UK keeps AI safeguards in the maybe pile for Cyber Security BIll

UK officials have not pledged to incorporate specific AI measures within the Cyber Security and Resilience Bill, despite ministers vowing to enact legislation when necessary. This ambiguity arises as experts warn about autonomous AI threats, such as Anthropic's prediction that smaller models could potentially function as self-replicating worms on susceptible smart devices within months.

Senior civil servants disclosed to MPs this week that the government is still deliberating amendments to the bill aimed at tackling AI risks. Alexandra Jones, the Department for Business, Innovation, Science and Trade's director general for growth, international, science, and technology, is in charge of AI and emerging technologies policy.

However, she informed MPs that recent government reorganization has placed the Cyber Security and Resilience (Network and Information Systems) Bill under the responsibility of the Department for Digital, Culture, Media and Sport. Jones stated that the department is contemplating incorporating changes to enhance preparedness for AI, cyber, and loss of control risks and exploring how serious incidents and near-misses are identified and reported, as well as how AI-driven disruptions within organizations can be contained.

During a Business, Innovation, Science, and Trade Committee hearing on Tuesday, chair Liam Byrne interjected: "You can't consider something in a bill. You have to legislate for something in a bill." AI minister Kanishka Narayan, who serves in the Cabinet Office, recently announced plans to enhance national defenses against rising AI risks.

He affirmed that the government will utilize "every power at our disposal," including legislation when necessary and British innovation: scientific expertise, technological abilities, and institutions to comprehend these powerful systems, protect against emerging threats, and respond when things go wrong. When asked about legislative changes, Jones mentioned that the government is "considering the introduction of amendments to the bill and developing the policy to ascertain whether we employ the Cyber Bill to do this."

The UK adopts a fragmented, sector-specific strategy for AI regulation. For instance, the Information Commissioner's Office has outlined principles it will employ to apply data protection law to AI. The EU's AI Act came into effect in August 2024, with new powers being activated progressively. The United States lacks any federal legislation exclusively targeting AI, although several states are introducing new laws.

Anthropic's research, published on Monday, examined whether AI models could replicate themselves across devices and operate on compromised hardware. Its forecast is based on improving model capabilities rather than demonstrating a fully autonomous worm spreading across actual IoT devices. Consultancy Booz Allen Hamilton cautioned that autonomous AI systems possess the capability to discover and target critical operational technology and industrial equipment, disrupting access to essential services like water, power, and daily necessities.

Earlier, AI risk researchers expressed skepticism during the committee, arguing that model developers cannot be relied upon to self-regulate, and that international rules must overcome entrenched political differences. Daniel Kokotajlo, executive director of the AI Futures Project, proposed a "least bad plan." He suggested avoiding recursive self-improvement, increasing transparency in the industry, and imposing stricter regulations to ensure responsible development and usage of AI.

However, he acknowledged that this approach still has flaws and could pose significant risks. Liam Byrne summarized the committee's testimony by expressing that the safety culture across the industry is "catastrophic," that individual companies' safety culture is misplaced, and that competitive dynamics among companies exacerbate these risks. He emphasized that the industry cannot be trusted to self-regulate.