The UK government has not committed to putting AI specific safeguards into its Cyber Security and Resilience Bill. Senior officials told the Business, Innovation, Science and Trade Committee this week that amendments to address AI risks, including how serious incidents and near misses are identified and reported, remain under consideration. The committee chair’s response captured the gap between the language and legislation: a bill is a place to legislate, not to consider.
The hearing took place against a specific warning. Anthropic research published on Monday explored whether AI models could copy themselves between devices and run on compromised hardware, and forecast that small models could be months away from operating as self replicating worms on vulnerable smart devices. The Register notes the forecast extrapolates from improving model capabilities rather than demonstrating a fully autonomous worm spreading across real devices. Consultancy Booz Allen Hamilton separately warned the committee that autonomous AI systems are capable of finding and attacking operational technology.
Ministers have used stronger language than the bill currently contains. The AI minister this week announced plans to step up national defences against growing AI risks and said the government would legislate wherever necessary. Asked about legislative changes, officials said the government was still developing the policy on whether to use the cyber bill for that purpose, a decision complicated by machinery of government changes that moved responsibility for the bill between departments.
Researchers testifying were blunter than officials. The committee heard that model developers could not be trusted to regulate themselves and that competitive dynamics are worsening the risks. For vendors selling into UK critical infrastructure, the practical consequence is uncertainty: incident reporting and AI disruption duties may land in this bill, in sector rules, or not at all, and procurement teams cannot yet write compliance requirements against a settled text.