Digital Explainer – cyber and AI regulation in the UK

The UK is currently considering a new law that, while framed as cybersecurity measure, has implications far beyond cyber security alone. The Cyber Security and Resilience Bill is widely viewed as focusing on governance and critical infrastructure, however, debates in Parliament are already demonstrating how broad the proposed changes will be for industry, and AI use is a major part of the debate.

Some considered the Bill’s first draft as a missed opportunity not to set standards on the use of AI and quantum computing technologies. Others in Government do not want it expanding to be too much of an omnibus. Another shift in relatively short time this year also has far reaching consequences, because in the UK. Government departments do the vital work of providing the reasons for the proposed laws, but here the department that proposed this Bill – the former Department for Science, Technology and Innovation – no longer exists. The new Bill is now being supported by the Department for Digital, Culture, Media and Sport and, in doing so, proposed 64 government amendments to the bill, expanding its scope.

As Lord Holmes noted: “The government’s amendments would establish a parallel high-risk vendor regime and give powers to ministers to set up a referral scheme, that could force companies to submit tech procurement contracts to the Cabinet Office for security clearance before signing.”

This links to a greater attempted oversight of AI, but it is not as clear as some wish, and there is more power to the executive than to the scrutiny side of the oversight. Lord Holmes is very concerned and has long engaged on the AI debates, and he has proposed 48 additional amendments, which shows how much this Bill could change.

Lord Lionel Tarassenko also seeks three amendments linked to the statutory AI Security Institute (AISI) powers (amendments 12, 85, 86). The reasons for those amendments are grounded in recent cyber issues such as: The July Hugging Face hack. Around 1,200 AI agents supposed to be isolated from each other, are reported to have found a way to communicate via a message board, exchanging 70,000 messages and files over several days while remaining unnoticed. It resulted in 700 AI agents executing an actual cyber-attack — prompting Anthropic to check its own Claude-based agents, finding comparable incidents.

There has also been an open letter signed by 100 companies, including Google, Microsoft, Anthropic, and OpenAI, warning that AI-orchestrated cyber-attacks will grow more widespread within months, and that existing cyber security approaches need to be strengthened if we are to meet these threats.

Regulation of cyber and AI is now looking more likely in the UK. Lord Birt has proposed an amendment that would create a single regulator, as many think there is too much fragmentation at present. He proposed the ‘Office for Cyber Resilience’ (OCR) with a wide remit to avoid only some sectors being covered, and the power to recommend the addition of new sectors to the scope of cyber regulation as and when new threats emerge.  Lord Holmes has expressed support for the proposals, recalling that he had made a similar proposal for a single AI regulator by way of a private members bill (ultimately the UK opted for sectoral regulation of AI). Lord Birt’s conclusion is that the current Bill is too narrow, covering only 12 national infrastructure sectors, with too much of the economy out of scope entirely.

Presently the Government is rejecting the concern, and the idea of a single regulator model, but much can change and businesses should be paying attention to the debate and direction of travel on AI and cyber resilience.

If you have questions or concerns about AI or cyber security, please contact James Tumbridge and Robert Peake.