Cyber-security of AI: Government Response

Peter Kyle Excerpts

Monday 3rd February 2025 Written Statements

[The Secretary of State for Science, Innovation and Technology (Peter Kyle)]

Artificial intelligence is one of the most vital technologies of our lifetimes. It has incredible potential to improve our public services, boost productivity and rebuild our economy. However, to take full advantage we need to build trust in these systems which are increasingly part of our day-to-day lives. AI is at the heart of the Government’s plan to kickstart an era of economic growth, transform how we deliver public services, and boost living standards for working people across the country. To fully realise these benefits, we must protect end users and address the very real security threats to AI systems and models.

Last Friday, I set out the Government’s response to the call for views on the cyber-security of AI and set out our ambitious next steps to protect organisations in the UK so they can be confident they can adopt AI securely.

The UK Government’s research into the cyber-security of AI found there are clear and specific risks to the security of AI models and systems throughout the AI life cycle. It is imperative these are addressed so consumers and organisations can safely benefit from AI technologies.

A call for views on the Government’s proposed interventions was held from 15 May 2024 to 9 August 2024. The proposals included a two-part approach, comprised of a voluntary code of practice, which forms the basis for the second part, a global standard developed at an international standards body. Together, these establish baseline security requirements which will help reduce the number and impact of successful cyber-attacks and protect users’ data and the economy.

The Department for Science, Innovation and Technology received 123 responses to the call for views. I greatly appreciate all the responses we received, including those from international partners and industry which make this a truly global endeavour. I am particularly pleased respondents were overwhelmingly supportive of the Government-proposed two-part intervention.

We have taken this feedback and used it to update the code of practice and create a new implementation guide that supports the code. The guide provides detail that supports organisations, particularly small and medium enterprises, with implementing the code. The voluntary code of practice on the cyber-security of AI that is set out in this Government response will be used to inform the development of a new global standard. Through this work, the UK, as a world leader in securing technology, will continue to advocate the importance of cyber-security and the need for a secure by design approach across all technologies.

The code of practice and the new implementation guide forms one part of Government’s wider work on AI and is aligned and contributing to the vital programme that DSIT is progressing on frontier AI to prepare the UK for future advanced AI models. As announced in the King’s Speech last summer, we will deliver on our manifesto commitment by placing binding requirements on the handful of companies developing the most powerful AI systems. This highly targeted legislation will build on the voluntary commitments secured at the Seoul AI safety summit for frontier AI companies to develop and deploy their systems responsibly and strengthen the role of the AI Safety Institute.

This work on the cyber-security of AI is also aligned with DSIT’s other cyber-security initiatives, such as the upcoming draft codes of practice for cyber governance and Software which will improve security practices, outcomes, and confidence for UK organisations.

We have published the Government’s response on www.gov.uk, alongside the updated AI cyber-security code of practice and implementation guide.

As we begin to develop a global standard for AI cyber- security based on this work, it is my hope these documents will help ensure we can all benefit from secure AI and will kickstart economic growth and innovation.

[HCWS409]