UK keeps AI safeguards in the maybe pile for Cyber Security BIll

UK officials have stopped short of committing to AI-specific measures in the Cyber Security and Resilience Bill despite ministers promising to legislate wherever necessary.

The uncertainty comes amid warnings about autonomous AI threats, including Anthropic's forecast that small models could be months away from operating as self-replicating worms on vulnerable smart devices.

Senior civil servants told MPs this week that the government was still considering amendments to the bill to address AI risks.

Alexandra Jones, director general for growth, international, science and technology at the Department for Business, Innovation, Science and Trade, is responsible for "AI and emerging technologies policy." However, she told MPs that the recent machinery-of-government changes had left the Department for Digital, Culture, Media and Sport responsible for the Cyber Security and Resilience (Network and Information Systems) Bill.

"We are proposing… to use the Cyber Security Bill to consider changes to improve preparedness for AI, cyber, and loss of control risks… [to] look at how serious incidents and near misses are identified and reported, and how AI-driven disruption across the organizations is contained," she said.

At Tuesday's Business, Innovation, Science and Trade Committee hearing, chair Liam Byrne interrupted: "You can't consider something in a bill.

You have to legislate for something in a bill." AI minister Kanishka Narayan, who sits in the Cabinet Office, this week announced plans to "step up national defenses against growing AI risks." "We will use every power at our disposal.

We will legislate wherever necessary.

And we won't look to law alone.

We will look to British ingenuity: our scientific expertise, technological capabilities and institutions to understand these increasingly powerful systems, defend against emerging threats and respond when things go wrong," he said.

Asked about legislative changes, Jones said the government was "looking at" introducing amendments to the bill and "developing the policy to look at whether we use the Cyber Bill to do that." The UK has a decentralized, sector-specific approach to AI regulation.

For example, the Information Commissioner's Office has published principles it will use to apply data protection law to AI.

The EU's AI Act entered into force in August 2024, with new powers activated in stages.

The US has no federal legislation specifically aimed at AI, although some states are introducing new laws.