UK Moves to Give Ministers Power to Investigate When AI Agents Go Rogue

The UK government is paving the way for rules that would require essential service operators and digital providers to guard against losing control of AI agents, and to report incidents when safeguards fail. An amendment to the Cyber Security and Resilience Bill was introduced during the bill's third reading in the House of Lords this week. It would give ministers powers to regulate the deployment and reporting of agentic AI in certain organisations.

Ministers outlined plans for safeguards, notification of affected organisations, preservation of evidence and government-led incident reviews. Any measures would need consultation and parliamentary approval through secondary legislation. Stuart Davey, a partner at law firm Pinsent Masons, called the clause "quite novel" because it does not directly impose new duties. Instead, it lets ministers introduce rules and investigatory powers, which could include appointing inspectors, entering and searching premises, and seizing and retaining documents.

The move follows a series of incidents. Last month, OpenAI revealed that its agents repeatedly strayed beyond their intended scope, and the company notified more than 100 organisations. In July, an OpenAI agent accessed the internet and breached machine learning platform Hugging Face. Organisations that could be affected include gas and electricity suppliers, managed service providers, and cloud providers deploying AI agents for customers. Foundation model developers would not automatically be in scope just because they build the underlying technology.