UK Cyber Bill: AI appears 0 times in the text; 0 of 47 amendments on the 13 October list are the Government's

The Bill says AI 0 times, and the Lords stage is 11 days away

The Cyber Security and Resilience (Network and Information Systems) Bill, in the text the House of Lords will take at report stage, contains the word AI 0 times. That text is HL Bill 49, printed on 7 September 2026 as amended in Grand Committee: about 35,700 words in the PDF text extract, 61 clauses and 2 schedules (derived). The count is also 0 for artificial intelligence, machine learning, frontier, autonomous, near miss and loss of control. Parliament's Bills page lists report stage for Monday 26 October 2026, which is 11 days after Thursday 15 October (derived), and warns that future dates may be provisional.

Against that count sits a pledge. On Monday 12 October the AI minister said: "We will use every power at our disposal. We will legislate wherever necessary." The Government's news release of the same day says stronger protections against emerging AI threats are "to be considered through the Cyber Security and Resilience Bill regime, such as how serious AI incidents and near misses can be identified and reported". On Tuesday 13 October, according to The Register, a director general told the Business, Innovation, Science and Trade Committee that the Government was "looking at" amendments and "developing the policy to look at whether we use the Cyber Bill". The committee's chair is reported to have replied that a Bill cannot consider something: it has to legislate for it. The running list of report-stage amendments, tabled up to and including 13 October, holds 47 amendments. 0 of them are in the Government's name, and 6 contain an AI term (derived). All 6 were tabled by peers.

What the count does not establish matters as much as the count. It does not show that the Government will table nothing: a running list records what has been tabled, not what is intended, and the Government's Lords minister said on 3 September that she was happy to come back on Report to whether voluntary reporting of threats and near misses should have a statutory footing. It does not show that the Bill cannot reach AI: at three stages (16 June, 14 July and 1 September) the Government said the Bill's national security direction power could, for instance, require an entity to cease using and isolate an AI model. It does not show whose policy any amendment would be, which department owns the Bill, what text is coming, by when, what counts as a near miss, or who would report to whom. And a pledge to legislate wherever necessary does not say who decides what is necessary.

This briefing reads the Bill text, the running lists of amendments, the Explanatory Notes, the Hansard record of all 14 debates on the Bill (derived count), the Government's speech, news release and two written statements, and the Parliament committee pages. Two things could not be read. The committee's oral evidence transcript for 13 October is not yet published: its transcripts page listed 8 September as the latest at about 12:10 BST on 15 October. Every quotation from the hearing therefore comes from The Register's report of 15 October, a secondary source. And three Commons-era PDFs on Parliament's publications site (the Commons amendment papers, the Commons Explanatory Notes and the impact assessment) returned a bot check to a script, which was not bypassed. Hansard and the Lords papers were read instead. Everything below is time-stamped to a reading from 12:00 to 12:30 BST on 15 October 2026, because the amendment list, the stage listing and the transcript can all change within hours. One interest is stated once: the pledge and the Bill are the Government describing its own legislation, and the Anthropic forecast that The Register also cites, of small models self-replicating on smart devices, is a vendor's own research, covered in this site's earlier briefing on that test and not re-examined here.

Promised, considered, tabled: what the record shows

The table sets each step a measure must pass against what the record shows and what it does not. "Not found" means not found in the documents read, in full. It does not mean the thing does not exist.

Where each step stands, read on 15 October 2026 from GOV.UK, Parliament's Bills and committees pages, Hansard and The Register. Counts marked derived are in calc-output.txt.

