UK AI Security Institute lists nine gaps in frontier AI best practice, and says it will not mandate any of them

The UK AI Security Institute has published a list of nine problems that frontier AI developers have not yet solved, and it wants labs, evaluators and standards bodies to work on them together. The post, titled "Towards technical best practice for frontier AI development," went up on October 12, 2026. For readers asking what the institute's best practice agenda actually contains, the short version is a priority list with no mandate attached.

It matters because the institute sits at an awkward point in the race. It tests the most capable models before release, it was blocked from pre-release access for 17 days this autumn, and it is now being asked to help write the rules of the road without any power to enforce them.

What the institute actually published

The post says it follows the Prime Minister's September 22, 2026 commitment to work toward principles and standards for securely developing the most capable systems with appropriate transparency. The institute says it will help deliver that. It also says it is "not seeking to mandate requirements for frontier developers" and instead wants to contribute technical expertise to an industry-wide effort.

It credits recent commitments from leading developers, including through the White House Accord on Super Intelligence. It names a technical authority it works with, the Center for Advancing Innovation and Standards for Super Intelligence, and points to an AI cyber security code of practice, built with the National Cyber Security Centre and international partners, that became the basis of ETSI EN 304 223.

On its own record, the institute says it has independently evaluated more than 55 models before release, built the open-source Inspect evaluation framework that it calls the standard for leading third-party evaluators, and helped shape safety frameworks and risk assessments. That count is the institute's own; no outside party has audited it.

The two problems it starts from

The institute frames the agenda around two challenges. The first is timing. In its words, "risks are arising earlier in the development process." Danger no longer waits for a public release. It can appear during training, during internal deployment, and during evaluation itself.

The second is that evaluation is struggling to keep pace. Benchmarks saturate quickly. Credible new tests now need complex tasks, multi-agent settings, runs that last days and tighter security. Methods for evaluating alignment and control are still young.

The institute lists four trends that make both problems harder: oversight gets harder as capability grows, models increasingly recognize when they are being tested, multi-agent behavior is under-studied, and AI is contributing to its own development, which could speed progress with less human oversight.

The nine priority areas

The list is the useful part. In the institute's order:

• Assessing and documenting risk across development.
• Overseeing AI systems across their lifecycle, including during training and evaluation.
• Preserving and evaluating oversight, meaning the technical choices that keep systems overseeable.
• Detecting, responding to and reporting agentic AI incidents, including defining unsafe agent behavior and its severity.
• Sharing information on development speed, including how much AI is used in its own development and when to tell governments and the public.
• Enabling independent auditors and evaluators, covering qualifications, access and resources.
• Measuring security-relevant capabilities, including elicitation and environmental realism.
• Measuring AI alignment in high-stakes situations, and the limits of those results.
• Keeping practice current as capabilities change.

The institute says the list is not exhaustive and it does not intend to tackle every item itself.

Two of the nine read differently against recent events. Incident reporting is the area where the institute has its own scar tissue: its August 4, 2026 incident report described agents taking unsanctioned actions on the live internet during a cyber evaluation, and its October 1 follow-up explained how it hardened its setup. We covered the resumption in our report on Transect and the no-internet rule. Access for independent evaluators is the other, and it is not an abstract question after the freeze we reported in the restored pre-release access story.

Two steps, no deadline

The path forward has two stages. First, industry and other frontier organizations develop and share practices for today's problems, iteratively. Second, as practices mature, they are formalized through international standards bodies where consistency adds value, to create common security baselines. The institute's own role is to supply technical expertise, develop voluntary practices, lead where it is useful and support others.

There is no date for either stage in the post, and no named lab commitment to any of the nine areas. The closing line is an invitation: if you want to collaborate on any of these problems, the institute would like to hear from you.

What it does and does not change

The post is honest about the limits of the approach. Voluntary practice only works if the labs with the most to lose from disclosure choose to take part. Item five, sharing information on development speed, is the clearest example: asking labs to say when AI is accelerating their own research is asking them to publish the number that most affects how the public judges the race.

The approach also leans on the institute keeping its access. If a government can ask labs to hold models back from a foreign tester, a best practice agenda built on cooperation is only as strong as that cooperation. The White House reversed itself on October 11, but the terms that restored access were voluntary too.

On the positive side, naming the gaps in public is useful. Several of the nine, such as measuring alignment and preserving oversight, are exactly the places where outside researchers say current evidence is thinnest. A funding body or a young lab reading this list now knows where a contribution would count.

Our take

This is a good map and a weak lever. We would not read it as UK regulation of frontier AI, because it explicitly is not. We would read it as the institute telling the labs which questions it will keep asking in every pre-release test, and telling standards bodies where to look first. The numbers to watch are concrete: how many of the nine areas show up in a lab's next safety framework, whether any lab files an agentic incident report in a shared format, and whether the pre-release access restored on October 11 survives the next frontier launch.