UK Considers AI Risks for Cyber Security Bill Amidst Growing Threats
The UK government is debating potential amendments to its Cyber Security and Resilience Bill to address emerging AI-driven threats, including autonomous worms and attacks on critical infrastructure.
UK officials are currently evaluating whether to incorporate specific measures addressing artificial intelligence risks into the upcoming Cyber Security and Resilience Bill. Despite previous assurances from ministers to legislate on necessary fronts, the government's stance remains uncertain as it grapples with warnings about the potential for advanced AI to pose significant cybersecurity challenges.
Alexandra Jones, director general for growth, international, science and technology at the Department for Business, Innovation, Science and Trade, indicated to Members of Parliament that the Department for Digital, Culture, Media and Sport, which holds responsibility for the bill, is exploring policy options. The aim is to "improve preparedness for AI, cyber, and loss of control risks," with a focus on how "serious incidents and near misses are identified and reported, and how AI-driven disruption across the organizations is contained."
This deliberation follows stark warnings from AI research firms. Anthropic has forecast that smaller AI models could soon evolve into self-replicating worms capable of spreading across vulnerable smart devices. Concurrently, Booz Allen Hamilton has highlighted the potential for autonomous AI systems to target critical operational technology (OT) and industrial control systems, posing a threat to essential services like water and power.
During a hearing of the Business, Innovation, Science and Trade Committee, committee chair Liam Byrne pressed officials on the legislative process, emphasizing that "You can't consider something in a bill. You have to legislate for something in a bill." This highlights the urgency and the need for concrete action rather than mere consideration.
AI minister Kanishka Narayan, from the Cabinet Office, has publicly stated the government's intent to "step up national defenses against growing AI risks" and "legislate wherever necessary." However, the specifics of how this will translate into amendments for the Cyber Security Bill remain under development, with Jones noting they are "looking at" introducing such changes.
The UK's approach to AI regulation is currently decentralized and sector-specific. For instance, the Information Commissioner's Office is applying existing data protection laws to AI systems. This contrasts with the EU's comprehensive AI Act, which began its phased implementation in August 2024, and the US, which lacks federal AI legislation but sees some states enacting their own laws.
Experts testifying before the committee expressed skepticism about the industry's ability to self-regulate. Daniel Kokotajlo of the AI Futures Project proposed a "least bad plan" involving a moratorium on recursive self-improvement and increased transparency and regulation within the AI industry. He warned that "the safety culture across the industry is catastrophic" and that competitive pressures exacerbate risks.
The government's cautious approach to embedding AI safeguards in the Cyber Security Bill reflects the complex and rapidly evolving nature of AI threats. As AI capabilities advance, policymakers face the challenge of creating legislation that is both robust enough to protect critical infrastructure and adaptable enough to keep pace with technological innovation, while also addressing concerns about the industry's self-governance.