UK ministers have stopped short of committing to AI-specific measures in the Cyber Security and Resilience Bill, despite repeated promises to legislate wherever necessary, leaving senior MPs questioning the government's resolve.
At Tuesday's Business, Innovation and Trade Committee hearing, officials said the government was still deciding whether to amend the bill to address AI risks. Alexandra Jones, the senior official responsible for AI and emerging technologies policy, said recent machinery-of-government changes had left the Department for Digital, Culture, Media and Sport in charge of the bill. The government was "looking at" introducing amendments, she said, proposing to use the bill "to consider changes to improve preparedness for AI, cyber, and loss of control risks," including how serious incidents and near misses are identified and reported, and how AI-driven disruption is contained.
Committee chair Liam Byrne interrupted: "You can't consider something in a bill. You have to legislate for something in a bill."
The exchange comes amid fresh warnings about autonomous AI threats. Research published this week by Anthropic forecast that small models could be months away from operating as self-replicating worms on vulnerable smart devices, though the forecast extrapolates from improving model capabilities rather than demonstrating a fully autonomous worm in the wild. Consultancy Booz Allen Hamilton has also warned that autonomous AI systems are fully capable of finding and attacking critical operational technology, shutting down access to water, power and other daily life necessities.
AI minister Kanishka Narayan this week pledged to "step up national defenses against growing AI risks." "We will use every power at our disposal. We will legislate wherever necessary," he said, adding that Britain would draw on its "scientific expertise, technological capabilities and institutions" as well as law.
Risk researchers told the committee that model developers could not be trusted to regulate themselves. Daniel Kokotajlo of the AI Futures Project advocated a "least bad plan" of no recursive self-improvement, more transparency into the industry and more regulation, while conceding that "it would still be pretty scary to do." Byrne summed up the testimony as showing that "the safety culture across the industry is catastrophic."
The UK currently takes a decentralized, sector-specific approach to AI regulation, in contrast with the EU's AI Act, which entered into force in August 2024 with powers activated in stages, and the US, which has no federal legislation specifically aimed at AI.