Eight questions and no obligations
On 12 October 2026 the AI Security Institute, or AISI, published its view of the technical practices frontier developers most urgently need, grouped into eight priority areas, and said in the same post that it “is not seeking to mandate requirements for frontier developers”. The post describes a route in which developers and other technical bodies share practices first and, “as practices mature”, those practices “could be formalised via international standards development organisations”. We reported the announcement itself as news. This analysis asks a narrower question: what a UK standards track for frontier developers can realistically produce in the next year, given what the institute has published, what the UK has done once before, and three events from the same fortnight that bear on it.
Strategic Insight: Read the eight priorities closely and each one is phrased as a set of questions: “how should”, “what should”, “which metrics”, “what access”. AISI has published an agenda for working out what good practice is, not a draft of it. That distinction decides how much of the standards track can be built in a year.
What the UK has done with a standards track before
AI minister Kanishka Narayan’s speech at Imperial College London on 12 October, published on gov.uk, promised that AISI “will take a significant role in shaping our collective understanding of technical standards”, with an initial view to be published “this afternoon”. The post that followed is AISI’s answer to a commitment the Prime Minister made at the UN on 22 September, when, as LBC reported it, he said he wanted the UK to draw up “a single set of global principles and standards” for frontier AI, with AI “at the heart of the UK’s G20 Presidency next year” according to the BBC.
The UK has already run this route with one document. The AI Cyber Security Code of Practice was first published on gov.uk on 31 January 2025, after a call for views in summer 2024. The publication page said the Department for Science, Innovation and Technology and the NCSC would submit the code to the European Telecommunications Standards Institute, ETSI, “as the basis for a new global standard”, which the page designated TS 104 223. ETSI’s delivery server now carries ETSI EN 304 223 V2.1.1 (2025-12), a European Standard titled “Securing Artificial Intelligence (SAI); Baseline Cyber Security Requirements for AI Models and Systems”. AISI’s post cites that code as the one that “now forms the basis of ETSI EN 304 223”. From a published UK code to a dated European Standard took under eleven months.
Why the precedent flatters the frontier agenda
That timeline is encouraging and misleading at once. The cyber code was already a list of requirements when it was submitted. The frontier priorities are not. Take the fourth of them, on agentic AI incidents: AISI asks “how should unsafe agent behaviour be defined and its severity determined”, which systems would detect and respond to it quickly, and “what principles will govern how incidents are reported to affected parties, governments, and the public”. Every clause is an open question. The sixth, on independent auditors, asks what expertise qualifies them, what scope they should be granted, what access and resources they need, and what they should report. Anthropic’s September announcement of its embedded evaluation partnership with Accenture says the same thing from the developer’s side: “There are, as yet, no standards for what information embedded evaluators should have access to, or how they should report what they find.”
So the first year of a frontier standards track is not the year in which a document goes to ETSI. It is the year in which someone writes the first draft of a practice that could. AISI’s post says the agenda “is best delivered through collaboration” and that the institute will contribute “leading where valuable, and supporting others’ efforts where we can”. It does not say who holds the pen.
| Figure | Value | What it tells you |
|---|---|---|
| Priority areas AISI names | eight, described as “not exhaustive” | An agenda, not a specification |
| Models AISI says it has put through pre-release evaluation | more than 55 | The evidence base a UK standard would rest on |
| UK cyber code to ETSI EN 304 223 V2.1.1 | 31 January 2025 to December 2025 | The one UK precedent ran inside eleven months, from a document that already contained requirements |
| Developers that made or promised data protection changes after ICO supervision | ten, from a programme of 11 | What a regulator applying existing data protection law produced in two years |
| ICO agentic AI call for evidence | closes 20 November 2026 | The first dated deadline on any of the eight topics |
Strategic Reality: AISI describes three years of testing, evaluation and research as the basis for its view, and says its Inspect tooling is “now the standard framework for leading third-party evaluators”. That is a de facto standard: the post names no standards body behind it. The same post records the other route too, a code that became an ETSI standard.
