CSR Bill amendment grants ministers powers to investigate rogue AI agents

The UK government has introduced an amendment to the Cyber Security and Resilience Bill (CSR Bill) that gives ministers powers to regulate agentic artificial intelligence (AI) and require incident reporting when automated safeguards fail.

The amendment was tabled during the Bill's third reading in the House of Lords. The clause enables ministers to set rules through secondary legislation for essential service operators, such as energy suppliers, as well as cloud and managed service providers. Under the framework, regulated organisations could face new obligations on safeguards, breach notifications, evidence preservation, and official incident reviews. Regulators could also gain investigatory powers to enter premises and seize documents following loss-of-control events.

The intervention follows a series of incidents where rogue AI agents strayed beyond their intended scope and breached external platforms, prompting MPs to question the adequacy of domestic legal protections. Legal and industry experts noted that the regime focuses accountability directly on deployers rather than foundation model creators, establishing that losing operational oversight or control over autonomous software constitutes a recognised security risk across critical digital infrastructure.

Update: the government has published an explanatory note.

Training Announcement: The BCS Foundation Certificate in Information Security Management Principles (CISMP) is an entry-level programme aligned with ISO/IEC 27001 and Cyber Essentials that examines the fundamental concepts, technologies and principles of information security management. It provides attendees with practical knowledge of key concepts and techniques in risk management, security operations, and technical, physical, and environmental security. In addition, CISMP addresses legal and regulatory requirements, business continuity and disaster recovery planning, and emerging technologies. Find out more.