Beyond the event horizon: AI, autonomy and the UK's regulatory challenge

Current Regime

The UK's approach to regulating AI has been hands-off for the time being. Across the Channel the EU was an early mover in AI regulation, enacting the risk-based AI Act relatively early, imposing progressively more stringent obligations the higher the risk category of the technology is. Conversely, the UK has opted not to enact any legislation that governs the use of artificial intelligence. Both approaches represent radically different philosophies, with the EU trying to leverage its 'Brussels effect' by becoming a trendsetter in regulating a sector in its infancy, whilst the UK has positioned itself to capitalise on cultivating home-grown AI labs as well as attracting AI-related companies and talent from overseas by maintaining a pro-innovation approach to its regulatory landscape. Whitehall has consistently resisted the introduction of AI-specific regulation citing concerns that an interventionist approach could contribute to "smothering" British innovation.

Autonomous Threats

But what happens when innovation begins to innovate for itself? Is a policy of "wait and see" still appropriate when technological advances are no longer waiting for instructions and are increasingly acting on their own initiative? More importantly, can we "wait and see" when the technology may already be accelerating beyond the point at which meaningful intervention is possible?

These concerns are not merely theoretical. As we explored in our recent article, When the Test Goes Wrong: Why Guardrails Are So Important for AI Usage, incidents involving leading AI developers have already demonstrated how quickly systems can behave in unexpected ways when safeguards fail or are insufficient. The lesson was clear: effective governance and robust guardrails cannot be treated as an afterthought to technological progress.

Anthropic has echoed this sentiment, warning that a new generation of "AI worms" will soon be able to infiltrate and take control of smart devices at home, such as ovens and televisions. "Worms" are malicious programs that are capable of spreading without human input. The idea is that the virus is set in motion and infects a high number of targets on its path. In their 12 October blog post, the developer of Claude warned that we are only months away from living in a reality where "worms", supercharged with the power of AI, will be able to self-replicate and spread from one device to another by exploiting insecure networks and devices. The most significant aspect of this development is that these worms would be capable of operating autonomously, without human intervention, potentially increasing the risk of incidents similar to OpenAI's hack of Hugging Face.

Shifting Posture

Out of all of this, the UK has emerged with a global lead in AI and AI security testing, but critics argue that the British industry is left vulnerable in the absence of regulation. The financial services sector is under particular scrutiny, with the House of Commons Treasury committee issuing a warning in January 2026 that the lack of regulation is exposing "consumers and the financial system to potentially serious harm" by adopting a hands-off approach. However, since then, the Financial Conduct Authority has come out with its own ambitions to become "an agentic regulator". Whilst not imposing any actual regulation for the time being, the FCA is looking to utilise AI in automating supervisory and enforcement activities in the near term, while the FCA's Chief Data Officer Jessica Rusu has promised to go beyond this, and to "automate wherever we can…and to intervene at scale".

However, the emergence of new AI-enabled vulnerability profiles and attack vectors have intensified calls for increased regulation. The UK's new AI minister, Kanishka Narayan, has compared the regulatory landscape at the advent of AI to that of the Industrial Revolution, issuing a stark warning in October to AI labs not to release models where they cannot adequately control the risks. Narayan also advocated for building sovereign AI infrastructure to give the state more meaningful control and has promised to "legislate wherever necessary". The AI minister's rhetoric in recent weeks reflects the growing concern about the lack of AI regulation among the public sector culminating in his warning to the British public that it is "likely, if not inevitable" that the UK's cyber defences will be breached in a similar way to the Hugging Face incident, raising further questions about whether the UK's existing approach remains sustainable.

Conclusion

In conclusion, the UK's approach to AI regulation has been very pro-innovation so far. As of October 2026, the approach can be characterised as a form of "calibrated permissiveness", designed to attract talent and investment on one hand, while safeguarding British innovation on the other.

The tone and posture from the government and industry regulators seem to be shifting towards a more favourable view of regulating AI, as the pace of development appears to be speeding up rather than slowing down, while exposing the industry and public sector to vulnerabilities that impossible to quantify only a few months ago. As AI capabilities continue to advance and new security risks emerge, there is growing recognition that a purely hands-off approach may not remain viable indefinitely. While the UK remains reluctant to introduce regulatory frameworks, recent developments suggest that a more interventionist approach may be on the horizon as policymakers seek to balance innovation with resilience, security and public trust.