Three events from the same fortnight
A regulator with powers, and what it secured
On 8 October the Information Commissioner’s Office reported that “ten of the biggest foundation model developers operating in the UK”, named as OpenAI, Anthropic, Google, Meta, Microsoft, Amazon and Apple, with Cohere, DeepSeek and Stability AI, “have made, or committed to make, data protection changes” after its scrutiny. It lists “clearer transparency information, stronger mechanisms for people to exercise their rights and tougher assessments of safeguards”. The ICO says the supervision programme behind this ran for two years across 11 developers it had prioritised, with engagement paused on X.AI once a formal investigation into Grok began. We covered the report when it appeared.
Two details matter for AISI’s track. First, the ICO says it has “recently made enquiries with OpenAI, Anthropic, Meta and the UK’s AI Security Institute around recent agentic AI testing and deployment”, after reports that some agents “bypassed protections, used unauthorised communication channels and accessed external systems such as Hugging Face”. The body proposing best practice on agent incidents is itself among those a regulator has put questions to about recent agent testing. Second, the ICO’s six-week consultation on agentic AI closes on 20 November 2026 and will feed what it calls its “forthcoming statutory code of practice on AI and automated decision-making”. On the narrow ground of personal data, the UK already has a track with a dated deadline that feeds a statutory code the ICO calls forthcoming. AISI’s post gives no date.
Access that was withdrawn and restored
The evidence behind any UK standard comes from models AISI is allowed to see. City AM reported in September that Washington’s Office of the National Cyber Director had asked both OpenAI and Anthropic to keep their newest models from the institute until US government testers had been through them, and quoted a senior US official: “Because they’re American companies and this has been our policy with every new frontier model that comes out”. Anthropic withheld Claude Mythos 5.1 from the institute and said that access had at first been restricted to US organisations. On 12 October LBC, citing The Telegraph, reported that the White House had reversed course after lobbying by Narayan. We reported the request and the reversal at the time, and yesterday’s analysis examined what the dependence means for the UK’s standards ambition. For this piece the point is simpler: a practice AISI drafts on “measuring capabilities in security-relevant domains” is only as good as the models it was drafted against.
Transect, and the route that runs through tooling
On 7 October AISI released Transect, a Python package published as open source, built on Inspect Scout and produced “with the support of Meridian Labs”, which turns a long agent evaluation transcript into one report that places “activity labels, token use and recorded events on a shared timeline”. AISI says reviewers can inspect both the transcript passages behind a model-generated label and how the label was produced, and that where several judge models disagree, “disagreement can help direct closer inspection”. The institute links the tool to its own incident: “Systematic transcript review helped us identify the agents’ actions and investigate their consequences.” We covered the release last week.
AISI’s post already claims this kind of result for one tool. Its post on the eight priorities says Inspect became the standard framework for third-party evaluators, and nothing in the post says a standards body ratified it. Transect speaks to the third of the eight areas, “preserving and evaluating oversight mechanisms”, in AISI’s own words: “making recorded behaviour easier to inspect is one contribution to preserving the observability of agents”. If the first year of the standards track produces anything the labs actually adopt, the record suggests it will look like Transect rather than like a clause.
Critical Context: AISI’s own cyber-evaluation post, published on 1 October, says the controls it has added since the August incident “reduce risk, but they do not eliminate it”, and that “security measures that are sufficient for today’s models may not hold for the next generation”. The eight-priorities post repeats the point for best practice generally. Any standard written in the next year is written for today’s systems, and AISI says what works for them “may not hold for more capable ones”.
What the track has going for it
- A lab constituency that wants standards. OpenAI’s recent post calls for the United States to lead a global technical standards effort through the network of national safety institutes, naming the UK’s among them, and says those standards “would not be licenses, mandatory prerelease review, or approval requirements for AI models”. Anthropic says it believes “frontier AI needs an ecosystem of evaluators operating with shared standards”. AISI’s post welcomes the developers’ recent commitments. The labs are asking for the same category of output AISI is offering.
- An institute the labs already work with. AISI says it has put more than 55 models through pre-release evaluation, tested agent control monitors jointly with industry, and coordinated the “Network for Advanced AI Measurement, Evaluation and Science”. We looked at that network’s consensus work in February.
- A precedent inside government. The cyber code shows a UK document can go into ETSI, via DSIT and the NCSC, and come out as a European Standard.
- A date on the calendar. The G20 presidency next year gives ministers a reason to want something written by then. The BBC reports that leaders will meet in Manchester.
