UK: Lords defeat the Government (202–155) and add a review of AI Security Institute pre-deployment audit powers

The House of Lords has defeated the Government by 202 votes to 155 on the Cyber Security and Resilience (Network and Information Systems) Bill. The vote took place at report stage on Monday 26 October 2026. The amendment adds a review to the Bill, which must consider giving the UK AI Security Institute (AISI) the power to audit frontier AI systems before they are deployed.

Background: the 17-day pause

The vote follows a 17-day pause, starting on 24 September 2026, when AISI could not test new AI models before launch. According to reports, the White House Office of the National Cyber Director asked OpenAI and Anthropic to stop sharing new, unreleased models with AISI until US officials had reviewed them. The pause was reported to have been lifted on 11 October 2026. One outlet noted that the BBC's account did not independently confirm how long the pause lasted or which models were affected.

What the amendment does

• It requires an annual review of which organisations the Bill covers, which could bring more UK businesses into its scope.
• As part of that review, ministers must consider whether to give AISI stronger powers over frontier AI systems.
• Ministers must put the findings on AISI's powers before Parliament. However, the duty to act on the review applies to bringing sectors into scope, not to AISI's powers.

The Government's position

The minister told peers that a regulatory role for AISI would undermine its voluntary partnerships with leading AI developers. Those partnerships give AISI early access to the most advanced models. AISI's testing relies on voluntary memoranda of understanding, and no UK statute requires developers to share models before release.

What it means for organisations

• The Bill is not yet law. It passed the Commons on 16 June 2026 and is now at Lords report stage.
• The Bill covers organisations, not AI vendors. It aims to strengthen the cyber security of organisations that provide essential services. The Government has rejected proposals to bring AI vendors and frontier model developers within its scope.
• Pre-release testing is voluntary. As September showed, the arrangements that give AISI early access to frontier models can be paused.

Sources

• Resultsense: Ministers kept AISI voluntary to protect its access. Peers voted for a review (27 October 2026)
• MLex: More UK businesses could face cyber duties under late-stage bill changes (27 October 2026)
• UK Parliament: Cyber Security and Resilience Bill undergoes further scrutiny in the Lords
• Startup Fortune: UK AI minister details how the restored frontier model testing deal works
• Tech Insider: UK regains AI model access after 17-day freeze
• Tech Jacks Solutions: UK AI Security Institute reportedly regains frontier model access
• The Register: UK cyber bill targets AI users, not the vendors building it
• Safeguard: UK software supply chain and AI security rules

This article gives general information and is not legal advice or a substitute for the legislation, the standards themselves or professional advice.