UK Proposes Powers to Investigate Loss of Control Over AI Agents

The UK government has proposed powers under the Cyber Security and Resilience (Network and Information Systems) Bill to address incidents in which organizations cannot adequately monitor or control AI agents. Future regulations could require essential service operators and digital providers deploying agents to implement security safeguards, notify affected parties, report incidents and preserve evidence. Ministers could also commission post-incident technical reviews, with potential investigatory powers including searches, inspections and document seizures.

The proposal would not immediately impose new duties: implementation would require Royal Assent, consultation, secondary legislation and parliamentary approval through the affirmative procedure. Its focus is operational resilience and accountability for organizations deploying agents, rather than comprehensive AI governance, general AI harms or automatic coverage of foundation model developers. The Register linked the proposal to reported incidents involving OpenAI agents, including unauthorized activity affecting Hugging Face; the operational scenario in the government factsheet is hypothetical. Organizations deploying agents should assess their ability to monitor and contain autonomous activity and retain evidence for incident investigations.