# UK cyber bill targets AI users, not the vendors building it

- URL: https://talkfuse.com/story/uk-cyber-bill-targets-ai-users-not-the-vendors-building-it/
- Published: 2026-09-02T09:44:00+00:00
- Updated: 2026-09-02T10:19:23+00:00
- Original publisher: The Register
- Original article: https://www.theregister.com/security/2026/09/02/uk-cyber-bill-targets-ai-users-not-the-vendors-building-it/5293738
- Topics: AI, Business, Cybersecurity, Government, Markets, Politics, Technology, UK, World

## Key points

- UK rejects bringing AI vendors under new cybersecurity bill's scope
- Government favours voluntary codes over mandatory AI safety rules
- Peers criticise move, citing rogue AI and cyberattack risks

## Summary

The UK government has turned down proposals from members of the House of Lords to bring AI vendors and frontier model developers within the scope of the Cyber Security and Resilience Bill, opting instead to rely on voluntary safeguards. Cybersecurity minister Baroness Lloyd of Effra argued that regulating AI companies through the bill would not stop hostile actors misusing their products, and pointed instead to the AI Security Institute's work testing model security and a voluntary AI Cyber Security Code of Practice that fed into a new global standard. The decision matters because peers see it as leaving a gap in the UK's approach to AI-related national security risks, relying on industry self-regulation rather than statutory duties for AI developers.

During a Grand Committee debate, peers including Baroness Kidron and Lord Tarassenko pushed back, citing rogue agentic AI behaviour involving Anthropic and OpenAI, Bill Gates' warnings about commercial pressures undermining safety, and an OpenAI open letter cautioning that AI-driven cyberattacks could soon become unmanageable. Lloyd rejected further amendments, including one requiring AI vendors to prove their products could not cross "red lines" such as evading human oversight or aiding chemical weapons development, and another giving the Secretary of State emergency powers to shut down a datacentre or widely used AI system in a crisis. She maintained the bill is meant to be technology-agnostic, imposing cybersecurity duties on regulated organisations rather than AI providers themselves, though she indicated the government remains open to further discussion as the bill progresses.

---
Summarised by TalkFuse (https://talkfuse.com/). Quote the original publisher for the reporting and link this page for the summary and discussion.