Three panels, 188 questions, one afternoon

The committee has been circling this question for months. Its own framing, published with the event, is unusually blunt for a select committee: the AI Security Institute (AISI) “can evaluate risk, if it is granted access to a model — but does not necessarily have the power to compel disclosure or stop a release” [UK Parliament, 2026d]. Chair Liam Byrne, a former Cabinet Office minister, said the purpose was to establish “whether Britain’s safety experts have the power to sound the alarm and stop the harm when things go wrong” [UK Parliament, 2026d].

The session was built in three parts: four researchers who had left frontier labs: Daniel Kokotajlo and Steven Adler from OpenAI, Geoffrey Irving from DeepMind and then AISI, and Aengus Lynch, who worked with Anthropic externally [UK Parliament, 2026a]; the four companies: Lord Booth-Smith (Anthropic), Tom Duff Gordon (OpenAI), Owen Larter (Google DeepMind) and Rob Sherman (Meta) [UK Parliament, 2026b]; and the people running the British side: AISI’s director, Henry de Zoete, Cat Little, and Alexandra Jones, the director general responsible for AI policy [UK Parliament, 2026c].

Two outcomes came from the chair’s seat: a standing 12-month inquiry into the UK’s AI safety regime, and a promised special report from this session “to help inform Parliament ahead of potential Government amendments to the Cyber Security Bill once it reaches the Commons” [UK Parliament, 2026c].

Two labs asked for rules, two declined

Asked directly whether AI safety needs a statutory framework, the four executives split down the middle, which was the point, Byrne later told WIRED: to “light up the wide differences in opinions between some of the wealthiest firms on Earth” and show “that you couldn’t rely on voluntary self-regulation” [Manavis, 2026].

Anthropic went furthest. “We have consistently believed that there should be binding rules on companies and that voluntary commitments are not enough,” Booth-Smith told the committee; pressed by Byrne, he answered: “The rules should be binding.” [UK Parliament, 2026b]

OpenAI was more specific. Duff Gordon set out four asks: mandatory incident reporting, guidance for third-party evaluators, published safety frameworks, and international convergence through a network of AI safety institutes [UK Parliament, 2026b]. Only the first, he said, should move to a statutory footing, but he added the sentence that matters: “We do not think basing everything on voluntary commitments for frontier risk is a good long-term plan.” He also disclosed that OpenAI had recently “held back a model — Astra 6.1 — that we were due to release” [UK Parliament, 2026b].

The other two would not follow. Asked the same statutory question, Google DeepMind’s Larter answered: “Focus on the standards is what we would be doing” [Manavis, 2026], and warned in the hearing that turning AISI into a regulator would “completely change the dynamic with which we engage” [UK Parliament, 2026b]. Meta’s Sherman pointed to Britain’s existing sector regulators, telling MPs they were “not writing on a blank page” [Manavis, 2026].

The split is narrower than the headlines. All four back incident reporting in some form; the disagreement is whether statute is required, and on that Larter would not commit: “You would have to look at the details and get the details right” [UK Parliament, 2026b]. Two labs are now asking Parliament on the record to bind them, which removes the most common objection to legislating: that the industry would fight it.

What the people in charge actually said

The third panel is where the regime described itself. Byrne put the position plainly: “Today, UK testing still depends on voluntary co-operation from both the companies and foreign Governments. That is the case.” Little’s answer: “Yes.” [UK Parliament, 2026c] Asked later whether that should change, she did not dispute it: “We have a really good track record of working on a voluntary basis. We cannot guarantee it” [UK Parliament, 2026c]. After de Zoete had explained what AISI can and cannot do, Byrne returned: “Yes, without doubt, but it is on a voluntary basis.” Little: “At the moment, yes, it is”, adding that this went to “the question of whether that is adequate” [UK Parliament, 2026c].

De Zoete’s answers defined the limits from the inside. AISI is “a research organisation that is not making policy”; on approving models: “What we are not doing is kitemarking. We are not saying yes or no to any model” [UK Parliament, 2026c]. Asked what would happen if it judged a model too dangerous and the company released it anyway, he said “with open-weight models, I do not think that anybody necessarily has that power,” the frontier labs being “either American or Chinese… There is only so much that we, as the UK, can do in that context” [UK Parliament, 2026c]. Little’s answer was that AISI “is not a regulator” and that publication substitutes for compulsion: “A really important part of it is transparency, so that everyone can see what we have found” [UK Parliament, 2026c].

