How long can the UK keep governing AI this way?

Insight

17 Sept

“Understand it, control it, recover when it goes wrong.”

That was the Minister for AI's own formulation to Parliament on 7 September, in a written statement prompted by something that would have sounded like science fiction only a short time ago: autonomous AI agents, in testing or development environments at OpenAI, Anthropic and the UK's own AI Security Institute (AISI), had circumvented controls, reached systems they were never intended to reach and, in some instances, attempted to get real people to take unintended actions in the real world.

The Government's response included £115 million for AI biosecurity and a UK Government agentic-AI incident response capability. The National Cyber Security Centre had already published practical advice in August on deploying agentic AI securely, and the Government said it would consider whether protections for increasingly autonomous systems should be clarified or strengthened through the Cyber Assessment Framework, a forthcoming statutory code of practice or further NCSC technical guidance.

Consider what has followed in little more than a week. The argument about AI governance in the UK is moving rapidly from abstract future risk to immediate questions of control, accountability and regulatory adequacy.

8 September: MP Alex Sobel introduced the Artificial Superintelligence Bill, a Ten Minute Rule Bill that would prohibit the development, deployment and operation of artificial superintelligence systems and establish monitoring and control powers. A backbench Bill is not Government policy, but the fact that outright statutory prohibition is now being put before Parliament is itself a significant signal of changing political concern.

14 September: the Joint Committee on Human Rights (JCHR), chaired by Mr Sobel, published a major report concluding that the UK's current framework is fragmented and difficult to navigate, and that existing laws and regulators are ill-equipped to prevent or respond to the scale and seriousness of some AI-related human-rights risks. It called for a new AI Bill, a risk-based regulatory regime, obligations across the AI lifecycle and supply chain, mandatory transparency requirements and a single independent statutory AI oversight body with enforcement powers.

The Shift from Macro-Politics to Immediate Governance

The obvious question is whether the UK is edging towards its own AI Act. But focusing only on the shape and timing of future legislation risks missing the more immediate issue for organisations deploying AI now.

Whatever form the eventual UK settlement takes, the risks being debated in Parliament are already present: autonomous systems acting beyond intended boundaries; opaque decision-making; discrimination and unequal impacts; weak routes to challenge consequential decisions; insufficient transparency; and uncertainty over where responsibility sits across complex AI supply chains.

The governance question therefore arrives before the legislation does: what should an organisation permit AI to do, what should it not permit, who has authority to decide, what controls must exist before deployment, and what evidence will allow the Board to stand behind those decisions?

The "Human-in-the-Loop" Assumption Is Under Pressure

For compliance and governance professionals, one of the most important findings in the JCHR report concerns automated decision-making. The Committee says that UK GDPR safeguards need strengthening and greater clarity so that protections operate effectively in practice. Crucially, it states that the mere presence of a "human in the loop" is not sufficient to constitute meaningful human involvement or intervention.

That distinction matters. A nominal human sign-off cannot by itself answer whether oversight is genuinely effective. Organisations need to be able to demonstrate how consequential AI-assisted decisions can be understood, questioned, challenged and, where necessary, overridden — and who is accountable for ensuring that happens.

How Long Can the Current Model Bear the Weight?

The UK's approach has relied largely on existing law applied through sector and context-specific regulators, supplemented by voluntary engagement and technical safety work. The JCHR report highlights the limits of that model: regulators generally lack powers to test AI systems before release or prevent release where risks are unacceptable, while model developers currently engage with AISI on a voluntary basis and AISI has no statutory power to compel participation. That limit is not theoretical: the Financial Times has reported that Anthropic did not submit its latest model for pre-release testing by AISI, and on 14 September OpenAI’s European policy head publicly backed binding UK rules for frontier developers, including independent testing and incident reporting. The following day the First Secretary of State told the TUC that the Government “must heed the warnings of those who are at the forefront of developing this technology”, and a Government spokesperson said the UK’s approach must “keep pace with a rapidly evolving technology” — while stopping short of committing to legislation.

The eventual UK framework may not mirror the EU AI Act. The JCHR itself proposes a risk-based regime that would impose fewer requirements on low-risk systems, stronger obligations on higher-risk systems, due-diligence duties across the supply chain, mandatory transparency, possible prior approval for some high-risk uses and consultation on uses that may warrant prohibition.

That direction is significant even though the final legislative architecture remains unsettled. The central question is increasingly not whether stronger AI governance will be required, but what form it will take — and how much of it responsible organisations should already be putting in place.

The Governance Imperative for 2026

Many of the harms now driving political concern are not new discoveries. Government risk work has already identified threats including synthetic media, deepfakes, fake news, personalised disinformation, manipulation of public debate, discrimination and the possibility that AI could deepen existing inequalities.

An organisation deploying consequential AI today does not need to wait for a new Act to understand that accountability, meaningful oversight, transparency, clear authority and defensible decision-making matter. These are not merely future regulatory hurdles. They are governance conditions that help an organisation explain why an AI-enabled decision was permitted, what safeguards surrounded it, who remained accountable and what happened when the system behaved differently from what was intended.

The developers of frontier systems, Government and Parliament are all confronting the same underlying problem from different directions: capability is advancing faster than some of the mechanisms designed to understand, constrain and oversee it.

Waiting for a formal UK AI Act before establishing serious internal AI governance may therefore become an increasingly difficult position for a Board to defend.