The government's clause, agreed without a division

The vehicle was not an AI bill. The Cyber Security and Resilience (NIS) Bill updates the UK's rules for hospitals, water, energy and the rest of the critical-services estate; AI arrived in it as a set of government amendments on report stage. Amendment 70 inserts a new clause titled "Functions of the Secretary of State: loss of control of artificial intelligence agent", which lets regulations confer investigatory and enforcement functions on ministers where a compromise to a regulated system "is or may be attributable to loss of oversight or control of an AI agent" [Hansard, 2026a]. Its companion, Amendment 74, extends the same route into the bill's financial-penalties clause [Hansard, 2026a]. Both were agreed without a vote.

Two features matter more than the headline. First, the operative words are undefined: in the enacted text, "'AI agent' has the meaning given by regulations made by the Secretary of State", and the same is true of "loss of oversight or control" [Hansard, 2026a]. The statute will carry the phrase; the scope arrives later, through secondary legislation that Parliament has not yet seen. Second, the power is reactive by design. It is triggered by a compromise that has happened or may happen, and it runs from the regulated service outwards — appointing inspectors, entry and search, compelled testing, information held outside the UK and penalties are the menu the clause opens up [Hansard, 2026a].

The minister, Baroness Lloyd of Effra, described the intent plainly: future regulations could "enable the Government to use in-house expertise, such as AISI, and gather information on why agentic incidents in our essential services happen", with the findings then shared to prevent repeats [Hansard, 2026a]. She added three further measures promised in secondary legislation — security requirements to reduce agentic incidents, preservation of incident information, and a duty on regulated entities to warn other organisations when their agents are disrupting someone else's operations — all of them to be consulted on [Hansard, 2026a]. In other words: the government wrote itself the power to look into AI failures, and left both the definitions and the duties to a later, quieter parliamentary stage.

The clause that would have made it work

Baroness Harding of Winscombe's Amendment 41 was the mirror image. It would have required a frontier developer that is, or ought reasonably to be, aware that its model gained unauthorised access to a regulated service to notify that service and its regulator within 24 hours, update within 72 hours and report fully within 14 days, stating whether the model acted autonomously or was used by someone else [Hansard, 2026a]. It would have put the reporting duty on the same firms the government's clause empowers ministers to investigate.

The case for it was made in one sentence by Lord Tarassenko: "no one can investigate an incident they have not been told about. Amendment 41 is what makes Amendment 70 work" [Hansard, 2026a]. Harding told the House the duty was not hypothetical — arguing that OpenAI's access to Australian Medicare data in June went unreported to the Australian government until September "via an unmanned email", a claim she made on the record, not a finding of any inquiry [Hansard, 2026a]. She pressed it to a division at 6.29pm and lost: 95 Contents to 165 Not-Contents, the first division ever taken on this bill in the Lords [Hansard, 2026a; UK Parliament, 2026a].

The government's reasons are the sentence to keep. Lloyd said the bill's reporting requirements already "place the onus for reporting on the regulated entities affected by an incident", which is why she "cannot support Amendment 41 … which would place the onus for reporting on developers of frontier models rather than regulated entities", adding that "regulating the developers of frontier AI is a different question, and I do not believe that this Bill is the right legislative framework in which to answer it" [Hansard, 2026a]. Harding's reply rejected the global-standards framing: "I do not accept the argument that this is a global issue … It will require national action, not just global talking", noting that the EU, California and New York had already acted [Hansard, 2026a]. The government promised a consultation on how the incident-reporting regime will work instead [Hansard, 2026a].

The pattern is now clear enough to state: when an AI agent loses control, the organisation entitled to investigate is the state, the organisation obliged to report is the victim, and the organisation whose model caused it discloses voluntarily. That is not a conspiracy; it is what the division record says.

AISI gets a review instead of a power

The same debate settled the question of what role the AI Security Institute would play — by not giving it one. Amendments to give AISI a statutory function, including Lord Tarassenko's pre-deployment audit regime and Baroness Kidron's red lines, were recorded as not moved, so the House never voted on them [Hansard, 2026a]. The reason was given on the record by the minister: "a regulatory role for AISI would undermine its voluntary partnership with leading AI developers, which give it early access to the most advanced models and on which its vital work to inform government depends" [Hansard, 2026a]. Statutory power, in this government's analysis, would cost the institute the very access that makes it useful.

That reading is consistent with how the arrangement actually works. Two days after the debate, a Cabinet Office written answer confirmed that "AISI signs a collaboration agreement with every developer whose models it tests before release", with results shared "in line with the individual agreements we have in place" [UK Parliament, 2026d]. Access to frontier models is a private contract with each company, not a legal right — which is precisely why ministers resisted putting it on a statutory footing.