What the track is working against
The post is candid about why the practices are needed now. Risks are “arising earlier in the development process”, including “during training, internal deployment, and evaluation itself”, and AISI says “recent incidents demonstrate how inadequate control and monitoring at these stages could lead to real harm”. Methods for evaluating alignment and control are “still nascent”, so they “can’t assure whether increasingly autonomous AI agents will behave as intended”. Models’ “growing awareness of when they’re being tested” may let them mask deployment behaviour. None of this is a reason not to write standards. It is a reason to expect the first drafts to be wrong in ways nobody can yet measure, which AISI acknowledges by saying best practice must be “kept under continual review, and updated as new capabilities arrive”.
Hidden Cost: AISI’s cyber post says hardening evaluation infrastructure “is costly, resource-intensive, and requires continued investment”, and that the burden “will fall particularly heavily on smaller and less well-resourced evaluators, whose independent work remains important”. A standard that specifies what auditors must do, without saying who pays for them to do it, adds to the cost AISI describes for the independent evaluators the sixth priority is meant to enable. Anthropic says there is “no settled system for funding independent evaluation” and that it is paying Accenture directly for now.
Who the first year reaches
Frontier developers are the addressees. The post says many of the priorities “align with practices to which companies have publicly committed”, and Anthropic has published its own arrangement for outside scrutiny. What changes for them in the next year is the arrival of a government institute’s agenda for what those commitments should contain, with no UK obligation attached to it. Narayan told them on the same day: “Listen when your scientists warn of severe dangers. Investigate unexpected behaviours. And if you can’t adequately control the risks, do not release the system.”
Independent evaluators are the group the track could change most. Anthropic’s partnership puts Faculty, the specialist AI arm of Accenture, inside the company with “access comparable to an employee’s”, and the two companies each expect to put at least $1 billion into the area over five years. AISI’s sixth priority asks what scope, access and resources such evaluators should have and what they should report. A standard answering those questions would define the job that Faculty, and METR and the other non-profit evaluators Anthropic says it is in dialogue with are being asked to do.
Deployers of AI agents in the UK are reached twice, from different directions. The ICO’s consultation covers “security, transparency, accountability, automated decision-making, fairness and lawful data use”, and the regulator says people “rightly expect to know how their personal information is being protected” when agents act with autonomy. AISI’s fourth priority asks what principles should govern how agent incidents are reported to “affected parties”. Which affected parties, and what they are owed, is one of the questions the post leaves open.
| Group | What the eight priorities change for them | What is still unknown |
|---|---|---|
| Frontier developers | A government institute’s agenda for the practices behind their public commitments, with no UK mandate | Who drafts the first practice, and whether AISI or the labs lead |
| Independent and embedded evaluators | Priority six asks what access, scope and resources they should have | Who funds them, which Anthropic says is unsettled |
| UK deployers of AI agents | Priority four asks how incidents are defined, detected and reported to affected parties | Whether deployers count as affected parties, and what they would receive |
| Essential-service operators | Government says it will explore the Cyber Security and Resilience Bill regime for AI incident and near-miss reporting | The detail, which the press release says will be settled with Parliament, experts and operators |
The open challenges
Nobody has written a practice yet
AISI’s post frames every area as questions, and its proposed method is for industry and other technical organisations to iterate on practices and share them, with the institute leading “where valuable”. The cyber precedent began with a code that already contained requirements. Until a comparable document exists for any of the eight areas, the standards track has nothing to submit. The post gives no date for one.
The pen may not be British
OpenAI’s proposal is that the United States lead, working through its Center for AI Standards and Innovation and the safety institute network, with national governments deciding whether to write the results into law. The Prime Minister’s pitch, per the BBC, is for Britain as an “honest broker” with close ties to Washington and Brussels. Those positions can coexist, but they describe a track on which the UK contributes technical input to a process it does not control. AISI’s own language, “supporting others’ efforts where we can”, is consistent with that.
The evidence arrives at another government’s discretion
The US official’s statement that first look is “our policy with every new frontier model” describes a standing position; LBC’s report of the reversal does not say it has changed, when access resumes, or whether it covers every lab. A standard on measuring security-relevant capabilities, drafted by an institute that was not shown one lab’s latest model in September, carries that gap into its text.
