Why the Cyber Security and Resilience (Network and Information Systems) Bill is now in the frame
Ministers have publicly pledged to act on growing AI risks, but concrete AI-specific measures have not yet been written into the Cyber Security and Resilience (Network and Information Systems) Bill. Senior civil servants told MPs this week that the government is still "considering amendments" to the bill to address AI risks, even as the AI minister announced plans to "step up national defenses against growing AI risks."
Alexandra Jones, director general for growth, international, science and technology at the Department for Business, Innovation, Science and Trade, said the government was "proposing… to use the Cyber Security Bill to consider changes to improve preparedness for AI, cyber, and loss of control risks… [to] look at how serious incidents and near misses are identified and reported, and how AI-driven disruption across the organizations is contained." But she also cautioned the government was still "looking at" introducing amendments and "developing the policy to look at whether we use the Cyber Bill to do that."
Alexandra Jones, machinery-of-government changes, and who owns the Bill
Jones — who is responsible for "AI and emerging technologies policy" at the Department for Business, Innovation, Science and Trade — told MPs that recent machinery-of-government changes had put responsibility for the Cyber Security and Resilience Bill with the Department for Digital, Culture, Media and Sport (DCMS). That shift framed the hearing: responsibility for drafting and tabling any amendments now sits with a different department than the one Jones leads.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleAnthropic's forecast and other technical warnings about autonomous AI
Technical warnings closing in on policymakers featured prominently in the committee testimony. Anthropic's research, published on Monday, "explored whether AI models could copy themselves between devices and run on the compromised hardware." The company offered a forecast that small models could be months away from operating as self-replicating worms on vulnerable smart devices, but the report's forecast "extrapolates from improving model capabilities, rather than demonstrating a fully autonomous worm spreading across real IoT devices."
Consultancy Booz Allen Hamilton also warned that autonomous AI systems are "fully capable of finding and attacking critical operational technology and industrial equipment, and shutting down access to water, power, and other daily life necessities." Those technical alarms underpinned calls at the committee for more regulatory clarity and stronger safeguards.
Parliamentary exchanges: Liam Byrne's interruption and the committee's assessment
The hearing produced an unambiguous exchange over legislative intent. Business, Innovation, Science and Trade Committee chair Liam Byrne cut across Jones's cautious language: "You can't consider something in a bill. You have to legislate for something in a bill." That exchange crystallised frustration among MPs that planning talk was outpacing concrete drafting.
Committee witnesses were stark in their assessments of private-sector culture. Daniel Kokotajlo, executive director of the AI Futures Project, described a package of controls he called the "least bad plan," urging "Don't do recursive self-improvement. Have a lot more transparency into the industry and a lot more regulation into the industry, so that it proceeds with the appropriate levels of transparency and caution." MPs were told that model developers could not be trusted to regulate themselves, and Byrne summarised the testimony bluntly: "You have told us that the safety culture across the industry is catastrophic, that the safety culture in individual companies is in the wrong place, that the competitive dynamics between the companies are exacerbating these risks, that we cannot trust these companies to self-regulate."
What this means for technologists, policymakers, and affected enterprises
- Technologists and security teams: They will be watching whether the bill is amended to require reporting of "serious incidents and near misses" and to define how "AI-driven disruption across the organizations is contained," as Jones described. Anthropic's projection and Booz Allen Hamilton's warnings will likely sharpen operational planning around containment and resilience for IoT and industrial systems.
- Policymakers and regulators: Departments must decide whether to embed AI-specific measures into the Cyber Bill or to pursue other instruments. The Information Commissioner's Office has already published principles to apply data protection law to AI, and that sector-specific regulatory approach contrasts with the centralised, bill-driven route some MPs pressed for during the hearing.
- Affected enterprises and procurement leaders: Companies that operate critical infrastructure or manage large IoT estates will be attentive to whether the bill creates new reporting duties or preparedness requirements. The committee testimony signalled a parliamentary appetite for clearer obligations if the government chooses to legislate.
The record from this week's hearing is straightforward: ministers have promised to legislate "wherever necessary," and the AI minister has vowed to "use every power at our disposal," but officials have not yet committed to specific AI safeguards in the Cyber Security and Resilience Bill. The immediate question is procedural — whether DCMS will table concrete amendments rather than leaving AI policy at the level of "considering" changes — and the committee's blunt intervention, "You can't consider something in a bill," makes plain the impatience that will shape the next phase.
