The UK Minister for Artificial Intelligence has told Parliament how the Government will strengthen resilience against powerful AI and respond to agentic AI incidents
The statement is a report of Government policy and intent, not a statute or a regulator's rule. Its most practical signal for firms is that AI near-miss and incident reporting is under consideration for the Cyber Security and Resilience Bill.
Bottom line: HCWS357 is a non-binding statement of Government policy and intent. It enacts no law, and the Minister says the Government is "considering" how the Cyber Security and Resilience Bill could cover AI near-miss reporting and loss-of-control risks.
Who this affects: Compliance officers, firm risk leads and advisers on AI incident reporting in the UK. The statement places no duty on them.
Issue date: 12 October 2026. No effective date or deadline is stated.
What changed: The Government says it has worked to retain AI Security Institute access to the most powerful models before release, announces an extension of its frontier AI hardening programme, and early work on a response capability for serious incidents caused by AI agents.
Analysis: In our reading, the item to watch is the Bill. A firm that already logs AI near misses would be better placed if reporting were later added, but the statement itself describes consideration only and contains no amendment text.
- Bindingness
- Not applicable (non-binding). It enacts no law and sets no duty on businesses
- Instrument (English)
- Written Ministerial Statement HCWS357, "Artificial Intelligence Policy"
- Authority
- Minister of State (Minister for Artificial Intelligence), Cabinet Office, made in the House of Commons
- Jurisdiction
- United Kingdom
- Scope
- UK Government policy on resilience against powerful AI: frontier model testing by the AI Security Institute, government cyber hardening, and response to AI agent incidents. It reports intent and sets no rules for businesses
- Current Status
- Statement to Parliament on Government policy and planned action
- Issue date
- 12 October 2026 (date made, per the Parliament Written Statements record)
- Effective date
- Not applicable (non-binding). No effective date or deadline stated in the source
- What changed
- The Government says it has worked to retain AI Security Institute access to the most powerful models before release, announces an urgent extension of its frontier AI hardening programme, early work on a response capability for serious agentic AI incidents, and consideration of AI near-miss reporting and loss-of-control risks under the Cyber Security and Resilience Bill
- Who this affects
- Compliance officers, firm risk leads, essential-service operators and anyone advising on AI incident reporting. The source does not impose obligations on any of them
- Primary source
- Parliament Written Statements record 1947456, HCWS357
- Workflow impact
- Not stated in the source as a requirement. The statement signals that AI incident and near-miss reporting may later be considered for the Bill's regime
- Operational next step
- Check whether your AI incident log would capture near misses, and watch the Bill's passage in the House of Lords for any amendment
- Last verified
- 2026-10-25
Primary source: Parliament Written Statements record 1947456, HCWS357
Key takeaways
- The statement is non-binding and announces no new statute, duty or deadline.
- The Minister says: "We cannot rely solely on the companies developing these technologies to assess and manage the risks they may pose."
- The Government says it is developing plans for responding to serious incidents in which AI agents cause harm. The statement describes them as being developed.
- AI near-miss reporting is described as under consideration for the Cyber Security and Resilience Bill, which is in the House of Lords.
Is the statement binding, and what does it announce?
It is not binding. It is Written Ministerial Statement HCWS357, made on 12 October 2026 by the Minister of State (Minister for Artificial Intelligence) for the Cabinet Office, titled "Artificial Intelligence Policy". The Minister says it updates the House on action to strengthen the UK's resilience against the risks of increasingly powerful AI. The Parliament record shows one linked statement of the joint type, dated the same day. We did not open it.
The Minister frames three actions: strengthening government cyber defences using frontier AI, establishing a specialist capability to respond to major incidents involving agentic AI, and considering how the Cyber Security and Resilience Bill can better protect essential services against emerging threats. The statement also refers to a National Cyber Action Plan to be outlined by the Security Minister and to the Prime Minister's AI Taskforce, chaired by Lord Vallance. It sets no deadline for any of these.
What does it say about the AI Security Institute and pre-release model access?
The Minister says the Government has been working with the labs and the US government to "retain access for Britain's AI Security Institute to the most powerful AI models before they're released". The statement does not describe the terms, and no agreement is published in it. The Minister adds that AISI scientists are now conducting "rigorous evaluations of the latest generation of models". The statement describes AISI as bringing together more than 100 technical specialists.
One sentence in the opening section states the policy premise: "We cannot rely solely on the companies developing these technologies to assess and manage the risks they may pose." Nothing in the statement says developers must give the Government access. The access is described as something the Government has worked to retain.
What are the frontier AI hardening and agentic incident response plans?
