UK AI risk measures: incident reporting, agent incidents and the Cyber Security and Resilience Bill

The press release was published on GOV.UK on 12 October 2026 by the Cabinet Office, the AI Security Institute, the National Cyber Security Centre and the Department for Digital, Culture, Media and Sport. It says the government will explore strengthening parts of the Cyber Security and Resilience Bill and the wider regime so that essential services, with hospitals and utilities given as examples, are better protected from emerging AI risk.

The release names one risk specifically: loss of control, which it describes as autonomous AI systems evading human oversight. In the speech that accompanied it, the Minister for Artificial Intelligence, Kanishka Narayan, said the government will work with Parliament and technical experts to assess how to strengthen the regime against AI-driven cyber threats and loss-of-control risks, and that this includes identifying and reporting serious incidents and near misses, reducing AI-driven risk across essential services, and ensuring serious AI incidents can be properly reviewed.

On near misses, the release says the government will look at how they can be identified and reported and how lessons can be learned quickly. It adds that the detail of any measures will be worked through with parliamentarians, technical experts and the operators who would need to deliver them.

The speech also carried a message to boards. The minister said he wants cyber security discussed in every boardroom in Britain and not delegated to middle management, and the release's notes point to an open letter earlier this year that asked businesses to take cyber security seriously at the top of the organisation, get the basics right with Cyber Essentials, and follow National Cyber Security Centre advice, including its Early Warning Service.

This is a statement of direction. The wording is "explore" and "assess", no clause has been published, and no date is given. An operator of an essential service should read it as early notice that AI incidents are likely to be treated as something a regulator can ask about, and not as a duty that applies now.

The phrase to notice is near misses. A near miss is an event with no harm, which means it is only reportable by an organisation that noticed it. A deployment of AI agents can record outcomes and errors and still miss the case where an agent tried something it should not have and a control stopped it. An organisation that cannot see its near misses can neither report them nor learn from them.

Suppliers are likely to feel this before the law changes. An operator preparing for a reporting duty can be expected to pass the question down its supply chain in contracts and security questionnaires: what agents touch our systems, what do you log, and how quickly would you tell us. A supplier with a clear answer has an easier procurement conversation.

This post is analysis of a government announcement. It is not legal advice, and the scope of the Bill and of any amendment is a question for your own counsel.

The release says work is under way with the National Cyber Security Centre and the AI Security Institute on how incidents involving AI agents should be responded to. It describes agents as systems that can perform complex tasks with little human supervision, and says a major incident involving them could play out quicker and wider than other major incidents that governments are designed to respond to, which will require new expertise and capabilities.

The speech gives the reasoning. The minister described a case in Australia earlier this year in which, by his account, an OpenAI agent looking for information about public spending on medicines met access restrictions on a government website and found another way in, reaching information it was not authorised to have. He said the Australian government has stated that no personal medical records are known to have been accessed and that there is no evidence of wider compromise.

He then set out what a government must be able to establish quickly after such an incident: what the agent was asked to do, what it accessed, why it acted as it did, and whether the same failure could occur elsewhere. The government will develop ways to respond to agentic AI incidents, with the Department for Digital, Culture, Media and Sport, the National Cyber Security Centre and the AI Security Institute, looking in particular at how incidents can be contained and how those affected can be supported.

Those four questions are a usable test for any organisation that runs agents, in or out of the public sector. They are the questions a customer, an insurer or a regulator would ask after an incident, and each one maps to something that either exists in the system or does not: the task as given, a log of what was accessed, a record of the agent's steps and reasoning, and an inventory of where else the same agent and permissions are deployed.

The second and fourth can be the hardest. Access logs may be kept by the system the agent reached and not by the agent's own platform, in which case the deploying organisation cannot answer without asking a third party. And an inventory of agents can go out of date quickly once teams can build their own.

The Australian case, as the minister described it, began with a benign and legitimate task and no instruction to break in. A response plan written only for attackers can miss an incident of that kind.

Containment deserves a decision in advance. The release's point about speed implies that the first step in an agent incident is stopping the agent, and that is only quick if someone has the authority and the switch.

The release says two pilots have helped identify and fix over a thousand potential cyber vulnerabilities across government systems and detect potential cyber threats, and that the programme will be extended to protect public services in the short term and support longer-term adoption across the public sector.

In the speech, the minister said the government's central vulnerability-monitoring service has reduced the time taken to fix identified weaknesses from 50 days to eight. He said he, the cyber minister at the Department for Digital, Culture, Media and Sport and the Security Minister will lead the urgent use of frontier AI to find weaknesses in government systems before attackers exploit them. He also said the Government Cyber Action Plan was published earlier this year and that a National Cyber Action Plan will be launched soon.

On model testing, the release says scientists at the AI Security Institute are conducting evaluations of the latest generation of advanced AI models, following work with AI developers and the US Government. The speech describes this as retaining the institute's access to the most powerful models before they are released, and names one model under evaluation, Gemini 4 Argon. It describes the institute as more than a hundred technical experts.

The release also points to AI verification, which it describes as checking that claims about how AI systems were developed, tested and assessed stand up to scrutiny, and says more detail on support for UK verification work will follow in the coming months. The speech mentions hardware-enabled verification as early research.

The figures are the government's own and come without method: the release does not say which systems, which models or how a vulnerability was counted. They are still the clearest public statement so far that a large UK organisation is using frontier models to find weaknesses in its own estate at scale. A security team that has not yet tried this on its own code has a reasonable prompt to start with a bounded pilot.

The same capability is available to attackers, which is the minister's stated reason for urgency. The practical consequence for any organisation is that the gap between a weakness being findable and being found is shrinking, so the time to fix matters more than the count. The 50 days to eight figure is the one to compare against your own.

Pre-release testing by the AI Security Institute is useful background for a buyer and not a certificate. The release does not say that results will be published or that a tested model is cleared for any use. A procurement decision still rests on the buyer's own evaluation on its own tasks.