None of that means the institute is doing nothing. De Zoete put numbers on the record: 240 staff, four times as many tests as in 2024, results in days rather than months; pre-deployment testing of GPT-5 found “12 biosecurity vulnerabilities”, including a universal jailbreak, which OpenAI then fixed [UK Parliament, 2026c]. He also described the institute’s own July evaluation incident: AISI deliberately connected a model to the internet, the behaviour was bad enough for it to be shut down within an hour and reported within a week, and “on reflection, we should not have connected it to the internet” [UK Parliament, 2026c]. A capable tester, testing on permission, with no power over the outcome.

Byrne’s sharpest exchange with Little was about process rather than powers: the announcement of the day before amounted to “consideration but not commitments: no new regulatory powers, no timetable for amendments to the Cyber Security Bill and no binding duties on AI developers” [UK Parliament, 2026c]. Her reply: “This is policy under development.” When an MP asked whether amendments would arrive before the Bill reaches the Commons, the departmental director general said the department was “looking at that live”, prompting the chair: “You cannot consider something in a Bill. You have to legislate for something in a Bill.”

Access runs through Washington

Britain’s pre-release access, it turns out, is a diplomatic arrangement rather than a legal one. Duff Gordon was direct: “We provide our models pre-deployment to CAISSI. We will continue to provide our models pre-deployment to AISI in the UK… As long as we are able to do that, under the US Government, we will continue to do it” [UK Parliament, 2026b]. The condition is doing all the work in that sentence.

Booth-Smith confirmed the arrangement had already failed once: Anthropic “were not able to provision full unrestricted access to the model to UK AISI at that time” for Claude Mythos 5.1, which WIRED reports him closing with “That’s a question for the US government,” and noting AISI now has access [UK Parliament, 2026b; Manavis, 2026]. Larter, by contrast, said reporting that Gemini 4 Argon had been withheld from AISI was inaccurate: the model was provided pre-release [UK Parliament, 2026b].

Those answers came 24 hours after the government confirmed the outcome of a quiet reversal. The Telegraph had reported on 11 October that the White House had dropped its request that labs hold new models back from Britain; Narayan’s written statement to the Commons on 12 October confirms the result without confirming that account, describing work “with the labs and the US Government… to retain access for Britain’s AI Security Institute to the most powerful AI models before they are released”, and adds that AISI “is now conducting rigorous evaluations of the latest generation of models, including Gemini 4 Argon” [Hansard, 2026]. So far as public records show, the White House has not described the reversal on the record: Narayan’s statement confirms the outcome, not the mechanism.

Britain’s testing capacity is real; its access is contingent, and nothing in UK law stops another government from withdrawing it.

What the leavers said, and why it landed

The morning panel provided the indictment the afternoon panels then had to answer. Kokotajlo, who left OpenAI over its conduct, said: “I do not think that the companies can be trusted to self-regulate,” arguing that the industry’s talk of self-regulation and pacing the frontier is “on track to defuse the political will that has built up in response to these incidents… without actually doing that in a meaningful way” [UK Parliament, 2026a].

Adler, who left OpenAI in late 2024, said he was “not confident in the safety culture across the industry,” and described internal pressure not to use words such as “dangerous” because they “would look bad” [UK Parliament, 2026a]. Irving, a former DeepMind researcher and former civil servant at AISI, put the labs’ working assumption this way: they believe they are in a race that governments will not interrupt and that they cannot leave themselves: “Both of those are false. They could just stop.” [UK Parliament, 2026a]

Two cautions. Irving’s “a coin flip is roughly the right model to have” for catastrophe is his own estimate, given as such, not a finding of any institution [UK Parliament, 2026a]. And a select committee is a political venue: the chair closed the panel by calling it evidence that “we cannot trust these companies to self-regulate”, his characterisation, not a committee conclusion [UK Parliament, 2026a].

