Lawmakers See 'AI-Shaped Hole' in UK's New Cyber Bill

Lawmakers advancing the first legislation in Britain to ever feature "cyber" in its title continue to debate the extent to which cybersecurity and resilience rules should involve oversight of artificial intelligence tools.

See Also: How UK government can continue to innovate while reducing tech costs

Some lawmakers see an "AI-shaped hole" in the Cyber Security and Resilience (Network and Information Systems) Bill now progressing through Parliament. But Labour Prime Minister Andy Burnham's government said questions regulating the supply and use of AI are much broader, and should be out of scope for this legislation.

Formally introduced to Parliament in November 2025, the Cyber Security and Resilience (Network and Information Systems) Bill is designed to improve cyber defenses and incident response across critical national infrastructure sectors, including healthcare, drinking water and energy (see: Backers Pine for Elusive UK Cyber Bill ).

Widespread bipartisan backing for such measures appears to exist, including from Burnham, who in July became the country's sixth prime minister in 10 years.

His government has moved to put its own imprimatur on the bill, last week proposing 65 new amendments to the more than 100 under consideration. These include measures that would allow two ministers, including the secretary of state, to prohibit on national security grounds the current or planned use of any designated "high-risk vendor" by a critical national infrastructure organization.

The law is designed to build on the U.K.'s Network and Information Systems Regulations 2018 . The law covers transport, energy, drinking water, health and digital infrastructure, as well as several types of online service providers, including cloud-computing services, marketplaces and engines.

The new legislation would expand this to include data centers, large load controllers, managed service providers and critical suppliers to regulated organizations, and include an initial 24-hour incident reporting deadline.

AI Concerns Drive Debate

The House of Lords Grand Committee on Tuesday began its line-by-line reading of the latest proposed amendments the CSRB.

Lawmakers debated whether fraud and post-quantum cryptography adoption timelines should become part of the bill, the size of an organization that should be in scope, how to best manage supply-chain risks including designating which organizations are critical suppliers, as well as how to define what counts as being a security incident.

AI also remains a major concern, in light of both frontier and open-weight model capabilities continuing to rapidly improve, and multiple security incidents involving poorly secured AI agents (see: CISOs Must Rethink Containment After Hugging Face Incident ).

Multiple lawmakers have proposed adding oversight of AI and large language model vendors to the bill's scope. "This AI-shaped hole needs to be filled," said Lord Lionel Tarassenko, who previously served as the dean of engineering for the University of Oxford.

"Three serious incidents have been reported since just mid-July: one involving OpenAI's GPT-5.6 Sol and an unreleased model, one involving Anthropic's Claude models and one involving multiple AI agents during a cyber evaluation by the AI Security Institute, AISI," he said.

Another amendment, backed by Liberal Democrat Lord Tim Clement-Jones, former chair of the House of Lords AI Select Committee, would provide the government with an AI "emergency kill switch." This legal power would enable the government, "if an autonomous model malfunctions within critical national infrastructure," to order it to be shut down, he said.

Responding for the government, reappointed cybersecurity minister Liz Lloyd told lawmakers that "as AI is increasingly becoming embedded across the economy, we will keep its impact on the regulatory landscape under review." She said that adding AI to the scope of the bill wouldn't address many other concerns, including its "misuse by hostile actors," and that "broader questions the regulation of AI systems are more appropriately addressed through separate discussions, for example on online safety."

Cybersecurity and Resilience Focus

The government's aim is that the CSRB remain closely focused on network and information systems in critical infrastructure sectors, and that the "NIS regime" focus on ensuring the continuity of "essential" critical national infrastructure, from a systemic standpoint.

"The bill will drive this through by establishing common security and resilience requirements and secondary legislation for all regulated entities, clear guidance for regulators and a statement of strategic priorities setting common objectives that regulators must seek to achieve. These will cover issues such as governance, skills, risk management, business continuity, supply chains, incident response and appropriate testing and exercising," she said.

Some lawmakers have proposed that a single regulator oversee CSRB compliance. But the government has also continued to advocate for sector-specific regulators.

"Regulators will supervise and enforce the common requirements while providing guidance that is tailored to the risks and operational realities of their sectors," Lloyd said.

Aspects of the bill set to be debated Thursday included incident reporting, customer communications requirements, senior executives' liability, as well as expanding the scope of existing rules to cover additional sectors, including data centers. Review of the bill by the Grand Committee is scheduled to continue until at least the middle of week, before going to the full House of Lords for further review.

Geo Focus: The United Kingdom

Executive Editor, DataBreachToday & Europe, ISMG

Schwartz is an award-winning journalist with two decades of experience in magazines, newspapers and electronic media. He has covered the information security and privacy sector throughout his career. Before joining Information Security Media Group in 2014, where he now serves as the executive editor, DataBreachToday and for European news coverage, Schwartz was the information security beat reporter for InformationWeek and a frequent contributor to DarkReading, among other publications. He lives in Scotland.