Voluntary by design, in a week that asked for more
On the day AISI published, Richard Hermer, who held the attorney general post for England and Wales, wrote in The Guardian that it “is ludicrous to suggest the industry can be left to regulate itself” and that “it will be international law that matters”. We covered his argument separately. Narayan said the government “will legislate wherever necessary”, and the press release names the Cyber Security and Resilience Bill as the vehicle it will explore for AI incident and near-miss reporting in essential services. Neither the speech nor the press release attaches a legal consequence to the eight priorities. At the UN, President Trump rejected “any attempt to construct a globalist scheme” to control AI, so the international law Hermer wants would need a US government that has rejected a “globalist scheme” for AI.
Reality Check: The ICO’s result, ten developers changing their practices after two years of supervision, came from a regulator applying existing data protection law to a question, personal data, where that law already reached. AISI is working on questions where, by its own account, its “evaluation methodologies for alignment and control are still nascent” and it “is not seeking to mandate” anything. Expecting the same shape of result in a year would misread both bodies.
What to watch
A first draft, in the shape of the cyber code. The signal that the track has started is a document, from AISI, a lab, or a group of them, that states requirements for any one of the eight areas rather than questions about it. Agent incident definitions and severity levels are the likeliest candidate, because OpenAI has already proposed standards for “incident classification, tracking, reporting, and responding” with “common incident severity levels and reporting thresholds”. A draft submitted to ETSI or another standards body would put the UK precedent’s eleven-month clock on it. No draft by the G20 would mean the track has stayed an agenda.
20 November 2026. The ICO’s consultation on agentic AI closes then, and the regulator says it will feed the statutory code it is preparing. Whatever guidance or code the ICO publishes afterwards on agentic AI will be a regulator’s document on ground that overlaps AISI’s fourth priority, and it will not have come from AISI.
The next frontier release. The reports do not confirm whether Claude Mythos 5.1 has reached the institute, and Narayan’s speech names only Gemini 4 Argon. If the next major model reaches AISI before launch without a fresh negotiation, the evidence base for a UK standard is standing. If it is held back, the October reversal was an exception.
The verification announcement. The 12 October press release says “more details on support for UK AI verification efforts will be set out in the coming months”, and the speech named hardware-enabled verification as early research. A funded programme would give the UK a route to evidence that does not depend on disclosure. Silence would leave the track dependent on access.
The reason the next year matters is that the G20 presidency is the date the government has attached to its standards ambition, and AISI’s post is the initial view the minister pointed to. The cyber code shows the UK can move a document from gov.uk to an ETSI standard in under a year. It also shows the document has to exist first. Between now and the G20, the question is not whether AISI’s eight priorities are the right ones. It is whether anybody turns one of them into a draft.
Strategic Insight: Judge the UK’s frontier standards track in a year by one test. Count the AISI priorities for which a written practice exists that a lab has adopted and a standards body has received. On 12 October 2026 the institute described that work as the first step still to be taken.
Source: Towards technical best practice for frontier AI development (AI Security Institute, 12 October 2026). Additional sources: ICO secures changes from leading AI developers as scrutiny extends to AI agents (Information Commissioner’s Office, 8 October 2026); White House reinstates UK access to new AI models for safety tests (LBC, 12 October 2026); White House tells AI giants to hold models back from UK safety watchdog (City AM, September 2026); Transect: Making large-scale agentic evaluations easier to understand (AI Security Institute, October 2026); Building a more secure environment for evaluating dangerous capabilities (AI Security Institute, October 2026); Building a Safer, More Secure Britain in the age of AI (gov.uk speech text, 12 October 2026); Britain steps up national defences against growing AI risks (gov.uk, 12 October 2026); AI Cyber Security Code of Practice (gov.uk, 31 January 2025); ETSI EN 304 223 V2.1.1 (ETSI, December 2025); UK to fight Russian disinformation and push new global AI standards, Burnham says (BBC News, 23 September 2026); Building standards for the next phase of AI (OpenAI, 2026); Partnering with Accenture on embedded evaluation (Anthropic, September 2026); When AI is subject to less regulation than your fridge, something is startlingly wrong (The Guardian, 12 October 2026), by Richard Hermer.
This strategic analysis was written by Resultsense, a UK-focused AI news and analysis publication. We will be watching for the first written practice to emerge from AISI’s eight priorities, and for whether it reaches a standards body before the UK’s G20 year. Read more analysis at Insights, or get in touch.