UK officials delay AI safeguards in Cyber Security Bill despite ministerial pledges

Senior civil servants told Members of Parliament this week that the UK government is still considering amendments to the Cyber Security and Resilience Bill to address artificial intelligence risks. This hesitation persists despite public pledges from ministers to act decisively on emerging technological threats.

The uncertainty arises as officials acknowledge growing dangers from autonomous AI systems. Anthropic recently forecast that small AI models could be months away from operating as self-replicating worms on vulnerable smart devices. This warning underscores the urgency of legislative action, yet the government has stopped short of embedding specific AI safeguards in the current bill.

Legislative Responsibility and Confusion

Alexandra Jones, director general for growth, international, science and technology at the Department for Business, Innovation, Science and Trade, holds responsibility for AI and emerging technologies policy. However, she informed MPs that recent machinery-of-government changes have shifted responsibility for the Cyber Security and Resilience (Network and Information Systems) Bill to the Department for Digital, Culture, Media and Sport.

Jones stated that the government proposes using the bill to consider changes that improve preparedness for AI, cyber, and loss of control risks. She noted the aim is to examine how serious incidents and near misses are identified, reported, and contained across organizations facing AI-driven disruption.

Political Pushback and Ministerial Pledges

During Tuesday's Business, Innovation, Science and Trade Committee hearing, chair Liam Byrne interrupted Jones to challenge the government's approach. He argued that one cannot simply "consider" something in a bill, emphasizing that legislation must explicitly mandate actions rather than leave them open for future consideration.

AI minister Kanishka Narayan, who sits in the Cabinet Office, announced plans this week to step up national defenses against growing AI risks. He stated the government would use every power at its disposal and legislate wherever necessary, while also relying on British scientific expertise and technological capabilities to understand and defend against these powerful systems.

Who is affected?

Security and technology professionals monitoring UK regulatory developments face uncertainty regarding how AI risks will be legally defined and managed. The lack of specific AI provisions in the bill means the government has stopped short of committing to AI-specific measures despite ministerial promises.

The delay also highlights the disconnect between ministerial rhetoric and legislative reality. While ministers pledge to use every power at their disposal, senior civil servants confirm that amendments remain under consideration, leaving the specific scope of AI regulation undefined in the current bill text.

What should you do?

Organizations should review their current incident response plans to ensure they account for potential AI-driven disruptions. Monitor official government channels for updates on the Cyber Security and Resilience Bill amendments. Assess internal AI deployments for vulnerabilities that could allow autonomous operation or prompt injection attacks.

Background: Prompt injection attacks

Look for sudden shifts in tone, refusal to follow system constraints, or output that repeats hidden instructions. These signs indicate the model is processing injected commands rather than your intended query.

Read the full guide: Prompt Injection Warning Signs: How to Spot AI Manipulation

What to do and how to stay safe: UK

• Review incident response protocols to include identification and containment of AI-driven disruptions and near misses.
• Monitor legislative updates from the Department for Digital, Culture, Media and Sport regarding AI amendments.
• Audit AI systems for vulnerabilities that could enable autonomous operation or self-replication on connected devices.
• Ensure reporting mechanisms are in place for serious cybersecurity incidents involving emerging technologies.

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Will the UK Cyber Security Bill include specific AI regulations?

Officials have not committed to specific AI measures, stating that amendments to address AI risks are still under consideration.

Who is responsible for the Cyber Security and Resilience Bill?

The Department for Digital, Culture, Media and Sport is responsible for the bill following recent machinery-of-government changes.

What did AI minister Kanishka Narayan promise regarding AI risks?

He pledged to legislate wherever necessary and use all available powers to step up national defenses against AI threats.