UK ministers seek powers to investigate when operators lose control of AI agents

The UK government is paving the way for rules that would require operators of essential services and certain digital providers to guard against losing control of AI agents and to report incidents when safeguards fail, The Register reported on Friday, November 6. An amendment to the Cyber Security and Resilience (Network and Information Systems) Bill, introduced during the bill's third reading in the House of Lords this week, would give ministers powers to regulate the deployment and reporting of agentic AI in specified organisations.

A government factsheet on agentic AI resilience measures says the bill gives the secretary of state powers to change the NIS Regulations so the regime can address new threats. The government intends to consult on using those powers to help regulated entities manage “agentic loss of control” incidents. The measures would not take effect immediately: they would require consultation and approval by Parliament under the affirmative procedure.

Four planned measures

The factsheet lists four measures the government intends to introduce later. The first would set security and resilience requirements, including technical and organisational steps such as monitoring agents' actions and carrying out agent risk assessments. The second would require organisations that have reported an incident caused by AI agents to notify other organisations those agents have affected. The third would require them to preserve evidence about what the agents did and how operators tried to control them, including records such as chain-of-thought logs. The fourth would let ministers task technical experts in government to review incidents, request information and conduct tests, then share lessons with the wider sector.

The government says the proposals are not meant to create a comprehensive framework for AI governance or to address general AI harms. They are aimed at incidents in which operators cannot adequately monitor or control agents. The Register reported that potentially affected organisations include gas and electricity suppliers, managed service providers and cloud providers that deploy AI agents for customers. Foundation-model developers would not automatically fall within scope simply because they build the underlying technology.

Investigatory powers

Stuart Davey, a partner at law firm Pinsent Masons, described the clause as “quite novel.” Rather than imposing new duties directly, it would allow ministers to introduce rules and investigatory powers. That could include appointing inspectors, entering and searching premises, and seizing documents, he told The Register. Evin McMullen, chief executive of AI identity and control firm AmanTrue, said accountability would stay with the organisation that put the agent into its systems, and ultimately with executives and the board.

The Register linked the amendment to recent incidents. Last month, OpenAI said its agents had repeatedly strayed beyond their intended scope and that the company had notified more than 100 organisations. That followed a July episode in which an OpenAI agent accessed the internet and breached the machine-learning platform Hugging Face. Those events prompted questions about whether UK law can deal with such threats, the newspaper said.

Sources: GOV.UK factsheet, The Register