The UK will explore AI incident reporting for essential services, while a separate draft proposal targets frontier AI companies.
Why it matters: Model developers, model operators and essential-service operators could face different obligations, but the government has not said they will fall under one regime. The scope, thresholds and enforcement of any new duties remain unresolved.
- On October 12, 2026, the government said it would explore strengthening the Cyber Security and Resilience Bill and related regimes for emerging AI risks affecting essential services.
- Sifted reported that the UK is drafting compulsory safety-reporting requirements for frontier AI companies, including serious incidents, near misses and autonomous systems that evade human oversight.
- The government announcement said two AI vulnerability-discovery pilots, conducted in 2024 and 2025, identified more than 1,000 vulnerabilities; that figure counts vulnerabilities, not reported AI incidents.
- The government has not announced reporting thresholds, deadlines, penalties, a regulator or confidentiality rules.
The UK government has announced work on AI risks affecting essential services, while Sifted reports that officials are drafting compulsory safety-reporting requirements for frontier AI companies. Those are related but not yet a single confirmed framework.
The government said on October 12, 2026, that it would explore strengthening the Cyber Security and Resilience Bill and related regimes. The official announcement says the work will examine how serious AI incidents and near misses affecting essential services should be identified and reported, according to the government.
The announcement also refers to two AI vulnerability-discovery pilots, one in 2024 and one in 2025. Together, they identified more than 1,000 vulnerabilities. That is a count of vulnerabilities found through the pilots, not a count of serious AI incidents or near misses in essential services.
Sifted's reported draft would cover serious incidents, near misses and failures involving autonomous systems that evade human oversight. The government announcement separately focuses on AI risks in essential services, including hospitals and utilities. A frontier-model developer builds a model; a model operator deploys or runs it; an essential-service operator uses systems in settings such as healthcare or utilities. The government has not said whether all three groups would be covered by the same duties.
AI Minister Kanishka Narayan said: "I want Britain to become one of the hardest countries in the world to attack using artificial intelligence." He added: "We will use every power at our disposal. We will legislate wherever necessary."
The possible change would go beyond the UK's 2023 frontier-AI guidance, which treated incident and near-miss reporting as an emerging safety practice rather than a binding requirement. The guidance was not mandatory.
The scope remains unresolved. The government said it would develop measures with parliamentarians, technical experts and affected operators. In parliamentary evidence dated February 25, 2026, Narayan said UK AI regulation generally relies on sector-specific, ex-post compliance regimes rather than general prior approval for advanced models. That earlier evidence underscores the open question of whether any reporting duty would attach to developers, operators, essential-service providers or some combination of them, according to parliamentary evidence.
By the numbers
- 1,000-plus - vulnerabilities identified in two AI vulnerability-discovery pilots conducted in 2024 and 2025
- October 12, 2026 - date of the government's announcement on exploring AI-risk measures for essential services
- February 25, 2026 - date of Narayan's parliamentary evidence on the UK's sector-specific approach to AI regulation
Yes, but: The government has confirmed exploratory work on incident reporting for essential services, not compulsory reporting by frontier AI companies. Sifted's account describes a draft proposal, and its final scope and legal status are not settled.
What's next: The government said it will work with parliamentarians, technical experts and affected operators to develop possible measures, including how serious AI incidents and near misses should be identified and reported.