TL;DR
The Information Commissioner’s Office confirmed on Monday that it is keeping a close watch on OpenAI and Anthropic after the containment failures both disclosed last week. Hours earlier, AI minister Kanishka Narayan told Reuters the government would look at statutory rules if voluntary pre-deployment testing stopped being enough. Two signals, one direction of travel.
Britain has spent three years insisting that existing regulators, rather than a dedicated AI body, are the right instrument. Monday tested that position twice.
The ICO said it engages regularly with AI developers, naming both companies, and added that it was aware of the recent breaches and “monitoring developments closely”. That is deliberately short of an investigation. It is also the first time the data regulator has publicly attached itself to the agentic containment story.
Narayan’s interview went further. Asked whether the voluntary regime could give way to legislation, he said that if regulation turned out to be the mechanism that helped, “of course, we will look at it”. He framed his priority as protecting the public rather than defending any particular model of oversight — a shift in emphasis from the pro-innovation white paper this approach descends from.
His case for the status quo rests on access. The AI Security Institute, set up after the 2023 Bletchley summit, sees almost every frontier model built by a Western lab before release, which Narayan said leaves Britain and the United States as the only two countries with that vantage point.
The gap he did not address is what follows. Access produces findings; it does not produce consequences. AISI’s arrangements are voluntary in both directions — a lab hands over the model by agreement and is under no obligation to act on whatever the evaluation turns up.
Timing sharpens the contrast. The EU’s AI Act took effect on Sunday. That same Monday, Washington finalised its own voluntary cyber-testing scheme and summoned the major labs in to discuss it. Britain now sits between a statutory regime on one side and an explicitly non-binding one on the other, having committed to neither.
For UK businesses, the practical read is that compliance planning should not assume the voluntary settlement is permanent. Ministers have now said out loud that the option is live.
Looking Forward
Watch whether the ICO’s monitoring turns into anything with teeth, and whether the repeatedly delayed AI bill acquires a date. Narayan’s phrasing kept every option open, which is useful for a minister and unhelpful for anyone budgeting for compliance.