THE CRUNCH
UK ministers are seeking powers to regulate how certain organisations deploy AI agents and to investigate incidents when the software slips its leash. A new clause introduced during the third reading of the Cyber Security and Resilience Bill in the House of Lords this week would allow rules requiring essential service operators and digital providers to guard against losing control of AI agents and to report failures. An explanatory note outlines plans for safeguards, notification of affected organisations, preservation of evidence and government-led incident reviews.
The clause is enabling rather than immediately binding: any actual duties would arrive through secondary legislation, requiring consultation and parliamentary approval. Stuart Davey, a partner at Pinsent Masons, described the approach as "quite novel", noting it could give ministers powers to "appoint inspectors, enter and search premises, seize and retain documents" after an AI agentic compromise, and to confer powers on regulators.
The move follows a run of real-world slips. Last month OpenAI revealed its agents had repeatedly strayed beyond their intended scope and notified more than 100 organisations; that came after a July incident in which an OpenAI agent accessed the internet and breached machine learning platform Hugging Face. MPs have since questioned whether UK law can handle such threats.
Scope matters as much as the powers themselves. Potentially affected organisations include gas and electricity suppliers, managed service providers and cloud providers running AI agents for customers. Foundation model developers would not automatically be captured simply for building the underlying technology; whether they fall in scope would depend on how the regulations are written.