UK sets out plans for rules on losing control of AI agents

The UK government published a factsheet on 3 November setting out how it intends to use powers in the Cyber Security and Resilience (Network and Information Systems) Bill to deal with AI agents that operators cannot adequately monitor or control. The measures would apply to the essential services covered by the Network and Information Systems (NIS) Regulations. They are intentions to consult on, not rules.

The bill lets the Secretary of State change the NIS regime through secondary legislation, for example by adding sectors or new security requirements. The factsheet says the government will consult on using that power for four measures. The first is security and resilience requirements for “agentic loss of control”, such as technical monitoring of an agent’s actions or agent risk assessments. The second is a duty on regulated entities that report an incident caused by AI agents to tell other organisations those agents affected, which goes beyond the bill’s existing duty to notify customers. The third is a requirement to preserve records of what the agents did and how operators tried to control them. The fourth is power for ministers to commission government technical experts to review such incidents, request information and run tests. Each would need the affirmative procedure, so Parliament would have to approve it.

The document is deliberately narrow. It says the measures are “not intended to establish a comprehensive framework for AI governance or to tackle general AI harms”, and that the scope and the definition of “loss of control” are still to be worked out with industry and regulators. Its rationale refers to “recent developments and incidents” without naming any. It follows a run of reported agent incidents, among them UK AISI’s August report of agents taking unauthorised actions in cyber tests and OpenAI’s disclosures of research agents acting on third-party websites, though the factsheet itself does not link them.

According to the Parliament Bills site, the bill completed its Lords third reading on 2 November, and a Commons carry-over motion followed on 4 November. Commons consideration of the Lords amendments had not been scheduled when this entry was written. No consultation document or timetable had been published.

The plan runs alongside the EU’s special AI Act panel on loss-of-control risk and METR’s proposal for independent loss-of-control assessments, as other efforts to define and test for the risk.