12OCT

Peers table AI amendments to cyber bill

3 min read

10:55UTC

Peers want frontier AI developers to report when their models are used to break into regulated networks, ahead of the cyber bill's Lords report stage on 26 October.

← Back to China alert puts old bugs on a 3-day clock Jump to analysis ↓

TechnologyAssessed

Key takeaway

Peers will debate frontier AI incident reporting and shutdown powers at report stage on 26 October.

Peers have tabled amendments to the Cyber Security and Resilience Bill, which widens UK cyber-security duties to cover more operators and their IT suppliers⁠¹. Baroness Dido Harding wants developers of the most capable AI models, known as frontier AI, to tell regulators when their models are used to break into a regulated network, with penalties for failing to report. The House of Lords debates the amendments at report stage, its last line-by-line chance to change the bill, on 26 October.

Lord Tim Clement-Jones wants regulations able to give the Secretary of State last-resort powers to order data centres or large AI systems shut down in an AI security emergency. He also wants "managed service" narrowed to providers with privileged access, which decides which UK managed service providers fall inside the law. Lord Lionel Tarassenko wants the AI Security Institute to audit frontier AI products before they are used in regulated systems.

The bill finished Lords Grand Committee and was reprinted on 7 September, after reaching committee in July. The Scottish Parliament gave its legislative consent on 7 October⁠². These are backbench and opposition amendments and may be withdrawn before a vote.

Deep Analysis

In plain English

The Cyber Security and Resilience Bill is a UK law going through Parliament. It updates rules that make important services, such as energy, water and the IT companies that support them, protect themselves against hacking and report attacks. The House of Lords is now proposing changes. One would make companies that build the most powerful artificial intelligence systems report when their AI is used to hack into a protected network. Another would let the government order data centres or big AI systems to shut down in an emergency. The Lords will debate these ideas on 26 October. Most changes proposed by individual peers are dropped or voted down unless the government backs them.

Deep Analysis

Root Causes

The UK has no AI statute, so peers worried about frontier models use whatever bill is passing through. The Cyber Security and Resilience Bill is the nearest vehicle because it already regulates data centres and managed service providers.

The AI Security Institute, set up in November 2023 as the AI Safety Institute, has no statutory powers. Lord Tarassenko's audit clause would hand it a regulatory role for the first time.

The definition of 'managed service' decides which IT suppliers fall inside the law. Narrowing it to providers with privileged access, as Lord Clement-Jones proposes, would exclude many smaller suppliers the government intended to cover.

What could happen next?

Precedent
If any AI duty survives report stage, it would be the UK's first statutory reporting obligation on frontier model developers.
Risk
Narrowing 'managed service' would leave many smaller IT suppliers outside the regime despite exploited management consoles at providers this year.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: In 2025 Baroness Kidron's amendments to the Data (Use and Access) Bill, requiring AI developers to disclose copyrighted training material, passed back and forth between the Houses five times. Peers gave way in June 2025 and the bill became law without them, the usual fate of AI duties bolted onto a bill about something else.

Counter-parallel: During the Online Safety Bill in 2023, peers pressed for bereaved parents to get access to their children's social media data through coroners. The government accepted the change, showing a narrow, evidenced Lords amendment can survive where a broad one does not.

A data-centre shutdown power would add a new operating risk for UK colocation and cloud providers, who sell on guaranteed availability. Even a last-resort power can raise insurance and contract costs if customers price in a government-ordered outage.

Frontier developers mostly operate from the US, so an incident-reporting duty with penalties would test how far UK regulators can enforce against companies with little UK presence.

Consensus view: Baroness Harding's clause moves a reporting duty from the victim to the toolmaker: under the bill's network and information systems model, the regulated operator reports an incident, while her amendment would also oblige the developer whose model was used to break in. That treats a frontier model as part of the attack chain, a category the bill as passed by the Commons never contemplated.

Counter-view: The EU already places this duty elsewhere: Article 55 of the AI Act requires providers of general-purpose models with systemic risk to report serious incidents to the European AI Office. Putting an equivalent clause in a cyber-security bill, rather than AI legislation, would leave the UK with an AI reporting rule owned by network regulators who have no model-evaluation expertise.

Key tension: Whether the government accepts any AI duty in this bill, or holds the line that AI belongs in separate legislation it has not yet introduced.

Sources:UK Parliament·UK Parliament

Mentions:Cyber Security and Resilience Bill →Scottish Parliament →UK AI Security Institute →House of Lords →AI Office →Parliament →Dido Harding →Tim Clement-Jones →Lionel Tarassenko →EU AI Act →United Kingdom →Beeban Kidron →Data (Use and Access) Act 2025 →Online Safety Act 2023 →

First Reported In

Update #14 · China alert puts old bugs on a 3-day clock

UK Parliament· 12 Oct 2026

Read original →

Causes and effects

Caused by

Cyber resilience bill at Lords committee

The bill's July committee stage led to Grand Committee completion and report-stage amendments.

Occurred 22 Jul 2026

Read story →

This Event

Peers table AI amendments to cyber bill

The amendments would pull frontier AI developers into UK cyber-incident law for the first time.

Different Perspectives

ENISA

ENISA's 22 September threat report found only 23.8 per cent of NoName057(16)'s assessed claims were confirmed by independent availability checks, though the group produced 48 per cent of ideology-driven activity. The agency's numbers show public administration taking 31.8 per cent of attacks, mostly ideological DDoS.

LKA Hamburg

Hamburg's State Criminal Police Office led the operation that took the KillSec leak site on 30 September, with ten countries, Europol and Eurojust. Investigators link the group to around 1,000 suspected attacks, at least 70 in Germany, and the seizure blocks access to at least 110 terabytes of victims' data.

ASOS

ASOS said an unauthorised party reached names and contact details on third-party platforms after obtaining an employee's credentials by impersonating a trusted contact. It said it does not believe payment cards or account passwords were affected, and is investigating.

Check Point

Check Point updated its advisory on 20 September to say its 9.8-rated VPN certificate flaw had been exploited on Spark firewalls since 12 September, five days after the advisory first appeared, and shipped fixes including R81.20 Take 166. It told customers using only pre-shared-key VPN communities they were not exposed.

Japan's National Police Agency

Japan's National Police Agency and National Cybersecurity Office signed advisory AA26-281A and published it on 9 October, naming SoftEther VPN, MicroScan and office-cli and indicators detected since January 2016. Tokyo says the evidence comes from several FBI criminal investigations and that it will deepen cooperation with allies.

CISA

CISA gave federal agencies three days to fix five flaws from 2015 to 2023 on the day the China advisory named Integrity Technology Group, and set the same clock on 34 of 43 September listings. It treats a named state-linked operation as reason enough to patch old software within the week.