What's Happening?
The UK government has opposed amendments to the Cyber Security and Resilience Bill that aimed to introduce a comprehensive framework for AI governance. Baroness Lloyd of Effra, the Minister, argued that the existing NIS regime is not designed for broad
AI governance and that AI risks require a global response. She stated that placing duties solely on UK developers would not protect against AI models developed elsewhere. While the Bill does not regulate AI as a distinct category, it aims to catch AI services through existing categories like cloud computing. The Lords added two AI clauses, and the government outlined four planned measures for 'agentic AI' under one of them, focusing on resilience rather than comprehensive regulation.
Why It's Important?
The UK government's stance highlights a significant debate regarding the scope and approach to AI regulation. By resisting a comprehensive AI governance framework within the Cyber Security and Resilience Bill, the government signals a preference for a more targeted, risk-based approach, particularly concerning 'agentic AI' and its impact on critical national infrastructure. This approach could influence how other nations, including the U.S., consider AI regulation, potentially favoring sector-specific rules over broad legislation. The argument for a global response to AI risk underscores the interconnected nature of technology and the challenges of national-level regulation in a globalized digital economy. This could lead to increased international cooperation on AI safety and governance standards.
What's Next?
The Cyber Security and Resilience Bill has passed both Houses and is awaiting consideration of Lords amendments by the Commons on November 24, 2026. The Bill will lapse if not passed by April 29, 2027. The government plans to introduce four measures related to 'agentic loss of control' in AI, following consultation. These measures will focus on security and resilience requirements, affected party notification, evidence preservation, and post-incident review powers for Ministers. Additionally, clause 66 requires the Secretary of State to review the NIS regime within 12 months of Royal Assent, including whether to bring 'frontier artificial intelligence models and systems' into scope and if the AI Security Institute (AISI) should have audit and inspection powers.
Beyond the Headlines
The UK's cautious approach to comprehensive AI regulation within this Bill reflects a broader tension between fostering innovation and ensuring safety in rapidly evolving technological landscapes. The government's emphasis on 'agentic AI' and its potential for 'loss of oversight or control' points to a growing concern about autonomous AI systems, particularly in critical infrastructure. This debate touches upon fundamental questions of accountability, liability, and the appropriate role of government in regulating advanced technologies. The decision to prioritize resilience measures over a full governance framework suggests a pragmatic, incremental approach, acknowledging the complexity of regulating a technology that is still poorly understood in its full implications. This could set a precedent for how other nations, including the U.S., navigate the challenges of AI governance.