What peers extracted instead was a delayed reckoning. Lord Birt's Amendment 163, carried against the government by 202 votes to 155, requires the Secretary of State to review the effectiveness of the regime within 12 months of Royal Assent and annually thereafter; the review must consider the institutional framework the regime runs on, listing the AI Security Institute among the bodies to be examined, alongside the question of which sectors should be in scope [Hansard, 2026a; UK Parliament, 2026a]. Secondary analysis of the marshalled list reads that framework reference as extending to AISI's powers, a point to watch in the clause's final wording [Yeandel, 2026]. Viscount Camrose's register of foreign powers posing risks to critical networks also passed, 194–155 [UK Parliament, 2026a]. The government lost two of three divisions in one evening, and the price of the win on the AI clause was a review that arrives after the Act, not before it.

What the government conceded anyway

Buried in the same sitting were two concessions that change what gets reported at all. The definition of a reportable incident was narrowed to an event which "has had an actual adverse impact" on a system's security and operations, dropping the earlier "could have had" wording that ministers accepted would have "drown[ed] the NCSC in thousands of false positives" [Hansard, 2026a]. And mandatory near-miss reporting for data centre operators was removed from the bill, replaced by a ministerial commitment to build a voluntary near-miss framework for all regulated entities [Hansard, 2026a].

Lord Clement-Jones named the trade in three words: "Reporting is not resilience" — welcoming the narrowing while making clear what had been given up [Hansard, 2026a]. For readers tracking this site's coverage, the direction of travel is consistent: the obligations that survive are the ones that fall on the entities that have already been breached, and the obligations that fall on the frontier labs remain, as our23 October account of the Commons hearing put it, a matter of goodwill — a watch line this report stage has now answered [Singularity AI, 2026].

Third reading: out of the Lords unchanged

The bill had its third reading on Monday 2 November at 3.35pm. The only amendments moved were four government technical corrections — tidying the phrase "data centre services" and cross-references to the definition of "regulated person" — all agreed in seven minutes [Hansard, 2026b]. No peer amendments were tabled on the day, no divisions were held, and at 3.42pm the bill passed and was returned to the Commons with amendments [Hansard, 2026b]. Peers had flagged drafting errors in the clauses they themselves had added, including a cross-reference in the new review clause that points at subsections containing none of the activities it names; with no manuscript amendment moved, that correction now has to happen in the Commons, or not at all [Yeandel, 2026; UK Parliament, 2026b].

Lord Clement-Jones used the "do now pass" debate to put the next decision on the government's desk: "The decision now rests squarely with the Government whether to engage in parliamentary ping-pong or accept this amendment as a sensible and constructive way forward" [Hansard, 2026b]. The bill now goes back to the Commons for consideration of Lords amendments, where the two defeats and the AI clause arrive together.

What changed, what it means, what to watch

What changed. Britain now has, in a bill about hospitals and water, a ministerial power to investigate and punish security failures attributable to an AI agent losing control — agreed without a vote, with both key terms deferred to regulations — and has refused, by 165 votes to 95, to make the model's developer report them [Hansard, 2026a; UK Parliament, 2026a]. AISI's access to frontier models was defended as a reason not to regulate it, and converted into a review that starts after Royal Assent [Hansard, 2026a]. The bill left the Lords on 2 November with all of it intact [Hansard, 2026b].

What it means. The UK's answer to "who tells whom when a model breaks in" is being assembled piecemeal inside a cyber bill: victims report, ministers investigate, labs disclose voluntarily, and the definitions that decide how much of the new power can actually be used are secondary legislation nobody has seen. None of this is settled law until Royal Assent, and the government can implement its own clause broadly or narrowly. The honest reading of the votes: reactive powers over incidents landed; proactive duties on labs did not.

What to watch. Commons consideration of Lords amendments — whether the government defends Amendment 163's review clause or sends it back, and whether any peer amendment survives the corridor in amended form. Whether the promised consultation on incident reporting materialises with a timetable. When, and in what words, "AI agent" and "loss of oversight or control" are defined in regulations. And whether the defeated reporting duty returns from another direction: two of the four frontier labs told Parliament in October they would accept a statutory reporting rule [Singularity AI, 2026].

Honest limits. The bill is not an Act; report-stage amendments can still be altered or removed, and division numbers and marshalled text are the records to quote, not running amendment lists. Hansard's debate text is the uncorrected rolling version. Harding's Australian example and the framing of what AISI's review can reach are statements made in debate or secondary readings of the clause, labelled as such above. And the government's power means nothing until regulations define its trigger — which is exactly why the undefined terms deserve more attention than the vote totals.