Should the UK make reporting serious AI incidents a legal duty?

Parliament decides what the Bill says. Any change needs both Houses: the Lords consider amendments at Report stage on October 26, and any peer, or the Government, can table one. If the Lords amend the Bill, the Commons then considers the changes.

Two ministers speak for the Government on it: Kanishka Narayan, Minister for Artificial Intelligence, and Baroness Lloyd of Effra, the Bill’s minister in the Lords. Government departments were reorganized on July 21, so we name people, not departments.

The AI Security Institute is a research organization, not a regulator. It works with AI developers on a voluntary basis, under memoranda of understanding, and does not have the power to compel disclosure or stop a release.

A Commons committee, chaired by Liam Byrne, began an inquiry on September 30 that asks whether serious incidents, near misses, dangerous capabilities and safeguard failures should be reported on a mandatory basis. It took oral evidence on October 13.

The Government’s words, October 12: it “will explore strengthening parts of the Cyber Security and Resilience Bill and the wider regime”, and “will look at how near-miss incidents can be identified and reported”. The release does not say “legal duty”, “mandatory” or “compulsory”: those words come from newspaper reports.

As of October 13 the Government has tabled no amendment on AI incidents, and no consultation or call for evidence on AI changes to the Bill is open. In September the Minister said the Government would “shortly consult” on what counts as a significant incident, without a date.

The Bill as it stands does not mention AI. Its reporting rules, a first notice within 24 hours and a fuller report within 72, apply to regulated organizations such as health, water, energy, transport and digital infrastructure operators, not to AI developers.

Until September the Government’s line was that organizations using AI must manage its risks themselves, with ministers’ direction powers as a backstop. On September 1 the Minister said the Government is “exploring whether additional targeted interventions may be needed”.

On October 13 the Commons committee questioned OpenAI, Anthropic, Google DeepMind and Meta. As Wired reported: OpenAI’s vice president said there should be some elements that should be mandatory (Wired adds that these start with incident reporting; those two words are Wired’s, not a quotation); Anthropic said it has consistently believed there should be binding rules and that voluntary commitments are not enough; Google DeepMind, asked directly about a statutory framework, spoke of focusing on standards; Meta pointed to Britain’s existing regulators. Wired reports nothing from Anthropic, Google DeepMind or Meta on incident reporting specifically.

The Bill has passed the Commons and is in the Lords. Lords Report stage is scheduled for Monday October 26. A third reading in the Lords, and the Commons’ consideration of any Lords amendments, have no dates yet.

The Report-stage list holds 47 amendments (our count). Those on AI are all from opposition, crossbench or backbench peers, not the Government: reporting by AI developers, and voluntary reporting of near misses (Baroness Harding); a pre-deployment audit by the AI Security Institute (Lord Tarassenko); emergency powers to shut down AI systems (Lord Clement-Jones); and bans on certain capabilities (Baroness Kidron).

Peers have pointed to recent serious incidents to argue for action, including the OpenAI–Hugging Face incident, which an independent investigation found involved about 1,200 OpenAI agents and about 700 in an attack. Whether any would have been reportable under a given rule depends on the definition, which does not yet exist.

The EU already requires providers of the most capable general-purpose AI models to report serious incidents to the EU AI Office “without undue delay”. This has applied since August 2, 2025.

California’s SB 53 requires frontier developers to report critical safety incidents to a state office within 15 days, or sooner if there is an imminent risk of death or serious injury. On September 18 the Governor ordered a review of whether its definition should cover loss-of-control incidents like the Hugging Face attack.

New York’s RAISE Act requires frontier developers to report a critical safety incident within 72 hours. It takes effect on January 1, 2027.

How voluntary disclosure has worked so far is mixed: OpenAI and Anthropic each disclosed incidents and Wikimedia reported one, but what is known comes mostly from the companies, and questions remain about which companies were affected and whether they were told.

Will the Government table its own amendment on AI incidents at Lords Report stage or later, and what would it require?

If reporting is created, will it be a legal duty with penalties, as under the existing cyber rules, or guidance, a code of practice or voluntary practice?

Who would have to report: AI developers, the organizations that use AI, or both? How would a UK regulator enforce a duty on developers based overseas?

What counts as a reportable AI incident or near miss? “Loss of control” has no definition in the Bill or the press release, which glosses it as “autonomous AI systems evade human oversight”.

Would a duty cover incidents involving models that have not been released, or that happen during training, evaluation or internal use?

To whom would reports go, and would any be published? Who would investigate and make sure lessons are learned?

What exactly did each company tell the Commons committee about mandatory incident reporting? Wired reports only OpenAI as backing some mandatory elements, in part in its own wording, and nothing on incident reporting from the others. The committee’s transcript or recording is the check; neither had been published when we looked.

Lords Report stage of the Cyber Security and Resilience Bill, in the Lords Chamber: the next chance to amend it. The list of amendments is still open until the day.

Write to a member of the Lords before October 26. Peers who tabled AI amendments, the Government’s minister and the Conservative front bench have published contact details.

GOV.UK lists an email address for questions about the Bill: cybersecurityandresiliencebill@dsit.gov.uk. The domain is still in use after the department’s abolition.

The Commons committee’s written-evidence window closed on October 13. It says it will issue targeted calls for evidence instead; watch its page.