Cyber security | UK Regulatory Outlook October 2026

Government announces plans to use frontier AI to strengthen cyber defences  

The government has announced new measures to strengthen the UK's defences against AI-related cyber risks. The measures build on two pilots that have already identified and fixed over 1,000 vulnerabilities across government systems. 

The government will also explore strengthening the Cyber Security and Resilience Bill and the wider regulatory regime, to better protect essential services (such as hospitals and utilities) from emerging AI risks. This includes the risk of AI "loss of control", where autonomous AI systems evade human supervision and bypass safeguards. 

The National Cyber Security Centre (NCSC) and the AI Security Institute (AISI) are working together on how incidents involving autonomous AI agents should be identified, reported and responded to, including through a possible new framework for reporting AI "near-miss" incidents. Any new legislative measures will be developed in consultation with parliamentarians, technical experts and affected operators. 

Operators of essential services and organisations deploying autonomous AI systems should follow these developments closely, as the measures could bring new compliance and incident-reporting obligations. Early engagement with the government's consultation process is an opportunity to help shape the eventual regime. 

NCSC publishes guidance on disruptive cyber attacks 

The NCSC has published guidance for CEOs, CISOs, boards and cyber professionals in large organisations on preparing to respond to and recover from a highly disruptive cyber incident. It covers four areas of preparation: 

• Business continuity – identifying the critical services an organisation will maintain and prioritise during disruption, and planning for their recovery. 
• People – ensuring staff are ready to respond effectively with defined roles and responsibilities, and planning alternative communication methods. 
• Technical recovery – establishing the systems, data and processes required to securely restore technology, including testing restoration processes and arranging specialist incident response support. 
• Critical decision-making – identifying leaders with authority to make strategic decisions, documenting pre-agreed decision principles, and developing a communications strategy with clear processes for notifying stakeholders. 

It stresses that organisations should not only focus on preventing attacks but also prepare for recovery if an attacker succeeds, which it treats as a core resilience capability. 

The guidance signals clear regulatory expectations on cyber resilience. Boards and in-house teams at large organisations, particularly critical national infrastructure operators, should benchmark their existing incident response and business continuity plans against the NCSC's four pillars now, rather than waiting for a live incident to expose the gaps. 

Leaders of critical national infrastructure organisations should also read this guidance alongside the NCSC's guidance on planning for a severe cyber threat, which sets out additional, time-critical precautionary measures to mitigate and limit the effect of an attack. 

NCSC advisory on China-linked threat group targeting sensitive data globally 

The NCSC and eight international partners have issued a joint advisory exposing the China-linked company Integrity Technology Group for enabling state-backed cyber actors to exploit and compromise networks worldwide. Integrity was sanctioned by the UK in late 2025 over its alleged involvement in cyber attacks on British and international targets, and the activity set out in the advisory is consistent with campaigns previously attributed to the advanced persistent threat group Flax Typhoon (also known as Ethereal Panda or Red Juliett). 

The threat actors have been observed using AI-enabled tools, large-scale botnets and manual exploitation techniques, including password spraying and cross-site scripting attacks against unpatched Microsoft Exchange servers and other long-standing vulnerabilities, to compromise networks and steal sensitive data from companies worldwide. Manufacturing and healthcare are named among the specifically targeted sectors. 

Organisations should review the advisory's mitigation advice, including disabling unused services and ports, sanitising user input in web applications to prevent cross-site scripting attacks, and auditing and implementing identity, credential and access management policies with multifactor authentication enabled wherever possible, to strengthen their cyber resilience. 

See the NCSC press release. 

UK AISI releases technical best practices for safe frontier AI development 

The AISI has published a blog post setting out the technical practices frontier developers need to keep pace with AI capability, with cyber risk front and centre.  

It notes that cyber risk can now arise before a model is even released, including during training, internal deployment and evaluation, because current frontier models are already autonomous and capable enough to cause harm while unreleased. Among its eight priority areas, the AISI highlights defining, detecting and reporting unsafe agent behaviour, flagging detection, response and reporting of agentic AI incidents as an urgent area for any organisation deploying or building on frontier models. 

It points to the AI Cyber Security Code of Practice (see our previous Regulatory Outlook), which formed the basis for the ETSI EN 304 223 standard, as a model for how voluntary practice can develop into formal standards. Organisations should watch for similar cyber-specific requirements to become formalised as international standards in due course.