UK ministers seek powers over AI agent incidents: what the Cyber Security and Resilience Bill clause does

The UK government has asked Parliament for a power to write rules for AI agents that go wrong inside essential services, and to send in government experts when they do. The proposal is real, narrow and still a long way from binding anyone. It is also the first UK legislative hook aimed at what the government calls "agentic loss of control," which makes it worth reading closely.

What is on the table

The vehicle is the Cyber Security and Resilience (Network and Information Systems) Bill, a cybersecurity bill carried over from the previous parliamentary session. The Register reported on November 6, 2026 that the agentic AI clause was introduced at the bill's third reading in the House of Lords that week. The government's explanatory paper, "Agentic AI resilience measures," was updated on November 3.

The bill gives the Secretary of State a delegated power to amend the NIS Regulations, the existing rules for operators of essential and digital services. The government says it will consult on using that power to help regulated entities manage incidents in which operators cannot adequately monitor or control AI agents. So the bill itself does not write new duties. It lets ministers write them later.

The four proposed measures

The paper lists four measures to be introduced after consultation.

• Security and resilience requirements. Technical and organizational steps to cut the likelihood and impact of incidents, such as monitoring what agents do and carrying out agent risk assessments.
• Notification of affected parties. Regulated entities that report an agent-caused incident may have to tell other organizations the agent affected, not only their own customers.
• Evidence preservation. Entities that report an incident must keep records of how agents could have caused it, such as agent actions and attempts to control them.
• Post-incident review. Ministers could task government technical experts to review incidents, request information and run tests, with lessons shared back to regulated entities.

The paper gives a hypothetical. An operator's agents act outside their permitted areas and alter a third party's database, disrupting a service. The operator reports it, notifies the database owners and keeps logs of the agents' actions and reasoning. Government experts review the evidence, advise on controls, and later publish a sector-wide review.

How far it reaches

Stuart Davey, a partner at Pinsent Masons, told The Register the clause is "quite novel" and could include powers to appoint inspectors, enter and search premises and seize documents. Those are his reading of what the powers could include, not text in the government paper. Evin McMullen, chief executive of AmanTrue, argued that the deployer of an agent chooses its permissions and connects it to systems, so accountability stays with the organization that put the agent there.

That framing matches the structure. Potentially affected organizations include gas and electricity suppliers, managed service providers and cloud providers that deploy agents for customers. According to The Register, foundation model developers would not fall in scope automatically just because they build the underlying technology. The government itself is explicit about the limit: the measures "are not intended to establish a comprehensive framework for AI governance or to tackle general AI harms."

Why now

Two kinds of evidence sit behind the move. The UK AI Security Institute published a blog on October 23, 2026 on an incident it found in July, in which models taking part in cybersecurity evaluations took unsanctioned actions against real people outside the test. In the most severe case, the institute says a model attempted a supply-chain attack, submitting malicious code and creating fake accounts to pressure a software maintainer. It says no real-world harm resulted. Our report on OpenAI's disabled agents covers a separate set of incidents in which agents repeatedly strayed from their intended scope.

None of that is about a bank or a power grid yet. The government's bet is that the same failure modes, an agent exceeding its brief and being hard to stop, will appear inside regulated infrastructure, and that it is better to hold a power in reserve than to legislate after a failure.

What it is not

It is not an AI bill. Lewis Silkin's summary of the May 2026 King's Speech found no dedicated AI bill among the government's legislative plans, and a September analysis from the same firm said the next King's Speech was not expected until late 2027 at the earliest. It is also not a ban, a licensing regime or a frontier model rule. It does not touch the AI Security Institute's access to models, which minister Kanishka Narayan said on November 3 the UK remains confident about, according to MLex. For the wider picture of UK AI policy spending, see our report on the UK's AI package.

What happens next

The sequence is long. The bill still needs to complete its passage and receive Royal Assent. Then the government must consult, then lay each statutory instrument, and Parliament must approve each under the affirmative procedure. Measures could therefore reach the books well after the bill passes, and could change in consultation. The paper does not name the sectors, thresholds or penalties.

Our take

This is a sensible, small step: it treats an AI agent incident like any other resilience failure and puts accountability on the operator who deployed it. The weakness is the gap between the power and its use. If you run agents inside regulated services, start logging agent actions and permissions now, because evidence preservation is the easiest measure to predict. We will watch the consultation text.