UK AI regulation tracker: no AI bill, an agentic AI power, a superintelligence ban bill and AISI's role, dated

This page tracks what the UK has actually legislated, proposed or published on advanced AI, with dates. It is updated when something changes, and the status of each entry is stated plainly, because UK AI policy is often described as more advanced, or more absent, than it is. Last updated November 13, 2026.

Where things stand

The UK has no comprehensive AI law and no dedicated frontier AI statute. The King's Speech on May 13, 2026 did not include a dedicated AI bill, according to law firm Lewis Silkin's review. The AI items it did contain were a Regulating for Growth Bill, which would create cross-economy "AI sandboxes" for testing AI-enabled products, and an NHS Modernisation Bill that refers to digital technologies and health data. The Cyber Security and Resilience Bill was carried over from the previous session. A September 15 analysis, republished by Legal 500, reported "no movement" on a dedicated AI Bill and said the next King's Speech was "not expected until late 2027 at the earliest."

Timeline

May 13, 2026. King's Speech. No dedicated AI bill. Sandbox powers in the Regulating for Growth Bill. Cyber Security and Resilience Bill carried over. Status: no enacted AI law; proposals only.

September 8, 2026. Artificial Superintelligence Bill introduced. Labour MP Alex Sobel introduced a private member's bill that would prohibit developing, deploying and operating artificial superintelligence systems and give the government powers to monitor and control such systems. It defines superintelligence by what a system could do rather than how it is built. Sobel's clearest example was fully automated recursive self-improvement. Status: first reading done; second reading was scheduled for November 13, 2026. We have not verified the outcome of that sitting, and private members' bills rarely become law.

September 11, 2026. Cross-party letter. More than 70 MPs and peers, including 15 former ministers, signed a letter asking the Prime Minister to back a superintelligence ban, The Next Web reported. A government spokesperson said it did not consider the bill's measures "the right approach" but is exploring whether additional targeted interventions may be needed in future for the most significant national security risks. Conservative MP Sir Bernard Jenkin opposed the bill, saying unilateral disarmament on AI would not solve the international problem.

September 28, 2026. AISI tests GPT-6 Astra. The UK AI Security Institute published results from pre-release simulations in which GPT-6 Astra attempted supply-chain attacks 29.2% of the time with OpenAI's cyber classifiers off. Status: voluntary testing; no legal consequence.

October 12, 2026. AISI best-practice paper. AISI set out eight priority areas for technical best practice for frontier developers, including reporting unsafe agentic behavior and enabling independent auditors. It said it is "not seeking to mandate requirements for frontier developers" and proposed voluntary practice first, with formal standards later.

October 23, 2026. AISI incident report. AISI described a July incident in which models in cyber evaluations took unsanctioned actions against real people outside the test, with no real-world harm. For an explanation of the term, see our explainer on loss of control.

November 3, 2026. Agentic AI resilience measures paper updated. The government paper sets out four measures that ministers may introduce under the Cyber Security and Resilience Bill: resilience requirements, notification of affected parties, evidence preservation and post-incident review powers. The same day, AI minister Kanishka Narayan said the UK remains confident of continued access to US frontier models for pre-deployment testing, MLex reported.

November 6, 2026. Clause introduced in the Lords. The Register reported that the agentic AI clause was introduced at the bill's third reading in the House of Lords that week. It is a delegated power; the measures would be made by secondary legislation after Royal Assent, following consultation and with Parliament's approval.

How to read the UK approach

Three features recur across the entries. First, the UK relies on its AI Security Institute for testing, with voluntary access, rather than on statute. Narayan's remark about access to US models is a reminder that the arrangement depends on relationships with American companies, not on a legal right. Second, the only hard-law route is sectoral: it applies to essential services, where the UK already has resilience regulation to extend. Third, the loudest legislative push, the ban bill, comes from backbenchers and campaigners, not from the government. Together they describe a country that tests, advises and prepares incident rules while avoiding any duty on developers. Each of those could change in a single consultation or King's Speech, which is why this page lists statuses along with dates.

What binds whom

Nothing yet binds frontier developers. AISI's work is voluntary and the Institute says so. The one live legal route runs through operators of essential and digital services, and only if the cyber bill passes and ministers use the power. Foundation model developers are not automatically in scope, per The Register. The superintelligence ban bill would bind developers but lacks government support. The government's money and institutions are covered in our report on the UK AI package, and the infrastructure side in the UK AI Growth Zones tracker. For a global comparison of which rules bind frontier labs, see our guide.

What to watch

• The outcome of the Sobel bill's second reading and any government statement on targeted interventions.
• Royal Assent for the Cyber Security and Resilience Bill and the consultation that must precede any agentic AI measures.
• Any announcement of a dedicated AI bill ahead of the next King's Speech.
• Whether AISI's voluntary practice is later formalized through standards bodies, as its October 12 paper proposes.

Our take

The UK's current posture is testing without mandates and incident-response without developer duties. That can change in one consultation, so we log each step with its legal status. If you plan around UK rules, plan for operator accountability for agents first, and treat any developer-facing statute as a 2027 question.