UK adds AI-driven cyber threats to national risk register

The UK government has updated its National Risk Register to warn that increasingly capable AI tools could help criminals and hostile actors launch cyber-attacks on essential infrastructure and public services. The Cabinet Office assessment identifies threats to water supplies, police communications systems and national data networks, linking the shift to faster AI development, geopolitical tensions and climate-related pressures.

Seven new risks have been added, including attacks on water infrastructure and a new “digital resilience failure” category for widespread technology outages. The register cites the global CrowdStrike IT disruption in 2024 as an example of failures that can affect airlines, businesses, transport networks and public services. Interference in UK democratic processes has also been added, while disruption to Russian gas supplies has been removed after ministers said reliance on Russian energy had fallen significantly.

A national resilience campaign is planned for later this year to encourage households to prepare for disruption to power, water, mobile networks or essential supplies. Schools and colleges will receive new resources, and regional mayors could gain a more formal emergency response role. The Home Defence Programme will stage Operation ALBISTON SHADOW in 2027 alongside NATO’s CMX27 exercise, while classified emergency plans known as the “War Books” are being updated for the first time since 2004.