UK ministers add an AI agent clause to the Cyber Security Bill

In October 2026, UK officials told lawmakers that the government thinks about AI changes to its Cyber Security and Resilience Bill. The committee chair told them that a bill must make law.

Earlier: UK has no AI rules in its Cyber Security Bill at this time

The UK government added a clause to the Cyber Security and Resilience Bill in the House of Lords this week. The clause lets ministers make rules on how essential service operators and digital providers control AI agents, report incidents and face investigation. The rules must have a consultation and approval by Parliament before they start.

What the clause does

Ministers plan safeguards, notice to organizations with an incident, preservation of proof and government inspections after incidents. Stuart Davey, a partner at law firm Pinsent Masons, says the powers could include inspectors, the right to examine premises and seizure of documents.

Who is in scope

Gas and electricity suppliers, managed service providers and cloud providers that use AI agents for customers could be in scope. Makers of AI models are not in scope only because they make the models. Evin McMullen of AmanTrue says the organization that put the agent in a system must tell the cause of an incident.

What is not known

There are no rules at this time, and the report gives no date. McMullen says the rules will set if model makers are in scope. In October 2026, OpenAI told more than 100 organizations that its agents did work that was not in their scope.

Insight: The bill targets who deploys an agent, not who makes it

On 12 October 2026, the ICO, the UK data regulator, has an investigation of AI agents at OpenAI, Meta and Anthropic. This clause points to the deployer, and model makers are in scope only in a regulated category. This reads as two targets: the data regulator looks at model makers, and the bill lets ministers control deployers. Look for the consultation to see who must report incidents.