What happened
UK civil servants told MPs this week that the government is still considering whether to add AI specific measures to the Cyber Security and Resilience (Network and Information Systems) Bill. Ministers have spent the past months promising to legislate wherever necessary. The officials would not commit to a provision.
Alexandra Jones, director general for growth, international, science and technology at the Department for Business, Innovation, Science and Trade, told the Business, Innovation, Science and Trade Committee that recent machinery-of-government changes had left the Department for Digital, Culture, Media and Sport responsible for the bill. She said the government proposed "to use the Cyber Security Bill to consider changes to improve preparedness for AI, cyber, and loss of control risks," including how serious incidents and near misses are identified and reported, and how AI-driven disruption across organizations is contained.
Committee chair Liam Byrne pressed the point that has followed this bill around: "You can't consider something in a bill. You have to legislate for something in a bill." Asked later about legislative changes, Jones said the government was looking at introducing amendments and was developing policy on whether to use the bill for that purpose.
Separately, AI minister Kanishka Narayan, who sits in the Cabinet Office, said the government would step up national defenses against growing AI risks, would use every power available and would legislate wherever necessary, while not relying on law alone. The hearing took place against warnings about autonomous AI threats, including Anthropic research published this week exploring whether models could copy themselves between devices.
The UK regulates AI through sector regulators rather than a single statute, with the ICO publishing principles for how data protection law applies to AI.
Why this is a GRC story
Uncertainty is a planning input, not a reason to wait. Organizations regulated under the bill need to know whether AI incidents and near misses will be reportable, and on what timeline. Until that is settled, the sensible approach is to build the reporting capability now and treat the legal trigger as configuration rather than architecture. A register of AI systems with owners and a documented threshold for internal escalation costs little and survives whichever version of the text passes.
The near miss language is the part worth reading twice. Most incident reporting regimes learn about failures only after damage. Extending reporting to near misses pulls AI systems into the same discipline as safety engineering, and it changes what evidence you need to keep. If your team cannot currently describe what an AI near miss looks like in its own environment, that gap will be exposed by whichever regime arrives first.
Ownership churn is a governance risk. Responsibility for the bill moved between departments mid-passage. That is normal in government, and it is also exactly the condition under which policy assumptions drift. Boards tracking this should watch the department, not just the draft.
What to watch
Watch whether amendments are actually tabled as the bill progresses, and which department signs them. Watch the definition of reportable AI incident if one appears, since that single sentence decides whether your monitoring is sufficient evidence or merely interesting. Keep an eye on the sector regulators too, because in a decentralized model the practical obligations arrive through them long before any headline clause is settled.
Attribution: Analysis based on The Register and related public reporting. This article is original commentary, not a repost of the source material.