Step	What the record shows	Not found
Promised	"We will use every power at our disposal. We will legislate wherever necessary." The AI minister, speech and news release, 12 October. The speech adds: "Wherever stronger defences will need stronger legislative support, we will secure it."	A clause, a list of what is necessary, a date, a test for necessity. The three 12 October texts never use the word amendment (derived).
Considered	Written statement HCWS357, 12 October: "we are considering how the regime can be strengthened so that AI cyber and loss of control risks are better understood and protected against". The release: the Government "will explore strengthening parts of the Cyber Security and Resilience Bill and the wider regime".	Which parts. Whether by amendment, by regulations, by the Bill's code of practice or by NCSC guidance.
Looked at, at the hearing	The Register, 15 October: a director general told the committee on 13 October that the Government was "looking at" amendments and "developing the policy to look at whether we use the Cyber Bill". The Chair is reported to have said a Bill cannot consider, it must legislate.	The transcript, which is not yet published. The Register's rendering is shortened and secondary.
Tabled by the Government	0 of 47 amendments on the 13 October running list (derived). At Grand Committee, 69 of 187 numbered amendments were the Government's, and none of the 69 contains an AI term (derived).	Any Government text on AI, loss of control or near misses.
Tabled by others	6 of the 47 contain an AI term, and 1 more defines near miss for voluntary reporting (derived). The amendment giving the AI Security Institute standards and inspection powers was marked new on the 13 October list, the day of the hearing.	Government support. On 1 September the Government's Lords minister said of the AI amendments then before the Committee: "we do not consider the amendments proposed to be the right approach".
Dated	Lords report stage is listed for 26 October 2026, provisional.	A date for any Government text, for the Commons stage, for Royal Assent or for commencement. The incident-reporting duties start on a day set by regulations.
In force	Nothing. The Bill has not passed the Lords. On 14 July the Government's Lords minister said the adjustment period would "probably be for the period up to 2028, when we expect the duties to come into force".	Any AI measure in force, or dated.

The Government's three texts of 12 October are a speech of 2,402 words, a news release of 1,010 and a written statement to the House of 1,083: 4,495 words in all (derived). The word amendment appears in them 0 times (derived). The pledge, legislate wherever necessary, is in the speech and the release. It is not in the written statement, the formal record to Parliament, which uses consider three times and legislate 0 times (derived). The statement closes the Bill paragraph with a different promise: it will "continue to update Parliament during the passage of the Bill". Secondary reporting goes further than the three texts. Infosecurity Magazine, on 13 October, wrote that there "will also be amendments" to the Bill. None of the Government's three texts says that. This site's earlier briefing on the same speech covers its other claims, including the count of vulnerabilities found and the breach judgement, and is not repeated here.

The counts, and how they were made

Every count below is made on the text as printed or extracted, not on a summary of it. The method is a case-insensitive search for AI as a whole word and for the other phrases, on the PDF or HTML text of each document, repeated on a second extraction of the Bill. A word search is blunt: it cannot find a measure that is described without the word. That is why the next section reads the Bill's own powers.

Counts of AI terms in the documents read (derived; text extracts as of 15 October 2026). Terms: AI, artificial intelligence, machine learning, frontier, autonomous, near miss, loss of control.

Document read in full	Size	What the search finds
The Bill: HL Bill 49, as amended in Grand Committee, 7 September 2026	35,713 words; 61 clauses, 2 schedules	0 for every term. The one hit for "automat" is the title of the Automated and Electric Vehicles Act 2018.
Explanatory Notes to HL Bill 32 (17 June 2026)	33,288 words	0 for every term.
Delegated Powers Memorandum (19 June) and supplementary memorandum (25 August)	6,471 and 3,100 words	0 for every term in both.
Policy statement, CP 1299 (April 2025)	7,496 words	2 mentions, neither a measure: data centres support AI development, and adversaries use artificial intelligence tools. 0 for near miss and loss of control.
The Government's three texts of 12 October	4,495 words	0 for amendment. Legislate: speech 2, release 1, written statement 0.
Running list of report amendments, tabled to 13 October	28 pages; 47 amendments	6 with an AI term, 1 with near miss, 0 in the Government's name.
Grand Committee marshalled lists (27 August to 4 September)	187 numbered amendments	12 with an AI or near-miss term. 69 in the Government's name, none with such a term.
King's Speech, 13 May 2026	1,386 words	0 for AI. It names the Cyber Security and Resilience Bill and no AI measure.

