UK keeps AI safeguards in the maybe pile for Cyber Security BIll

The United Kingdom has found a permanent home for AI safeguards, and it is the maybe pile, which at least has the advantage of being roomy. Alexandra Jones, a director general covering AI and emerging technologies policy, told MPs the government was 'looking at' amendments to the Cyber Security and Resilience Bill and was 'developing the policy to look at whether we use the Cyber Bill to do that.' That is two 'looking ats' and one 'whether' in a single breath—not a legislative programme, but a man squinting at a fuse box and hoping the lights come back on by themselves. Note the grammar of it: they are developing the policy to decide whether to use the policy instrument, which is policy as a rumour of policy.

The vehicle is instructive. Britain's AI safeguards, should they ever exist, may arrive as a clause in the Cyber Security and Resilience Bill—AI rules stapled to cybersecurity legislation the way you tape a tax return to a birthday card and hope nobody reads the back. The UK's approach is 'decentralized and sector-specific,' which in Whitehall means nobody is in charge and everybody is slightly in charge. Ask which regulator owns an AI incident and you will get a committee, a consultation, and a follow-up meeting about the consultation, while the technology in question adds capabilities on something close to a quarterly schedule.

None of this is malice; it is how a system behaves when a wrong decision costs a headline and no decision costs nothing until next year. Jones's evidence is refreshingly honest, which is the trouble: 'looking at' is the most durable piece of infrastructure in Westminster—cheap to build, impossible to inspect, and it never needs planning permission. The maybe pile is now the UK's principal AI safety mechanism, and it performs flawlessly, provided you never expect anything to come out of it.