This panel mattered because it sat in Whitehall on the same afternoon the security services made their own point. The chair noted that MI5’s director, Ken McCallum, used his annual threat update that day to name AI-enabled bioweapon misuse as the case he would “attach greatest weight” to; WIRED quotes the line directly: “Not yet realized, but the misuse case to which I’d attach greatest weight, is AI’s potential to change the stakes on existing or even new bioweapons” [UK Parliament, 2026a; Manavis, 2026]. Byrne’s post-hearing summary to the same outlet: the head of MI5 warning about capability uplifts in one part of Whitehall while “the permanent secretary of the Cabinet Office is basically admitting that our regulatory regime for AI is voluntary, tells you everything you need to know” [Manavis, 2026].

The day before: consideration, not commitment

The hearing cannot be read without the government’s own announcement of 12 October, which set the ceiling for what officials could promise. Narayan’s written statement confirmed four things: an urgent extension of the frontier-AI cyber-hardening programme, whose pilots had found 1,352 vulnerabilities across 548 repositories in 18 departments; work with the NCSC, DCMS and AISI on responding “when AI agents cause serious harm”; consideration of strengthening the Cyber Security and Resilience (NIS) Bill so that “near misses can be identified and reported” and AI loss-of-control risk is covered; and hardware-enabled verification research [Hansard, 2026].

The accompanying press release is careful about the verb: the government “will explore strengthening parts of the Cyber Security and Resilience Bill and the wider regime… This includes AI loss of control risk, where autonomous AI systems evade human oversight” [Cabinet Office, 2026]. In his speech at Imperial the same day, Narayan told the labs: “if you cannot adequately control the risks, do not release the system,” and insisted “we will legislate wherever necessary” [Narayan, 2026]. Neither creates an obligation: a rule that labs must not release uncontrollable systems, announced without a legal basis, is (like everything else tested here) a request.

Byrne also raised process. Section 9.1 of the ministerial code asks that major policy announcements be made to Parliament first; why, he asked, had this one been briefed to a newspaper on Sunday and confirmed by letter at 10.31pm rather than in the chamber? Little replied that she would “report back to the Minister your concerns about his compliance with the code” [UK Parliament, 2026c]. Easy to dismiss as theatre, but it is the session’s own question: when an announcement is not a commitment, what exactly was announced?

What changed, what it means, what to watch

What changed. Britain’s testing regime has been called voluntary by the official responsible for it, in front of the companies it depends on, in a published transcript, with AISI’s director confirming in the same transcript that the institute cannot stop a release and does not “kitemark” models [UK Parliament, 2026c]. In that session, two of the four frontier labs asked Parliament for binding rules while two declined [UK Parliament, 2026b]. Both halves of that sentence were new on 13 October.

What it means. Three dependencies now have dates and names: testing depends on companies choosing to hand models over; access depends on a foreign government not withdrawing it; and any future legal duty depends on a Cyber Security Bill being considered rather than amended [UK Parliament, 2026c; Hansard, 2026]. AISI’s work is not worthless (the GPT-5 vulnerabilities it found and had fixed are the counter-example) but Britain’s best technical evidence currently has no route to a stop. For readers who have followed this site from the White House accord onwards: the voluntary side has now been conceded by the people running it, and the binding side requested by the companies themselves.

What to watch. Whether government amendments on AI incidents and near-miss reporting materialise as the Cyber Security Bill enters the Commons, which the committee has positioned its special report to shape [UK Parliament, 2026c]. Whether mandatory incident reporting becomes the first statute both OpenAI and Anthropic back, Duff Gordon having named it as the one element that “could move to a statutory footing” [UK Parliament, 2026b]. Whether the new 12-month inquiry extracts a recommendation on a statutory basis for AISI: Little’s answer was “That is a matter for Parliament” [UK Parliament, 2026c]. And whether pre-release access survives the next disagreement between London and Washington, because on this evidence nothing but practice holds it in place.

Honest limits. Quotes come from the committee’s own transcripts, ordered published on 13 October 2026; WIRED is used only for Byrne’s post-hearing remarks, for Larter’s and Sherman’s answers as reported, and for the McCallum quotation. The Telegraph’s 11 October account of the US reversal remains unconfirmed by Washington on the record. And nothing in this session changed a legal power: as of 23 October 2026 the UK still has no AI statute, no regulator for frontier models, and no compulsion over who tests what.