On hardening, the statement says Government Cyber Unit experts have been testing frontier AI on real-world government cyber security problems, and two pilot programmes have used AI to find and address 1,352 vulnerabilities across 548 code repositories in 18 participating departments. The Minister announces "an urgent extension" of the programme. These figures are the Minister's own account, and we have not checked them against any other source.
On incidents, the statement says that as AI agents are used more widely and with less human oversight, the risk of serious incidents in which they act beyond their instructions is growing. The Government is "taking the first steps", working with the National Cyber Security Centre, the Department for Digital, Culture, Media and Sport and the AI Security Institute, and is developing plans for how government should respond when AI agents cause serious harm. The statement says the Government will build on this work in the weeks and months ahead.
What does it say about the Cyber Security and Resilience Bill?
The statement says the Bill is currently making its way through the House of Lords. The Minister says "we are considering how the regime can be strengthened so that AI cyber and loss of control risks are better understood and protected against". The examples given are how near misses can be identified and reported, how AI-driven risk across organisations is reduced, and how AI incidents can be properly understood so that lessons are shared.
The statement describes this as consideration. The Minister says the Government will consider proposals with parliamentarians, technical experts and the operators who would need to deliver them, and will keep Parliament updated during the Bill's passage. We found no amendment text, reporting threshold or covered-entity definition in the statement.
Which dates and deadlines does the statement give?
It gives none for any action. The table lists the only dates in the record.
| Date | Event | Status |
|---|---|---|
| 7 September 2026 | Earlier statement to the House on frontier AI agents, mentioned in HCWS357 | Not opened by us |
| 12 October 2026 | HCWS357 made in the House of Commons | Date made, per the Parliament record |
| Not stated | Effective date or compliance deadline | None stated; the statement is non-binding |
| Not stated | Passage of the Cyber Security and Resilience Bill | Described as currently making its way through the House of Lords |
What should compliance officers and risk leads do now?
Treat the statement as an early signal, not a compliance trigger. In our reading, the useful step is internal preparation that costs little whether or not the Bill changes.
- Check whether your incident log can record AI near misses, using whatever definition your firm adopts. The statement gives none.
- List the AI agents your firm runs, what access each has, and who is responsible for each.
- If you operate essential services, ask your counsel to track the Bill in the Lords for amendments touching AI incident reporting.
- Watch for the National Cyber Action Plan the statement says the Security Minister will outline.
FAQ
Is Written Ministerial Statement HCWS357 binding?
No. It is a statement to Parliament on Government action and intent. It enacts nothing, and the Minister says the Government is considering how the Cyber Security and Resilience Bill could be strengthened, with proposals still to be discussed with parliamentarians.
Does the statement create an AI incident reporting duty for businesses?
No. The Minister says the Government is considering how near misses can be identified and reported under the Bill's regime. No duty, threshold or deadline is stated.
What does the statement say about the AI Security Institute?
The Minister says the Government has worked with the labs and the US government to retain AI Security Institute access to the most powerful models before release, and that AISI scientists are now evaluating the latest generation of models.
What is the frontier AI hardening programme?
The statement says two pilot programmes used AI to find and address 1,352 vulnerabilities across 548 code repositories in 18 participating departments, and announces an urgent extension of the programme across government.
What is the Government doing about serious incidents caused by AI agents?
The Minister says the Government is taking first steps and, working with the National Cyber Security Centre, the Department for Digital, Culture, Media and Sport and the AI Security Institute, is developing plans for how government should respond when AI agents cause serious harm.
What we did not verify
What we opened: the Written Ministerial Statement text, HCWS357, through the Parliament Written Statements API on 25 October 2026 (UTC). The quotations and figures above come from that record.
What we did not open: the linked joint statement, the Bill text or its Lords amendments, the 7 September statement the Minister mentions, any AISI evaluation, any model developer's account of the access arrangement, and any published incident response plan. We cite the statement by section heading because it has no paragraph numbers.
What we refuse to claim: that developers are required to give the Government pre-release access, that any AI incident reporting duty exists or has been added to the Bill, or that the figures on vulnerabilities have been independently confirmed.
HCWS357 is a policy signal, not a rule. Keep an AI incident log that can record near misses, track the Cyber Security and Resilience Bill in the Lords, and do not treat any AI incident reporting duty as settled.
Related briefings
Source File
Primary: https://questions-statements-api.parliament.uk/api/writtenstatements/statements/1947456
Secondary: None relied on for the facts above.
Last checked: 2026-10-25 (UTC)
Status: Statement to Parliament, not binding.
Editorial note: Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.
Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.
Sponsored Training
Practical AI training for regulated professionals, built around verification, documentation and a defensible process. See the courses.