UK cyber bill adds AI containment powers and vendor safeguards

The UK Cyber Security and Resilience Bill has reached its Third Reading in the House of Lords, with changes addressing AI incidents, vendor risks and regulatory information sharing. Implementation details remain subject to consultation, and MPs will consider the Lords’ amendments when the Bill returns to the Commons.

New provisions would allow directions requiring regulated critical infrastructure organisations to isolate systems, restrict data flows or suspend automated actions during AI-related compromises, where strict national security tests are met. Proposed statutory powers for the AI Security Institute did not enter the Bill. However, expanded review obligations would examine appropriate oversight of frontier AI systems in essential activities.

The Government restored a vendor-risk regime targeting national security threats from supplied technology, with parliamentary approval required for regulations bringing entities into scope. Ministers continue to favour voluntary referrals before introducing a mandatory scheme. The Lords also backed a register of threatening state actors, which the Government may seek to remove. Near-miss incident reporting will be voluntary across regulated sectors, while regulators face explicit geographical restrictions on sharing sensitive information overseas.

Planned mandatory security requirements are expected to include board oversight of resilience frameworks and suitably skilled senior accountability. Organisations should clarify ownership of cyber risk, provide boards with meaningful resilience evidence and ensure AI failures can be contained without disrupting essential services. The Government has confirmed a business adjustment period before regulators increase compliance expectations.