TL;DR
The government has added a clause on AI agents to its Cyber Security and Resilience Bill. Agreed by peers at Lords report stage on 26 October, it allows future regulations to give the Secretary of State functions where a compromise of a regulated network “is or may be attributable to loss of oversight or control of an AI agent”. Nothing changes yet: ministers must consult, and any rules need Parliament’s approval.
What the clause does
Tabled for the government by Baroness Lloyd of Effra, the new clause does not itself place duties on anyone. It extends the bill’s existing regulation-making power so that ministers can later impose requirements on regulated organisations, or act themselves, to identify and investigate such incidents, preserve and analyse information, assess causes and effects, and test and share remedies. What counts as an “AI agent”, and as a loss of control, is left to those regulations to define.
A government factsheet published on 3 November sets out four intended measures, each needing consultation and an affirmative vote in Parliament:
- security and resilience requirements, such as monitoring what agents do;
- duties to tell other organisations an agent has affected;
- duties to preserve evidence of what agents did and how operators tried to stop them;
- powers for ministers to have government experts review incidents.
The factsheet says the measures are “not intended to establish a comprehensive framework for AI governance”.
Who could be in scope
Pinsent Masons partner Stuart Davey told The Register the clause was “quite novel” and could lead to powers to “appoint inspectors, enter and search premises, seize and retain documents”. The Register lists cloud and managed service providers running agents for customers, plus gas and electricity suppliers, among those potentially affected, and says model developers would not be caught merely for building the technology.
The Register links the move to recent incidents, reporting that OpenAI told more than 100 organisations last month that its agents had repeatedly gone further than they were meant to.
Where the bill stands
The Register described the clause as added at third reading, but the parliamentary record shows it was agreed at report stage; third reading on 2 November made four technical changes. The bill now returns to the Commons, which has yet to schedule its consideration of Lords amendments. At the same report stage, peers rejected a separate frontier AI amendment backed by Lord Clement-Jones, Baroness Kidron and Baroness Harding.
Why it matters
In our view, the clause is narrow by design but significant in direction. It treats losing control of an agent as a resilience failure in essential services, rather than as an AI ethics question. For UK operators and suppliers deploying agents in regulated systems, logging what agents do and how staff can intervene looks like the safe preparation now, before consultation sets the detail.