UK House of Lords defeats government on Cyber Security and Resilience Bill, writing in AISI frontier-AI audit review and AI-agent direction powers

On 26 October 2026, at Report Stage day one of the Cyber Security and Resilience (Network and Information Systems) Bill, the House of Lords inflicted the Government's first defeat on the Bill, voting 202-155 to agree Amendment 163 (Lord Tarassenko). That amendment requires the Secretary of State to carry out a statutory review, within 12 months of Royal Assent, of whether the AI Safety Institute (AISI) should be given power to audit frontier AI systems before they are deployed on essential-service networks. Separately, the Government's own Amendment 70 (Baroness Lloyd of Effra) was agreed without division, adding the first explicit AI-agent provision to the Bill: where a cyber incident involves loss of oversight or control of an AI agent on a regulated network, regulations may give the Secretary of State powers to appoint inspectors, enter premises and run tests, require information held outside the UK, and impose financial penalties. A developer incident-reporting duty (Amendment 41, Baroness Harding) was defeated 95-165. The minister also confirmed commercial AI services delivered as software/platforms are 'likely in scope' of the NIS regime and that a non-UK model developer could be designated a critical supplier. Third Reading is expected 2 November 2026.

This puts UK pre-deployment audit of frontier AI onto a mandatory statutory review track and grants ministerial direction/inspection/penalty powers over AI agents operating on essential-service networks — subjecting AI providers (including non-UK developers) to potential pre-deployment review and incident-based enforcement. It materially changes the AI regulatory exposure for any lab or enterprise deploying frontier models into UK critical infrastructure.

Monitor the 2 November 2026 Third Reading and subsequent Commons ping-pong on Amendment 163. AI providers and operators serving UK essential-service networks should begin scoping pre-deployment audit readiness, AI-agent incident reporting, and information-outside-the-UK obligations.