The UK government has added two new fact sheets to its Cyber Security and Resilience Bill collection, updated on November 3. One describes possible measures for incidents where organisations lose control of AI agents operating in their systems. The other outlines a proposed framework for managing risks from technology suppliers to essential services. Both topics are increasingly practical for organisations that rely on connected infrastructure, but neither fact sheet is itself a new law. The documents explain how the government may use powers in the Bill if Parliament approves them.
The AI-agent document says the government intends to consult on safeguards using powers in the Bill. Options could include technical and organisational controls, notifying organisations affected by an incident, preserving evidence about an agent’s actions and allowing government experts to review what happened. The stated focus is loss of control that affects regulated network and information systems, not a general framework for all AI harms. The government says any resulting measures would need further scrutiny and approval through the parliamentary process for secondary legislation.
The supplier proposal would begin with operators of essential services, including energy, drinking water, transport, health, digital infrastructure and data centres. It describes guidance for identifying risky procurements, a voluntary route for operators to ask government for help, and a possible power to direct an operator to stop using or mitigate a particular supplier’s product or service. The government says such a direction would need to be necessary and proportionate for national security. The proposal is aimed at supplier-related security risks in essential systems, rather than routine purchasing across every business in the UK.
The Bill has not received Royal Assent. Parliament’s current record shows it at the stage of considering amendments from the House of Lords, following the Lords’ third reading. The government says the proposed AI measures and supplier framework would require further consultation and later secondary legislation after Royal Assent. As a result, there is no application date for these specific new measures yet; organisations should not mistake a policy fact sheet for a duty already in force. The Bill and its supporting rules may still change as the process continues.
For UK operators of essential services, the proposals signal where future planning may focus: monitoring autonomous agents that touch operational systems, keeping evidence if something goes wrong and understanding the security of suppliers before systems become dependent on them. For now, the useful distinction is between the existing Network and Information Systems rules and powers still being debated in Parliament. Organisations can review their current controls and supplier inventories without treating the future proposals as already binding. The final legal duties and start dates will depend on the enacted text and later regulations.
Sources: