that the AI Security Institute is conducting rigorous evaluations of the latest generation of models. The minister warned labs to listen to their scientists, investigate unexpected behaviour and not release systems they cannot control.
Why it matters
This is the UK government's clearest signal that AI incident reporting and loss-of-control risk are being legislated into the critical-infrastructure cyber regime, extending reporting-style duties to operators of essential services built on AI. Combined with the restored UK AISI access to US frontier models, it positions AI incident disclosure as a UK regulatory obligation in formation and signals a whole-of-society resilience posture that AI deployers and critical-infrastructure operators will need to track into the Cyber Bill's passage.
Action needed
UK critical-infrastructure/essential-service operators deploying AI and agentic systems should prepare for AI-specific incident-reporting and near-miss-reporting duties under the Cyber Security and Resilience Bill; monitor the upcoming Government detail on AI verification support and the Cyber Bill amendments.