UK to strengthen cyber defenses and demand more safety from AI labs

UK AI minister Kanishka Narayan will say that the country cannot rely entirely on tech companies for the safety of their own models. According to the Guardian, he will urge the developers of the most powerful AI systems to step up their safety work, and will also announce stronger British cyber defenses. The speech is scheduled for 12 October 2026.

The Guardian's account boils down to one point: it is not enough for model creators to be the only ones checking their models. The state wants levers and capacity of its own. The published announcement contains no figures, budgets or timelines, so it is too early to judge the scale of the package.

What we know about the statement

Narayan has led the UK's AI portfolio since autumn 2025. As described in the announcement, his message comes down to three points.

• Companies that build frontier AI systems must invest more in safety.
• Britain cannot rely on tech giants to police their own models.
• The country needs to develop its own AI infrastructure.

The three points are linked. Without compute and expertise, the government can only ask companies to act in good faith. With them, it can test models itself.

Context: from voluntary commitments to a home-grown base

London's approach to AI has long rested on voluntary cooperation with the labs. The UK's AI Safety Institute, renamed the AI Security Institute in 2025, got access to models for testing through agreements rather than binding legal requirements. The change in name from safety to security already signaled a shift in emphasis toward cyber threats, misuse and national security risks.

Infrastructure is a separate track. In 2025, the Isambard-AI supercomputer, built on 5 448 Nvidia GH200 chips, went live in Bristol. The government has also promoted AI growth zones, where data center construction is fast-tracked. Narayan's talk of "its own" infrastructure continues that course: without access to compute, a country remains a consumer of other people's models and other people's safety standards.

Cyber defense is not an incidental add-on here. Advanced models can already help find vulnerabilities and write code, which changes both attack and defense. The state has to harden its own systems while also demanding that developers ensure their models do not make attacks easier.

What is still missing

The announcement names no funding amount, no specific cyber defense measures, and no mechanism the government will use to push companies toward greater safety. It is unclear whether this will mean new legislation, conditions in government procurement, or expanded powers for the AI Security Institute. These are the key questions, and the answers will only emerge after the speech itself and the publication of documents.

Practical takeaways

For AI companies operating in the British market, the signal is unambiguous: rhetoric about voluntary commitments is giving way to talk of things that can be verified. It makes sense to prepare documentation of risk assessments, red-teaming results, and a description of how the model behaves in cyber scenarios.

For teams that use AI inside their business, it is worth reviewing their own cyber defenses with the tools available to attackers in mind. For investors and infrastructure suppliers, something else matters more: if London does build up national compute capacity, contracts will follow for data centers, power and cooling. The details of the program will have to be tracked through official publications.