The six AI amendments on the 13 October list are five proposals and one passing mention. The proposals are: a duty on frontier AI developers to report incidents in which their model reaches a regulated person's systems, within 24 hours, 72 hours and 14 days, copied to the AI Security Institute; "last-resort" powers to direct the shutdown of data centres or AI systems deployed on a substantial scale in an AI security or operational emergency; an AI Security Institute audit of frontier AI products before they are used in regulated systems, with a 28-day review; AI Security Institute standard-setting, inspection and enforcement powers; and capability "red lines" for AI products, with regulations required within 12 months of passing. The sixth, a digital sovereignty strategy, mentions the AI Security Institute only as a body to be consulted. A seventh amendment, on voluntary notification of incidents, cyber threats and near misses, has no AI term but defines near miss. The same four subjects (red lines, last-resort powers, the Institute's audit and its standards) were before the Grand Committee as amendments 75, 84, 85 and 92 (derived by number), and on 1 September the Government's Lords minister said the Government did not consider those proposals the right approach. The wording on report differs in places.

The calendar, in days

The pledge and the hearing are one day apart. The hearing and the listed Lords stage are 13 days apart. Everything below is calendar arithmetic, labelled derived.

Days between dated events (derived in calc.py). The 26 October stage is a listing that Parliament itself calls provisional.

From, to	Days	What it measures
12 October to 13 October 2026	1	The announcement to the committee hearing.
12 October to 26 October	14	The announcement to the listed Lords report stage.
13 October to 26 October	13	The hearing to the listed stage.
15 October to 26 October	11	Today to the listed stage.
12 November 2025 to 15 October 2026	337	Bill introduced to today: 48.1 weeks.
7 September to 15 October	38	Age of the Bill text that report stage will take.
1 September to 12 October	41	From "exploring whether additional targeted interventions may be needed in future" to the pledge.
16 June to 12 October	118	From the Commons minister saying the direction power could require an AI model to be isolated, to the pledge.
17 July 2024 to 15 October 2026	820	From the King's Speech sentence promising legislation on the most powerful AI models, to today.
13 January 2025 to 15 October 2026	640	From the AI Opportunities Action Plan's call to "act quickly" on how frontier models will be regulated, to today.
15 October 2026 to 1 January 2028	443	To the start of the year the Government said the duties are expected.

Report stage is not the last stage. After third reading in the Lords the Bill returns to the Commons, where Lords amendments are considered, and Parliament's Bills page lists consideration of amendments and Royal Assent as the final stages. Whether any Government AI text would come at report stage, later, or never is not stated. The Bill's own dates are few. Part 1, Part 3 Chapters 1, 3 and 6 (which hold the regulation-making power) and the five-yearly review in clause 40 start on Royal Assent. The statement of strategic priorities chapter starts two months later. The rest, including the incident-reporting duties for data centres, managed service providers and critical suppliers, the code of practice and the national security direction powers, starts on a day the Secretary of State sets by regulations (clause 60). The Bill names no such day.

Which department owns the Bill

Four departments appear in the record. The Register reports that the director general, whose department's remit includes "AI and emerging technologies policy", told MPs that machinery-of-government changes had left the Department for Digital, Culture, Media and Sport responsible for the Bill. Parliament's own page for the Bill still names a different department.

Which department each official surface names for the Bill, read on 15 October 2026. DSIT is the Department for Science, Innovation and Technology; DBIST the Department for Business, Innovation, Science and Trade; DCMS the Department for Digital, Culture, Media and Sport.

Surface	What it says	Names
Parliament's Bills page (last updated 14 October, 18:17)	Sponsoring departments: the Department for Science, Innovation and Technology, for both the Commons and the Lords sponsor.	DSIT
GOV.UK collection and policy statement pages	Tagged to DSIT. The factsheets page is tagged to DCMS and DSIT, with a DSIT contact address.	DSIT, DCMS
GOV.UK DCMS cyber security newsletter page (September edition, page updated 15 October)	"the DSIT cyber security team has moved into a new digital department" and "DCMS now leads on cyber security policy for the economy".	DCMS
Hansard, the Government's Lords minister	Titled for DBIST and DCMS on 1 and 7 September, and for DSIT on 3 September.	DBIST and DCMS, then DSIT
The 12 October release and written statement	The release is published under the Cabinet Office, the AI Security Institute, the NCSC and DCMS. The statement says DCMS, the NCSC and the Institute are developing the response to agentic AI incidents.	Cabinet Office, DCMS
The 13 October hearing (The Register, secondary)	A director general at DBIST said DCMS was responsible for the Bill.	DCMS

