5SEP

Peers table AI amendments to cyber bill

3 min read

12:09UTC

Peers want frontier AI developers to report when their models are used to break into regulated networks, ahead of the cyber bill's Lords report stage on 26 October.

← Back to Four privileged platforms under live attack Jump to analysis ↓

TechnologyAssessed

Key takeaway

Peers will debate frontier AI incident reporting and shutdown powers at report stage on 26 October.

Peers have tabled amendments to the Cyber Security and Resilience Bill, which widens UK cyber-security duties to cover more operators and their IT suppliers⁠¹. Baroness Dido Harding wants developers of the most capable AI models, known as frontier AI, to tell regulators when their models are used to break into a regulated network, with penalties for failing to report. The House of Lords debates the amendments at report stage, its last line-by-line chance to change the bill, on 26 October.

Lord Tim Clement-Jones wants regulations able to give the Secretary of State last-resort powers to order data centres or large AI systems shut down in an AI security emergency. He also wants "managed service" narrowed to providers with privileged access, which decides which UK managed service providers fall inside the law. Lord Lionel Tarassenko wants the AI Security Institute to audit frontier AI products before they are used in regulated systems.

The bill finished Lords Grand Committee and was reprinted on 7 September, after reaching committee in July. The Scottish Parliament gave its legislative consent on 7 October⁠². These are backbench and opposition amendments and may be withdrawn before a vote.

Deep Analysis

In plain English

The Cyber Security and Resilience Bill is a UK law going through Parliament. It updates rules that make important services, such as energy, water and the IT companies that support them, protect themselves against hacking and report attacks. The House of Lords is now proposing changes. One would make companies that build the most powerful artificial intelligence systems report when their AI is used to hack into a protected network. Another would let the government order data centres or big AI systems to shut down in an emergency. The Lords will debate these ideas on 26 October. Most changes proposed by individual peers are dropped or voted down unless the government backs them.

Deep Analysis

Root Causes

The UK has no AI statute, so peers worried about frontier models use whatever bill is passing through. The Cyber Security and Resilience Bill is the nearest vehicle because it already regulates data centres and managed service providers.

The AI Security Institute, set up in November 2023 as the AI Safety Institute, has no statutory powers. Lord Tarassenko's audit clause would hand it a regulatory role for the first time.

The definition of 'managed service' decides which IT suppliers fall inside the law. Narrowing it to providers with privileged access, as Lord Clement-Jones proposes, would exclude many smaller suppliers the government intended to cover.

What could happen next?

Precedent
If any AI duty survives report stage, it would be the UK's first statutory reporting obligation on frontier model developers.
Risk
Narrowing 'managed service' would leave many smaller IT suppliers outside the regime despite exploited management consoles at providers this year.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: In 2025 Baroness Kidron's amendments to the Data (Use and Access) Bill, requiring AI developers to disclose copyrighted training material, passed back and forth between the Houses five times. Peers gave way in June 2025 and the bill became law without them, the usual fate of AI duties bolted onto a bill about something else.

Counter-parallel: During the Online Safety Bill in 2023, peers pressed for bereaved parents to get access to their children's social media data through coroners. The government accepted the change, showing a narrow, evidenced Lords amendment can survive where a broad one does not.

A data-centre shutdown power would add a new operating risk for UK colocation and cloud providers, who sell on guaranteed availability. Even a last-resort power can raise insurance and contract costs if customers price in a government-ordered outage.

Frontier developers mostly operate from the US, so an incident-reporting duty with penalties would test how far UK regulators can enforce against companies with little UK presence.

Consensus view: Baroness Harding's clause moves a reporting duty from the victim to the toolmaker: under the bill's network and information systems model, the regulated operator reports an incident, while her amendment would also oblige the developer whose model was used to break in. That treats a frontier model as part of the attack chain, a category the bill as passed by the Commons never contemplated.

Counter-view: The EU already places this duty elsewhere: Article 55 of the AI Act requires providers of general-purpose models with systemic risk to report serious incidents to the European AI Office. Putting an equivalent clause in a cyber-security bill, rather than AI legislation, would leave the UK with an AI reporting rule owned by network regulators who have no model-evaluation expertise.

Key tension: Whether the government accepts any AI duty in this bill, or holds the line that AI belongs in separate legislation it has not yet introduced.

Sources:UK Parliament·UK Parliament

Mentions:Cyber Security and Resilience Bill →Scottish Parliament →UK AI Security Institute →House of Lords →AI Office →Parliament →Dido Harding →Tim Clement-Jones →Lionel Tarassenko →EU AI Act →United Kingdom →Beeban Kidron →Data (Use and Access) Act 2025 →Online Safety Act 2023 →

First Reported In

Update #14 · China alert puts old bugs on a 3-day clock

UK Parliament· 12 Oct 2026

Read original →

Causes and effects

Caused by

Cyber resilience bill at Lords committee

The bill's July committee stage led to Grand Committee completion and report-stage amendments.

Occurred 22 Jul 2026

Read story →

This Event

Peers table AI amendments to cyber bill

The amendments would pull frontier AI developers into UK cyber-incident law for the first time.

Different Perspectives

Hospital Sírio-Libanês

Hospital Sírio-Libanês said a 21 September attack reached a reporting system for its social projects, possibly exposing patients' and staff identity numbers and health information, while its general patient database was untouched. It notified the ANPD and the Polícia Federal and warned of fraud attempts.

The Foschini Group

The Foschini Group told the Johannesburg exchange on 13 October that an attack found on 11 October disrupted IT systems at its TFG London brands, while stores stayed open. It has not identified the attackers or established whether personal data was taken.

FirstVDS

FirstVDS said attackers used a VMmanager 6 flaw to copy customers' passwords, cloud credentials and cryptocurrency wallets from beneath their virtual servers, and told notified customers to assume theft and rotate credentials. ISPsystem's flaw was not fully fixed on 19 October.

ESET

ESET says Russia-aligned UAC-0099 phished a Ukrainian grain logistics firm in July 2025 and apparently passed its access to GRU-linked Sandworm, which wiped the company's data that September. It treats the attackers' use of the Yggdrasil network as a first for a state-aligned actor.

JPCERT/CC

JPCERT/CC issued emergency alert AT-2026-0032 on 14 October as EG Secure Solutions confirmed attacks on the SiteGuard Server Edition flaw. It told operators to save diagnostic data before updating, because the update may erase traces of the attack.

Cyber Security Agency of Singapore

The Cyber Security Agency of Singapore said on 20 October that attackers are exploiting Ivanti Connect Secure, seven days after Ivanti's disclosure, having flagged PAN-OS exploitation on 16 October. It issued a PHP2Shell alert on 21 October, the day the fixes shipped.

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.