22OCT

UK AISI vets frontier models pre-release

3 min read

17:24UTC

Kanishka Narayan told MPs the AI Security Institute is testing frontier models before release, including one his letter calls Gemini 4 Argon, and that government cyber pilots fixed 1,352 flaws.

← Back to EU questions AI labs over loss of control Jump to analysis ↓

TechnologyDeveloping

Key takeaway

Britain's AI Security Institute now tests frontier models before their public release.

The UK AI Security Institute (AISI) is evaluating "the latest generation of powerful models (including Gemini 4 Argon) prior to their release", Kanishka Narayan, the Cabinet Office minister for AI, told the Commons Science committee in a letter dated 12 October⁠¹. The Cabinet Office took on AI policy when the government split its Science department across three bodies in July. Nothing in the letter links the model or Google to any incident.

Narayan reports that Government Cyber Unit pilots used frontier AI to find and fix 1,352 vulnerabilities across 18 departments⁠². Ministers are drawing up incident-response plans for agentic AI "acting beyond their instructions" with the NCSC (National Cyber Security Centre), the Department for Digital, Culture, Media and Sport and AISI. They are also weighing loss-of-control provisions for the Cyber Security and Resilience Bill, now in the Lords.

Correction: our update of 8 September reported that the government response to the committee's July report on UK tech sovereignty, known as HC 62, had fallen due with no department left to answer it. That was wrong. The committee records the response as received on 4 September and published it on 15 September as HC 652⁠³. It came from the Department for Business, Innovation, Science and Trade (DBIST), led by Jonathan Reynolds⁠⁴.

The reply restates an "own-collaborate-access" approach and says the UK will not "replicate every layer of the global AI stack". Chi Onwurah, the committee chair, wrote to Reynolds on 15 September that it did not fully address the paragraph on sovereignty, and asked for more by 29 September⁠⁵.

Deep Analysis

In plain English

The UK AI Security Institute is a government body that checks powerful AI systems for dangers, such as helping with cyber attacks or acting in ways their makers did not intend. Companies let it test some models before the public can use them. Kanishka Narayan is the UK minister for AI. He wrote to the Commons Science committee, a group of MPs who scrutinise government on technology. His letter says the institute is testing new models, including one from Google. It also says ministers may add rules on AI that escapes human control to a cyber-security law now being debated in the House of Lords.

Deep Analysis

Root Causes

The July reorganisation split UK tech policy across several homes.

The Department for Science, Innovation and Technology was abolished on 20 July, and AI strategy and the institute moved to the Cabinet Office, while the sovereignty brief went to the Department for Business, Innovation, Science and Trade.

That split explains why one minister writes about model testing while another department answers on sovereignty. Chi Onwurah's committee now deals with two departments for one inquiry.

The testing itself depends on goodwill. The labs whose models it tests are US-owned, Google DeepMind in London included, so access rests on the labs' willingness to submit models early.

What could happen next?

Precedent
Loss-of-control duties in the Cyber Security and Resilience Bill would be the UK's first statutory rule aimed at frontier AI behaviour.
Medium term · Suggested
Consequence
The committee is likely to keep pressing for a fuller sovereignty answer from the business department.
Short term · Assessed
Opportunity
The Government Cyber Unit results give departments a case for wider use of AI vulnerability scanning.
Short term · Suggested

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: At the Bletchley Park summit in November 2023, leading labs agreed to let the UK's then AI Safety Institute test models before deployment. The arrangement was voluntary; the institute was renamed the AI Security Institute in February 2025 with the same non-statutory footing.

Counter-parallel: The Online Harms White Paper of April 2019 took until October 2023 to become the Online Safety Act. Moving AI loss-of-control duties into the Cyber Security and Resilience Bill borrows a carrier already in the Lords instead of starting that four-year cycle again.

The 1,352 fixed vulnerabilities give the first public measure of what frontier AI tools return inside government IT. The figure covers pilots only, across 18 departments.

The wider spending frame is the £1.1bn AI Hardware Plan announced in June, including a £750m national supercomputer due from 2030, and a £96m second wave of Sovereign AI procurement. Testing foreign models is cheap next to those sums, which is part of its appeal to the Treasury.

Consensus view: The Commons Science, Innovation and Technology Committee has pressed the government on strategy rather than on testing. Its 7 July report found "no coherent strategic framework" for sovereign technology, and chair Chi Onwurah said an earlier Narayan letter failed to set out a coherent strategy.

Counter-view: Ministers argue the UK does not need to own every layer to be secure. The Department for Business, Innovation, Science and Trade's reply to the committee sets out an "own-collaborate-access" approach, and pre-release testing by the institute is the "access" leg in practice: London gains early sight of US models without building rivals.

Key tension: Whether early access to foreign models counts as sovereignty when the lab chooses what to submit, when, and on what terms.

First Reported In

Update #17 · EU questions AI labs over loss of control

UK Parliament· 22 Oct 2026

Read original →

Causes and effects

Caused by

MPs name the UK's sovereignty gap

Onwurah's request for more on sovereignty follows up the committee's July report on UK tech sovereignty.

Occurred 7 Jul 2026

Read story →

This Event

UK AISI vets frontier models pre-release

Britain is putting state testing in front of frontier AI releases while weighing loss-of-control powers for a cyber bill already in the Lords.

Different Perspectives

European Centre for International Political Economy

ECIPE found nine states gave about 97% of awarded cloud lots to home providers from 2018 to 2025, and every sovereignty-framed lot went to a domestic supplier. The think tank reads sovereignty clauses as a home-bias tool that narrows competition, with a 46% sole-bidder rate on a small sample.

Mistral AI

Mistral opened a Munich industrial AI hub on 28 September with BMW and Siemens Energy work, and Germany's digital minister Karsten Wildberger praised it on the launch page. The French lab gains a German ministerial endorsement while its 21 October Nvidia partnership ties the work to US accelerators.

AWS European Sovereign Cloud

AWS will run its Brandenburg region for several hours on 24 October cut off from the AWS global backbone, with an EU-resident team. AWS says the test follows BSI's C3A criteria and will give regulators and customers verifiable evidence of separation.

Greenland government

Greenland signed a joint declaration with the EU and Denmark in September and received Virkkunen on 24 and 25 September. The Arctic Strategy now backs a cable linking Greenland directly to Europe, an alternative to Greenland Connect, which lands in Canada and Iceland.

Greek government

Kyriakos Mitsotakis inaugurated DAEDALUS at Lavrion on 19 October, a €36m machine on Nvidia GH200 chips that anchors the PHAROS AI Factory. Athens paid 65% through Greece 2.0, making national recovery money the main funder of an EU AI Factory.

ASML

ASML reported record quarterly sales of €11.66bn and said planned supply for 2027 and 2028 will not fully meet demand. It plans about 30% more capacity in 2027, and some customers want to book for 2029 and 2030.

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.