The weight of the statements is that DCMS holds the Bill. Parliament's record of who sponsors it has not caught up. The pledge came from a Cabinet Office minister, and the hearing's final panel was a DBIST director general, the Cabinet Office's permanent secretary and the director of the AI Security Institute, speaking about a Bill that DCMS is said to own. Which department, with which minister, would table a Government amendment on AI is therefore a reading, not a statement. For an operator the practical point is smaller: the regulator that will supervise the duties is the competent authority for the sector, not any of these departments.

Who the Bill reaches today, and what the Government already says about AI in it

The Bill amends the Network and Information Systems Regulations 2018 and gives the Secretary of State new powers. None of it is law yet. As printed, its duties on organisations fall on these regulated persons.

Who the Bill reaches, read from HL Bill 49 (7 September 2026) as printed. A reading of the clauses, not legal advice.

Who	How the Bill reaches them	Clauses
Operators of essential services	The essential services already in the NIS Regulations, with data centres added (rated IT load of 1 megawatt or more, or 10 megawatts or more on an enterprise basis) and large load controllers.	3 to 6
Relevant digital service providers	Online marketplaces, online search engines and cloud computing services that are not micro or small enterprises, whether or not established in the UK.	7, 8
Relevant managed service providers	Providers of ongoing management of a customer's IT systems by connecting to, or obtaining access to, those systems; not micro or small enterprises. Data centre services are excluded.	9, 10
Critical suppliers	Persons a regulator designates because they supply a regulated entity directly and an incident affecting them could disrupt it with significant impact on the economy or society.	12
All regulated persons	Regulations on security and resilience, including requirements "relating to the reporting of specified matters" (Part 3); and directions where a compromise, "or the threat of such an occurrence", risks national security, including "a prohibition or restriction on the use of goods, services or facilities" (Part 4).	29 to 35, 43
Not reached by name: AI developers	The Government's Lords minister, 14 July: the Bill "does not specifically bring large language models or AI companies into scope". An organisation in scope that uses an AI model must manage its risks.	None

On what the Bill already says about AI, the Government's position is consistent across 16 June, 14 July and 1 September. The Bill takes an "all hazards, all threats, all technologies" approach. If AI forms part of a system an essential service relies on, the operator must assess and mitigate its risks, for example in drinking water or a hospital. The direction power in Part 4 "could, for instance, require an entity to cease using and isolate an AI model". And on 1 September the Lords minister added that the Government was "exploring whether additional targeted interventions may be needed in future", at an early stage, including whether proportionate containment powers could restrict access to specific AI systems. Read together, those statements describe a Bill that reaches AI as a component of a regulated system, and not as a product. That is the distinction behind the amendments on the 13 October list, which would reach the developer.

Two inferences, labelled as such. First, the Bill's regulation-making power in clause 29 is technology-neutral and clause 30(6) allows requirements on reporting, so a reporting duty for near misses could in principle be made by regulations after Royal Assent without an AI-specific amendment. The Government has not said that is the plan. Such regulations would need consultation and approval of a draft by both Houses (clause 42). Second, a measure that sits in secondary legislation, a code or guidance would reach regulated persons later and with less debate than a clause, which is why "in the Bill" and "under the Bill" are different promises.

Where an AI-specific duty could sit, and what the record shows for each place (read 15 October 2026).

