Cyber security | UK Regulatory Outlook September 2026

Cyber Security and Resilience Bill completes Lords committee stage

The Cyber Security and Resilience Bill (CSRB) completed its committee stage in the House of Lords on 7 September 2026. During the committee stage, the government tabled a number of amendments to the bill, which aims to strengthen the cyber security of organisations providing essential services.

Among the most significant provisions considered are the national security direction powers in section 54 of the bill. The secretary of state may direct regulated persons to take specified action where a threat to network and information systems gives rise to a risk to national security. Directions may include a prohibition or restriction on the use of goods, services or facilities; a prohibition on the installation of goods or the taking up of services; and a requirement to remove, disable or modify goods, facilities or services.

The report stage, where members will further scrutinise elements of the bill and make changes, has been scheduled for 26 October 2026.

Organisations providing essential services, managed service providers, data centres and their supply chains (particularly in the technology, energy and infrastructure sectors) should be actively assessing their readiness for the CSRB’s expanded regulatory requirements, including vendor risk management, incident reporting capabilities and governance structures.

Monitor developments via Osborne Clarke’s Digital regulation timeline.

NCSC publishes joint advisory warning UK and allies of spyware used by Iranian state actors

The National Cyber Security Centre (NCSC), alongside the US Federal Bureau of Investigation (FBI) and the Netherlands’ General Intelligence and Security Service (AIVD), has published a joint advisory on the "CHOSEN BRICK" malware used by Iranian state-linked cyber actors to target dissidents, activists and journalists around the world, including in the UK.

The malware allows attackers to collect information on a target’s contacts, emails and social media messages, capture screen content and access device microphones. The advisory states that Iranian state actors have been observed impersonating contacts over messaging apps such as WhatsApp and Telegram, to build rapport with targets before deploying the malware. The personal details of previous victims of CHOSEN BRICK have appeared on pro-Iranian leak sites, potentially increasing the risk to the personal safety of those affected.

To reduce the chances of compromise, the NCSC recommends individuals and organisations at risk to follow the mitigation steps in the advisory, which include following guidance on staying safe online, keeping devices up-to-date and to take up the NCSC’s dedicated support for high-risk individuals.

Organisations are recommended to circulate the advisory with staff who may be at risk and ensure that relevant individuals supported in securing their personal devices as well.

See the NCSC press release.

UK and partners issue warning over new 'zero-click' phishing campaign targeting Western organisations

The NCSC and international partners have issued a joint advisory warning of the threat from the Russian state-supported "LAUNDRY BEAR" cyber threat group, which is targeting users within Western organisations as part of an ongoing phishing campaign.

The advisory states that the threat group uses a zero-click exploit, which requires no action from the victim, and is triggered simply by viewing a malicious email within a vulnerable version of the Zimbra Collaboration Suite webmail service. The exploit enables the exfiltration of the victim's emails from the last 90 days, email addresses, passwords, the organisation's email directory, and other sensitive information, to infrastructure controlled by Laundry Bear. It also attempts to establish persistent access to victim accounts through a variety of means.

Organisations that use the service are urged to follow the recommended mitigation advice, including immediately patching vulnerabilities and improving network monitoring capabilities. Laundry Bear has to date targeted and compromised users across a range of sectors, including defence industrial base, local government, education, energy, law enforcement, media, non-governmental organisations (NGOs) and technology

See the NCSC press release.

NCSC publishes guidance on agentic AI security

The NCSC has published a blog post aimed at helping system designers and operators manage the risks associated with agentic AI. It sets out seven recommendations, intended to be applied proportionately based on the level of autonomy of each agentic AI system:

• Identify what could go wrong by documenting the scope of intended activity and carrying out threat modelling to identify risks and determine whether additional controls should be implemented.
• Prompt carefully and review how the agent handles tasks in context over time, ensuring that controls are in place for the agent to stop and seek human approval where appropriate.
• Set the right level of oversight. Among other things, where unintended activity would have significant consequences, the NCSC recommends maintaining human oversight and using real-time monitoring alerts to identify unexpected or concerning behaviour.
• Control the AI agent's environment with a robust sandbox, including restricting access to the resources needed for a task to be performed and monitoring for attempts at wider access.
• Maintain a log and monitor agentic AI activity as part of 24/7 security monitoring and incident response, to allow organisations to actively oversee an AI agent's activities in real time and investigate any incidents.
• Where an AI agent communicates with third-party systems, make AI activity easy to attribute. This could include ensuring that traffic originates from IP addresses that support reverse lookups, or adding identifying headers to outbound communications (such as HTTP headers).
• Maintain the ability to rapidly shut down and stop autonomous AI agent activity if an incident is detected or reported.

The NCSC states that this is intended as interim practical advice, pending the publication of formal guidance in due course. Organisations deploying or considering agentic AI systems should review these recommendations now and assess whether their existing governance, oversight and incident response frameworks are adequate to manage the risks of autonomous AI activity, particularly where such systems interact with sensitive data or critical infrastructure.

