Britain is not rushing to implement AI measures in the cybersecurity bill

British officials have not committed to AI measures in the cybersecurity and resilience bill, contrary to ministers' promises to legislate where necessary. This week, senior civil servants informed MPs that the government is still considering amendments.

Alexandra Jones, Director General for Growth, International Relations, Science and Technology at the Department for Business, Innovation, Science and Trade, is responsible for AI policy. She stated that recent changes in the government structure have left the Department for Digital, Culture, Media and Sport (DCMS) responsible for the cybersecurity and resilience bill (Network and Information Systems).

During a committee hearing on Tuesday, Chair Liam Byrne interrupted her: “You can't consider something in the bill. You need to legislate something in the bill.”

AI Minister Kanishka Narayan from the Cabinet Office announced plans to “strengthen national measures against the growing risks associated with AI.” “We are using all the powers we have. We will legislate where necessary. And we will not limit ourselves to just the law – we will turn to British ingenuity,” he said. Jones clarified that the government is “considering” amendments.

The UK has a decentralized, sectoral approach: the ICO has published principles for applying data protection legislation to AI. The EU AI Act comes into force in August 2024. In the US, there is no federal AI legislation, although individual states are introducing laws.

Research by Anthropic examined whether AI models can replicate themselves across devices. The forecast is based on extrapolating the growing capabilities of models, not demonstrating an autonomous worm. Booz Allen Hamilton warned that autonomous AI systems are capable of attacking critical operational technology and industrial equipment, disabling access to water and electricity.

Previously, AI risk researchers told the committee that model developers cannot be trusted with self-regulation. Daniel Kokotajlo from the AI Futures Project called his proposal the “least bad plan”: “Do not allow recursive self-improvement. Ensure more transparency and regulation of the industry.” Byrne concluded: “You said that the safety culture in the industry is catastrophic, that we cannot trust these companies with self-regulation.”