Place	Status on the record	What it needs
A Government amendment at Lords report stage (listed 26 October)	None on the 13 October list.	Text tabled before the stage, then a Lords vote.
A later stage of the Bill	Not stated.	Not stated.
Regulations under clause 29, after Royal Assent	The power exists in the Bill. My reading, not a Government statement: it could carry a reporting duty.	Consultation, then approval of a draft by each House (clause 42).
The statutory code of practice, the Cyber Assessment Framework or NCSC guidance	The 7 September written statement said the Government would consider whether protections for increasingly autonomous AI systems should be clarified or strengthened through these.	Code: the procedure in clauses 36 to 39. Guidance: nothing; it is advice.
Primary legislation outside this Bill	The King's Speech of 17 July 2024 said the Government "will seek to establish the appropriate legislation" for the most powerful AI models. The King's Speech of 13 May 2026 does not mention AI. A search of Parliament's Bills service for Artificial Intelligence returns three bills, all private members' bills, none in the 2026-27 session.	A Government Bill. None found.

Friendly names: what each label does the work of

A comforting word is not a control, and a verb of process is not a commitment. The record uses these labels.

Labels in the 12 and 13 October statements, where each appears and what the record shows behind it.

The label	Where it appears	What the record shows
"Consider" and "considering"	The written statement (three times) and the news release.	A verb of process. The Register reports the committee Chair's answer: a Bill cannot consider, it has to legislate. The pledge sentence is not in the written statement.
"Looking at" and "developing the policy"	A director general at the hearing (The Register).	On her own account the policy is still being developed, so no text can yet exist.
"Step up national defences"	The news release headline.	The measures named are mostly executive: extending the pilots that found 1,352 vulnerabilities across 548 code repositories in 18 departments (the written statement), response planning for agentic AI incidents, and AI Security Institute testing. None needs an Act. The Bill is the one item that could.
"Every power at our disposal"	The speech and the release.	The Bill's direction power, which the Government has pointed to since June, is not yet law, and its Part 4 starts on a day set by regulations. The texts do not list the powers meant.
"Wherever necessary"	The speech and the release.	Necessity is judged by the Government. No test, threshold or deadline is given.
"AI risks"	The release and statement.	Undefined. The Bill reaches AI inside a regulated organisation's systems, not AI developers. Three different risks fit the phrase: AI inside a regulated system, an AI-enabled attack on one, and a developer's model behaving unexpectedly.
"Loss of control"	The release.	Defined there as "where autonomous AI systems evade human oversight". It appears 0 times in the Bill. The AI Security Institute's own 12 October blog lists "how should unsafe agent behaviour be defined and its severity determined" as an open question.
"Serious incidents"	The speech and release.	The Bill's trigger is an incident with significant impact. "Serious AI incident" has no definition anywhere read.

The test of a commitment is a document and a day. The verbs the Government used about the Bill, consider, explore, look at and assess, name neither. The three texts name no amendment at all.

A near miss: four meanings, and no reporter named by the Government

The phrase "how serious incidents and near misses are identified and reported" is the one concrete subject in the pledge. It is also the one the Bill comes closest to already. Clause 15 changes the NIS Regulations definition of an incident from an event with an "actual" adverse effect to one that has, "or capable of having", an adverse effect (my reading of the substitution). For data centres the new reporting duty covers an incident that "could have had" a significant impact. For other operators, the new duty applies to an incident that has affected or is affecting their systems with significant impact, so a pure near miss that never touched the systems is outside it (my reading). The Government told the Lords on 3 September that the wording is intended to capture "significant near misses", not routine scanning, and that thresholds will be set in secondary legislation after consultation.

Four meanings of near miss and incident reporting in the record, and who would report to whom.

Meaning	Source	Who reports to whom
"Significant near misses" caught by the Bill's "capable of having" wording	The Government's Lords minister, 3 September.	The regulated person to its competent authority, with a copy to the NCSC's incident team. Thresholds to follow in regulations.
A mandatory 72-hour report of threats, near misses and sub-threshold incidents	Peers' amendment 72 at Grand Committee. The Government: "I would not support the amendment as drafted."	A regulated person to its authority.
Voluntary notification of incidents, cyber threats and near misses, with no added liability	Peers' amendment on the 13 October list, which defines a near miss as an event that could have compromised availability, authenticity, integrity or confidentiality but was prevented or did not in fact do so.	A regulated person to the NCSC's incident team or its authority.
A frontier developer's report of a model reaching a regulated person's systems	Peers' amendment on the 13 October list: 24 hours, 72 hours and 14 days.	The developer to the regulated person, its authority, the NCSC's incident team and the AI Security Institute.

