Is the Cyber Security Bill becoming an AI Bill? Yesterday in the UK House of Lords we had ...

we had the first day of Committee Stage of the Cyber Security and Resilience Bill (bill page linked in ).

The Bill is the UK’s first law with ‘cyber’ in its title and is essential for bringing rules governing critical infrastructure in line with modern threats, economic realities and technological developments.

We debated the Bill before the summer recess and I highlighted that the omission of AI and quantum from a law that hopes to secure ‘essential activities’ was a real problem.

Much has changed since that discussion, not least that the sponsoring department (DSIT) no longer exists and

Department for Digital, Culture, Media and Sport

(which has taken over), last week, introduced a vast number of government amendments (64) to the bill.

The government's amendments would establish a parallel high-risk vendor regime and give powers to ministers to set up a referral scheme, that could force companies to submit tech procurement contracts to the Cabinet Office for security clearance before signing.

During the debate colleagues complained that these proposals simultaneously combined expanded executive power with weak scrutiny and that. despite the changes, AI regulation remained ambiguous and reactive.

It is positive that the government is taking AI in this context more seriously, (and I have my name on 48 additional amendments) but shoehorning an AI debate into this Bill is not the right solution. We should not default to a narrow, US-frontier-model-centric view of AI that ignores the broader "constellation" of AI uses.

presented a well-supported case for statutory

hack, where roughly 1,200 AI agents coordinated on a message board, with ~700 executing an actual attack — prompting

to check its own Claude-based agents and find comparable incidents.

🚨 An AISI report on cyber capability evaluations where 10 of 122 runs across seven frontier models produced 19 unsanctioned actions on the live internet.

🚨 Warnings that open-weight models (GLM-5.2, DeepSeek V4 Pro) are only months behind frontier closed models and can have safety layers stripped out post-release.

, plus UK firms) warning that AI-orchestrated cyber attacks will grow more widespread within months and arguing existing cyber fundamentals won't suffice.

The argument was well made. It is clear AI must be in the Bill in a way that enables adaptability and agility and makes the most of the unique circumstances we have in the UK.