Most businesses think of cyber risk as hackers getting in. A new risk is now on the UK government's radar: AI that you have let in yourself, acting in ways you did not intend.
Changes to the Cyber Security and Resilience Bill agreed in the House of Lords on 26 October make that risk a regulatory issue. They also open the door to SaaS providers being regulated more directly.
What is the Bill?
The Bill updates the Network and Information Systems (NIS) Regulations, the UK's main cyber security rules for essential services and certain digital service providers. It is designed to strengthen security and incident reporting across key parts of the economy.
What changed on 26 October
At the Lords report stage, peers agreed three changes that matter for tech businesses.
1. AI agents
An AI agent is AI software that can carry out tasks and take actions on its own, rather than only answering questions. A government amendment would allow future regulations to give the relevant government minister powers to investigate and enforce where a security or operational incident, actual or potential, is caused by losing oversight or control of an AI agent.
Those powers could include requiring information to be preserved, testing, inspections, orders to fix problems and financial penalties. The detailed rules would need consultation and a vote in both Houses of Parliament first.
2. A review covering SaaS and cloud
An opposition amendment requires a review of the NIS regime within 12 months of the Bill becoming law. It must specifically look at cloud services, SaaS, content delivery networks, frontier AI and agentic technologies. It must also consider whether the AI Security Institute, the government body that tests advanced AI, should have legal powers to audit and intervene.
3. Incident reporting
The government dropped a plan to require reporting of incidents that caused no actual harm. It added new factors for deciding whether an incident must be reported, including the impact on users' systems and wider economic or social effects.
What this does not mean yet
The Bill is not law. It still has further stages in Parliament, and the House of Commons may remove or change the review amendment. There is no compliance deadline yet.
Why it matters now
Two signals are clear. Control over AI agents is becoming a cyber security issue, not just a product question. SaaS providers may eventually be brought more directly into cyber regulation.
Even if your business ends up outside the final rules, your customers may not be. Regulated businesses and their key suppliers pass their obligations down the supply chain through contracts. That is usually where smaller tech businesses feel new regulation first.
What to do now
- Map where AI agents act inside your business or your product, and what they can access or change.
- Check who can override or switch off an agent, and how quickly.
- Make sure your incident response plan covers AI behaving unexpectedly, not just external attacks.
- Review customer contracts for security and incident reporting promises you may struggle to meet.
- Review supplier contracts for AI tools that act on your systems. Check liability, notice of incidents and your right to information.
Summary
The rules are not final, but the direction is clear. AI agents and SaaS are moving into the scope of UK cyber regulation, and customer contracts will feel the effect before the law does.
If your product uses AI agents, or your customers are in regulated sectors, book a free 20-minute call with the Ethiqs team.