The government is considering stronger incident-reporting rules for essential services after frontier AI tools helped security teams identify and patch more than a thousand potential vulnerabilities in government-led pilots.
What was announced
On Monday ministers said they would explore amendments to the Cyber Security and Resilience Bill regime so hospitals, utilities and telecoms operators can better record serious AI-related incidents and near misses. The work sits alongside efforts with the National Cyber Security Centre and the AI Security Institute on how autonomous agents should be handled when they misbehave at scale.
Officials are particularly focused on “loss of control” scenarios where agentic systems act without meaningful human oversight. They argue that such events could unfold faster than traditional major-incident playbooks assume.
Why near misses matter
Cyber policy has long struggled with under-reporting: organisations fear reputational damage if they disclose probes that never became breaches. Near-miss registries, if designed carefully, could give NCSC analysts pattern data without punishing every misconfigured server.
The pilots cited by ministers used frontier models to scan code and infrastructure for known weakness patterns. Finding 1,000 issues sounds dramatic, but defenders note that many may be low severity; the policy question is whether reporting mandates will distinguish critical findings from noise.
Sector obligations
Existing NIS regulations already require some operators to notify significant incidents. The proposed AI layer would clarify how automated decision systems fit into those duties, especially when a model triggers an outage indirectly—say, by misclassifying a maintenance window.
NCSC guidance published this month on disruptive attacks urges boards to map critical data and practise recovery, regardless of whether the entry vector is phishing or an AI-generated exploit chain.
What businesses should do now
Operators should document how AI tools access production systems, limit credentials, and keep humans in approval loops for destructive actions. If the Bill gains near-miss clauses, legal teams will need templates ready before regulators ask for retrospective logs.
Parliament will still debate details with industry, but the direction is clear: AI is moving from innovation slides into the same resilience regimes that govern power grids and NHS networks.
Insurance implications
Underwriters are already asking cyber policies whether AI agents can modify firewalls. If near-miss reporting becomes mandatory, premiums may rise unless firms show disciplined access controls and audit logs that satisfy loss adjusters.
Editors will update this file if ministers publish new data later in the day.