The UK GOV.UK factsheet on agentic AI resilience measures (updated 3 November 2026) explains how the Cyber Security and Resilience (Network and Information Systems) Bill could be used. After Royal Assent, ministers intend to consult on secondary legislation that would help regulated entities manage agentic loss of control incidents on their networks and information systems. The Register reported on 6 November that a Lords amendment sits in that bill path.
What is proposed (not yet in force)
The factsheet lists four intended measure types after consultation and the affirmative procedure in Parliament:
- Security and resilience requirements for agentic loss of control (for example monitoring and agent risk assessments).
- Affected-party notification when incidents caused by AI agents impact other organisations.
- Evidence preservation about how agents may have caused an incident.
- Ministerial post-incident review powers so government experts can request information and share lessons.
Scope language targets regulated essential and digital service operators and related deployers. The factsheet says these measures are not meant as a comprehensive AI governance framework. Legal commentary quoted by The Register notes foundation-model builders are not automatically in scope just because they build base models.
Why this matters
If you deploy agents inside UK essential or digital services (or as a cloud / MSP serving them), this is a watch item for future NIS-style duties around monitoring, notification, and evidence when oversight fails. It is not law yet: consultation and affirmative secondary legislation still have to happen after Royal Assent. Read it next to the ICO agentic AI call and NCSC critical-infrastructure malware note, and keep UK geo in mind when you write compliance plans.
The Campfire
CommentsThanks. Your comment is waiting for the desk. Once it is approved it appears here within about a minute.
Add a comment