UK Officials Say AI Cybersecurity Amendments Still Under Consideration

Amendments remain under review

UK officials have stopped short of committing to AI-specific measures in the Cyber Security and Resilience Bill, despite ministerial promises to legislate wherever necessary. Senior civil servants told MPs this week that amendments to address AI risks were still under consideration.

Alexandra Jones, director general for growth, international, science and technology at the Department for Business, Innovation, Science and Trade, said recent machinery-of-government changes had left the Department for Digital, Culture, Media and Sport responsible for the bill. She said the government was proposing to use it to consider changes to improve preparedness for AI, cyber and loss of control risks, including how serious incidents and near misses are identified and reported and how AI-driven disruption across organizations is contained.

Committee chair Liam Byrne interrupted to say that something had to be legislated in a bill, not considered in one. Asked about legislative changes, Jones said the government was looking at introducing amendments and developing policy on whether to use the Cyber Bill for that.

Warnings over autonomous systems

The uncertainty follows warnings about autonomous AI threats. Research published by Anthropic on Monday examined whether AI models could copy themselves between devices and run on compromised hardware. Its forecast extrapolates from improving model capabilities rather than demonstrating a fully autonomous worm spreading across real IoT devices.

Consultancy Booz Allen Hamilton also warned that autonomous AI systems are fully capable of finding and attacking critical operational technology and industrial equipment, and of shutting down access to water, power and other daily life necessities.

Regulation and oversight

AI minister Kanishka Narayan, who sits in the Cabinet Office, this week announced plans to step up national defenses against growing AI risks. He said the government would use every power at its disposal and legislate wherever necessary, while also drawing on scientific expertise, technological capabilities and institutions.

The UK has a decentralized, sector-specific approach to AI regulation. The Information Commissioner's Office has published principles it will use to apply data protection law to AI. The EU's AI Act entered into force in August 2024, with new powers activated in stages. The US has no federal legislation specifically aimed at AI, although some states are introducing new laws.

Earlier, AI risk researchers told the committee that model developers could not be trusted to regulate themselves and that international rules would have to overcome entrenched political differences. Daniel Kokotajlo, executive director of the AI Futures Project, proposed avoiding recursive self-improvement and adding transparency and regulation so the industry proceeds with caution. Byrne summed up the testimony as saying the safety culture across the industry was catastrophic, the safety culture in individual companies was in the wrong place, competitive dynamics were exacerbating the risks and the companies could not be trusted to self-regulate.

Sources: The Register