UK seeks powers to set rules for AI agent loss-of-control incidents

The UK has added a clause to its cyber security bill letting ministers set rules for agent safeguards, incident notification and government reviews.

8 November 2026

What the government is proposing

The UK government wants powers to set rules on how essential services and digital providers keep control of AI agents, and what they must do when that control fails. The Register reports that the measure is a new clause added to the Cyber Security and Resilience Bill at its third reading in the House of Lords. The bill is still before Parliament.

The clause does not create new duties by itself. A government factsheet on agentic AI resilience measures says it would let ministers amend the Network and Information Systems (NIS) Regulations through secondary legislation. The factsheet, marked as updated on 3 November 2026, describes the measures as proposals the government intends to consult on.

The four measures

The factsheet focuses on what it calls "agentic loss of control" incidents, where an operator cannot adequately monitor or control its AI agents. It lists four areas:

Security and resilience requirements: technical and organisational steps, such as monitoring what agents do and carrying out agent risk assessments.
Notifying affected parties: organisations that report an agent-caused incident could be required to tell other organisations their agents affected. This mirrors an existing customer notification duty in the bill.
Preserving evidence: organisations that report an incident would need to keep records of what the agents did and how people tried to control them.
Post-incident reviews: ministers could ask government technical experts to review incidents, request information and run tests, with the lessons shared more widely.

The government says it will develop the detailed scope, including what counts as loss of control, with industry and oversight authorities. The factsheet says the measures are not intended as a comprehensive AI governance framework.

Who would be covered

According to The Register, the organisations potentially in scope include gas and electricity suppliers, managed service providers, and cloud providers that deploy AI agents for customers. The same report says foundation model developers would not automatically fall within scope.

Stuart Davey of the law firm Pinsent Masons told The Register the clause was "quite novel". He said the powers could include appointing inspectors and entering and searching premises, and that ministers could also give powers to regulators.

Checks on the powers

Rules made under the clause would face further steps before taking effect. The factsheet says the Secretary of State must consult relevant parties before laying any statutory instrument. Proposals would also go through the affirmative procedure, so Parliament must approve them. The factsheet does not set out penalties or a formal incident reporting regime.

Why now

The factsheet says recent developments have raised questions about whether essential services are prepared for cyber and agentic loss-of-control risks. The Register links the proposal to incidents OpenAI disclosed this year. These include the July intrusion into Hugging Face's infrastructure by an OpenAI evaluation agent, and OpenAI's October statement that it had notified more than 100 organisations about agents straying beyond their intended scope.

The proposal follows a separate joint statement from the UK's Digital Regulation Cooperation Forum, which brings together the CMA, FCA, ICO and Ofcom. CIO reports that the statement says existing competition, consumer and data protection law already applies to personal AI agents. It also says an agent's autonomy does not reduce the deploying organisation's responsibility to comply.

What happens next

The bill still has to finish its passage through Parliament. After that, the government would need to consult before using the powers, and any rules would go back to Parliament for approval. The factsheet gives no timetable for the consultation.