On 15 October 2026, The Register reported that UK officials had told MPs the government is considering amendments to the Cyber Security and Resilience Bill to deal with risks from advanced AI. Alexandra Jones, a senior official responsible for AI policy, said the government was “looking at” amendments and “developing the policy”, including how serious incidents and near misses would be reported. A day earlier, a House of Commons Library briefing confirmed that the UK still has no AI-specific law.
What changes
Nothing has changed in law yet. The UK regulates AI through existing sector regulators rather than a single act. Labour promised binding rules for the most powerful models in 2024, but no bill has been introduced. According to the Library briefing, the AI minister called for mandatory pre-deployment testing after developers reported cybersecurity incidents during internal testing, and in October pointed to the cyber bill as a possible vehicle. In September, Parliament’s Joint Committee on Human Rights called for an AI bill and a new regulator. In October, the Information Commissioner’s Office (ICO) published its expectations for generative AI developers, particularly on training with personal data. At the hearing, committee chair Liam Byrne told officials: “You have to legislate for something in a bill.”
What it means for founders
Most UK startups that use AI, rather than build frontier models, are unlikely to be the main target of new duties. The more likely change is incident reporting. If AI measures join a cyber resilience law, firms that supply services to regulated sectors could face reporting duties for AI failures, as they do for cyber incidents. For now, data protection law is the rule that bites, and the ICO’s generative AI expectations are the most concrete guidance available. Businesses selling into the EU also face the EU AI Act, whatever the UK decides.
What to do now
- Read the ICO’s generative AI expectations if you train or fine-tune models on personal data.
- Keep a simple register of the AI tools you use, what data they touch and who owns each one.
- Track amendments to the Cyber Security and Resilience Bill if you supply IT or managed services to regulated sectors.
- If you want help setting up light AI governance, our tech advice service covers it.
Sources: The Register, UK keeps AI safeguards in the maybe pile for Cyber Security Bill; House of Commons Library, AI regulation in the UK
This is general information, not legal or tax advice.