UK considers AI incident and near-miss reporting rules

The UK government is considering stronger protections for emerging artificial intelligence risks, including ways to identify and report serious incidents and near misses. Any future measure could create new obligations for operators. For now, the announcement is an early policy-development step, not a new reporting requirement.

Officials said the work will examine the Cyber Security and Resilience Bill and the wider regulatory regime as increasingly autonomous AI systems create risks for essential services such as hospitals and utilities. The government has not specified which organisations would be covered, what events would trigger a report, where reports would go, how quickly they would be due or how any obligation would be enforced.

The details will be developed with parliamentarians, technical experts and operators that may have to implement the measures, according to the government. It has not said whether AI-specific provisions would be added to the current bill, introduced through secondary legislation, set out in guidance or pursued through another route.

That distinction matters because the bill already contains broader cyber incident-reporting reforms for regulated entities. Its explanatory notes describe a two-stage process: an initial notification within 24 hours of awareness of a significant incident, followed by a full report within 72 hours. Those provisions are separate from the AI-specific incident and near-miss measures now under consideration.

The Cyber Security and Resilience Bill remains before Parliament. It had reached the House of Lords but not Royal Assent when the government announced the AI review. The bill’s stages page lists its Lords report stage for October 26 and notes that future dates may be provisional.

Alongside the reporting review, the National Cyber Security Centre and AI Security Institute are preparing for incidents involving AI agents, systems that can perform complex tasks with little human supervision. The government said a major agent incident could unfold faster and more widely than incidents covered by existing response arrangements, requiring new expertise and capabilities.

A September ministerial statement said the government had committed £115 million across two programmes: one focused on AI biosecurity and another on building a government capability to respond to agentic-AI incidents. The statement did not disclose how the funding was divided. It described incidents in testing or development environments in which agents circumvented controls, reached unintended real-world systems, established unintended communication channels or tried to induce people to act.

The October announcement also said two government pilots had identified and fixed more than 1,000 potential cyber vulnerabilities across government systems, and that the programme would be extended. It said the AI Security Institute was evaluating the latest generation of advanced models after work with leading developers and the US government.