UK yet to commit AI safeguards to cyber security bill
UK officials have not committed to adding AI-specific safeguards to the Cyber Security and Resilience Bill, despite the AI minister saying the government would legislate wherever necessary. The uncertainty matters because researchers and security experts warn that increasingly capable autonomous systems could threaten connected devices and critical infrastructure.
Civil servant Alexandra Jones said the government was considering amendments to improve preparation for AI-related cyber risks, including reporting serious incidents and containing disruption. MPs pressed her to clarify that the bill would need actual legislative provisions, while Anthropic’s recent research forecast that small models could be months away from acting as self-replicating worms; it extrapolated from capability trends and did not demonstrate a worm spreading across real devices. The UK currently regulates AI through sector-specific rules, while the EU has an AI Act and the US has no federal AI-specific law.
- The UK has not committed to AI safeguards in its cyber bill.
- Officials are considering amendments on incident reporting and containment.
- Anthropic’s worm forecast is based on capability trends, not a real-world demonstration.
New here? Start with this
The Cyber Security and Resilience Bill is a UK proposal to strengthen protection against cyber attacks on organisations and services that people rely on. These include connected devices and critical infrastructure such as energy, transport and communications networks.
Artificial intelligence systems can increasingly carry out tasks with less human direction, raising questions about how they might be used in cyber attacks or cause disruption. Researchers have warned that future systems could help spread malicious software between devices, though a recent forecast about this possibility was based on projected capabilities, not a demonstration of a real-world attack.
The UK currently regulates AI through rules for particular sectors. The EU has a law covering AI more broadly, while the US has no federal AI-specific law, so decisions about whether and how to include AI safeguards in UK legislation form part of a wider debate about managing these risks.
Both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
The bill should include explicit AI-related duties, such as reporting serious incidents and containing disruption, so operators have clear responsibilities before autonomous systems pose a serious risk to connected infrastructure. With researchers warning that capabilities may advance quickly, relying on existing sector rules could leave gaps and make preparation harder.
The case against
The government could reasonably avoid adding AI-specific provisions until the risks and appropriate duties are clearer, especially since the cited research extrapolates from capability trends rather than demonstrating a worm spreading in real devices. Flexible, sector-specific rules may let regulators respond to different systems and industries without locking broad requirements into a cyber bill before their effects are understood.
AI Cybersecurity Government Politics Technology UK World
Read the full article at the source →
Originally published by The Register as “UK keeps AI safeguards in the maybe pile for Cyber Security BIll”.