NCSC guidance on the risks of shadow AI

The NCSC has published a blog post on the hidden risks of shadow AI (a form of shadow IT that describes the use of AI tools by employees without organisational approval or oversight). It notes that, as AI use has grown rapidly in the workplace, organisational policies and guidance have not always developed at the same pace, which can lead employees to adopt unapproved AI tools that introduce new cyber security risks.

The NCSC highlights a number of cyber security risks arising from shadow AI:

• Providing unapproved AI tools with access to company or customer data increases the risk of data breaches, intellectual property loss and regulatory non-compliance.
• Employees who transfer sensitive or proprietary information to consumer AI services may reduce the organisation's visibility and control over that information, as data may be stored, retained or used to improve the service outside of the organisation's established security and governance arrangements.
• Shadow AI can also create new opportunities for attackers. AI agents may contain critical security vulnerabilities, which if exploited, can allow attackers to gain access to the same data, services and privileges that the agent has legitimate access to.

To manage these risks, the NCSC recommends that organisations adopt a positive cyber security culture and encourage open communication, so that employees are less likely to turn to unapproved services. Organisations should seek to understand why staff are using shadow AI and, where possible, securely integrate AI systems into the workplace that meet employees’ needs, reducing the incentive to use unapproved alternatives.

NCSC publishes guidance on risk from internet-exposed systems and edge devices

The NCSC has published an alert warning of increased targeting of internet-exposed operational technology (OT) systems across multiple sectors globally, including in the UK.

It warns that any organisations with internet-exposed technology (hardware and software systems) as well as edge network devices (such as routers and remote access appliances) could be affected and should therefore review their security posture accordingly.

In response to the increased threat, the NCSC recommends that organisations take a number of actions, including replacing default credentials and preventing the use of shared passwords, controlling access to operational technology, monitoring connectivity to and within operational technology networks as well as testing backups and recovery procedures to minimise downtime and support safe recovery from cyber incidents.

The NCSC reiterates that organisations that have embedded strong cyber resilience practices are better placed to prevent, detect and respond to cyber incidents before they cause operational disruption. It reminds organisations to register for their free Early Warning service and to consider implementing the Cyber Assessment Framework or Cyber Essentials as a way of gaining assurance that systems are protected against the most common threats.

Ofcom launches engagement on the role of AI in cyber defence

Ofcom has launched an engagement exercise to explore how advances in AI can support cyber defence across critical communications networks and services. It notes that frontier AI models are increasingly being used by malicious actors to identify vulnerabilities, automate elements of attack chains and target critical services, but that AI-enabled tools can help organisations detect threats more quickly, improve vulnerability management, accelerate incident response and strengthen the resilience of networks and services.

The engagement will explore the opportunities and challenges associated with AI-enabled cyber security tools, including questions around trust, assurance, accountability and compliance with existing cyber security requirements. Ofcom is also keen to ensure that current regulatory frameworks do not create unintended barriers to the adoption of technologies. The regulator plans to hold a series of discussions with industry, technical experts and vendors during autumn 2026, with findings expected to be published in early 2027.

Government publishes response to consultation on cyber security regulation for downstream gas and electricity

The government has published its response to the joint consultation by Ofgem and the Department of Energy Security and Net Zero (DESNZ) on new baseline cyber requirements across the downstream gas and electricity (DGE) sector (as previously reported). Following consideration of the feedback received, the government intends to take forward proposals to review the regulatory thresholds of the Network and Information Systems (NIS) Regulations 2018 in the DGE sector, including whether to bring new critical sub-sectors within scope, and to develop baseline cyber resilience requirements for all Ofgem licensees.

ESAs publish statement on mitigating ICT risks from frontier AI models

The European Supervisory Authorities (ESAs) have published a joint statement on taking a consistent and risk-based approach to ICT risks from frontier AI models.

In the statement, the ESAs encourage financial entities to adjust their ICT risk management processes, procedures and controls to address issues arising from frontier AI models. The statement includes an Annex which provides examples of risk mitigation strategies firms should implement in relation to:

• Prevention, such as applying secure-by-design principles and implementing proactive patching processes.
• Detection, including transitioning from periodic to continuous vulnerability monitoring to reduce detection and response times.
• Risk management and operational resilience, including operational resilience testing, disaster recovery and data backup processes, and adapting risk management frameworks to address AI-assisted threats and potential multi-system failures.

The ESAs expect firms to establish governance structures that support effective management of frontier AI-related risks and to monitor these risks closely. They also call on competent authorities to ensure that firms' management bodies are fully committed to mitigating frontier AI model-driven cyber risks. Firms should have established clear governance and accountability frameworks, prepared timely response plans and dedicated sufficient internal investments to strengthening cyber resilience.

The ESAs will work with competent authorities to maintain a proportionate, risk-based and forward-looking approach regarding emerging risks from advanced AI models. Financial entities subject to the EU's Digital Operational Resilience Act (DORA) should review their ICT risk management frameworks against the risk mitigation strategies outlined in the statement and ensure that governance structures are in place to support effective oversight of frontier AI-related risks.

In the UK, the FCA published findings from its multi-firm review of frontier AI and cyber resilience. See fintech, digital assets, payments and consumer credit section.