The Government's own 12 October texts name no reporter and no recipient. The AI Security Institute's 12 October blog lists, as open questions, how unsafe agent behaviour should be defined and its severity determined, and what principles should govern how incidents are reported to affected parties, governments and the public. If the Institute has not settled the definitions, a clause that depends on them before 26 October would be quick work. That is an inference from the Institute's page, not a statement by anyone.

The UK today: what binds an organisation, and where each stops

Until text exists, what binds a UK organisation on AI is a patchwork of existing instruments, none written for AI near misses. The table reads each from its own page and says where it stops.

UK instruments read on 15 October 2026 from legislation.gov.uk, GOV.UK, ncsc.gov.uk, ico.org.uk and aisi.gov.uk, with where each stops. Quotations are short and exact.

Instrument	What it says or requires	Where it stops
NIS Regulations 2018 (in force)	Operators of essential services must notify an incident with a significant impact on the continuity of the service within 72 hours of becoming aware (regulation 11). Penalties reach 17,000,000 pounds (regulation 18). An incident is an event "having an actual adverse effect" on systems (regulation 1).	Only listed sectors and providers. Needs an actual adverse effect, so a near miss is outside it. No AI wording in the three regulations read.
The Bill, if enacted	24-hour initial and 72-hour full notice; incident wording widened to "capable of having"; powers to direct a regulated person to stop using goods or services; critical supplier designation.	Not law. Duties start on a day set by regulations; the Government pointed to 2028. No AI term in the text.
Cyber Essentials requirements v3.3 (April 2026)	Five technical controls: firewalls, secure configuration, security update management, user access control and malware protection.	5,810 words and 0 for AI or agent (derived). Says nothing on models, agents or incident reporting.
NCSC, Managing the cyber risk of agentic AI (20 August 2026)	Interim advice: assess how much autonomy is needed, threat-model, run agents in a sandbox with network access denied by default, give each agent its own identity, log and monitor, and keep the ability to "pull the plug". It says formal guidance will "build upon, and ultimately supersede" the blog.	Advice, not law. Aimed at designers and operators of agentic systems. No reporting duty.
ICO and UK GDPR	The ICO opened a call for evidence on agentic AI on 8 October. It closes on 20 November 2026, 36 days after 15 October (derived). The ICO also reported changes secured from ten foundation model developers and confirmed enquiries into recent agentic AI testing.	Personal data only. A call for evidence is not guidance. No duty to report AI near misses at essential services.
AI Opportunities Action Plan (13 January 2025)	Recommendation 23: "It is also essential to act quickly to provide clarity on how frontier models will be regulated."	The plan does not use the word legislate (0 hits, derived). 640 days have passed (derived).
AI Security Institute	Tests models before release when developers give access. Its 12 October blog says it "is not seeking to mandate requirements for frontier developers". The committee's page says it "does not necessarily have the power to compel disclosure or stop a release".	A research organisation, not a regulator. Access is voluntary. No power to require a report.

Read together, the gap is plain. Today's law needs an actual adverse effect and a listed sector. The advice is current and detailed, but advice. The Government's pledge is the only item that points at a duty on AI near misses, and it is not text. For an organisation that uses AI agents in regulated or public services, the controls that exist are the NCSC's interim advice and its own contracts.

What to do, in order

Three lists, one for each reader, each ordered by what is worth doing first. None depends on any amendment being tabled, and none should wait for one.

The question that exposes the gap

If the Government will legislate wherever necessary, which department will put which words into which clause, by 26 October or at any later stage, saying what an AI near miss is and who must report it to whom? Until that is answered, the pledge is a pledge, and the text is the one that says AI 0 times.

Key facts