UK government AI security strategy: first steps set out, most detail still to come

The UK government’s AI security strategy, announced on Monday 12 October 2026, sets out new national defences against risks from increasingly powerful artificial intelligence. Ministers say they will put frontier AI to work finding weaknesses in public systems, and will look at stronger legal protections for essential services. The detail of most measures has yet to be worked out.

Speaking at Imperial College London’s Base One incubator, AI Minister Kanishka Narayan said: “I want Britain to become one of the hardest countries in the world to attack using artificial intelligence.” The government’s press release describes the measures as “the first steps on a longer journey”.

What is changing and when

The first change is practical and already under way. According to the government, two pilots have helped identify and fix over a thousand potential cyber vulnerabilities across government systems, and detect potential threats. That programme will now be extended, with the aim of longer-term adoption across the public sector.

The second is legal and much less settled. The government said it will explore strengthening parts of the Cyber Security and Resilience Bill and the wider regime, so that essential services such as hospitals and utilities are better protected. That includes what it calls AI loss of control risk, where autonomous AI systems evade human oversight. Ministers will also consider how serious AI incidents and near misses can be identified and reported, and how lessons can be learned quickly.

Third, the National Cyber Security Centre (NCSC) and the AI Security Institute are examining how incidents involving AI agents should be handled. These are systems that can carry out complex tasks with little human supervision. The government said such an incident could play out faster and wider than the major incidents it is designed to respond to, and that this will require new expertise and capabilities.

The government said the detail of any measures will be worked through with parliamentarians, technical experts and the operators who would deliver them. It also said more on support for UK AI verification, which checks claims about how AI systems were built and tested, will follow “in the coming months”.

Video: Bank of England Governor on AI risks and the need for controls (BBC Politics / YouTube)

Who is affected by the government’s response to AI security threats

The most direct effect falls on the operators of essential services. The government named hospitals and utilities specifically, and Narayan’s speech and the press release focus on infrastructure and public services. Banks are not named in the government’s material, so any claim about new duties for them would go beyond what has been announced.

Developers of frontier AI are also in the frame. Narayan told them: “Listen when your scientists warn of serious dangers. Investigate unexpected behaviour. And if you cannot adequately control the risks, do not release the system.” He also confirmed that AI Security Institute scientists are now evaluating the latest generation of models, following work with leading developers and the US government.

For households, the sources say nothing about bills or charges. The government has not said what new requirements would cost or who would pay. The case it makes is that stronger defences reduce the risk of disruption to services people rely on, and that is the extent of the claim.

What supporters and critics say

Cyber Minister Liz Lloyd said the measures put “cyber security and AI preparedness at the heart of the UK’s digital future”.

Resilience Media said much of the government’s response remains on the drawing board, noting that ministers have yet to say when they might introduce new safeguards, what they would require of AI developers, or how Britain would respond if an autonomous system caused a major incident. The Guardian reported that safety experts want faster action on risks ranging from cyber-attacks on essential infrastructure to novel bioweapons.

The Guardian also quoted Geoffrey Irving, a former chief scientist at the AI Security Institute, who said: “The AI companies do not have security that would prevent an adversarial country from stealing the models.” OpenAI told the paper it has multiple protections against theft, including encryption and continuous monitoring. The Guardian added that the UK has not signed an international call for common safety standards backed by countries including France, Germany and Australia.

What to do now

Nothing in the announcement requires action from the public. For businesses and organisations, the government pointed to an open letter ministers sent earlier this year. It asks them to take cyber security seriously at the top of the organisation, get the basics right with Cyber Essentials, and follow NCSC advice, including signing up to its Early Warning Service.

The timeline is short on dates. The table sets out what has been confirmed and what has not.

Beyond that, the Prime Minister’s AI Taskforce will focus in the coming months on the areas most affected by AI, and AI will be central to the UK’s G20 Presidency next year. Anyone running a hospital, utility or other essential service should watch for the detail on incident reporting, which the government says it will work through with the operators who would deliver it.