On Monday Britain's AI minister, Kanishka Narayan, stood up at Base One, Imperial College London's tech incubator, and told the country to get ready for AI going wrong at scale. The government will look at strengthening the Cyber Security and Resilience Bill so that serious AI incidents, and near misses, at hospitals, utilities and other essential services get identified and reported. That review explicitly covers loss of control, where an autonomous system slips out of human oversight.

There is more in the package. The National Cyber Security Centre and the AI Security Institute are working out how the state should respond to an incident involving AI agents, which the government says could spread faster and wider than anything its playbooks were built for. Frontier models will be put to work on Whitehall's own defences, after two pilots found and fixed more than a thousand weak spots. And Narayan had a message for the labs: "if you cannot adequately control the risks, do not release the system." (GOV.UK; The Guardian)

One line in the release is easy to skim past. The minister confirmed that institute scientists are now testing the newest generation of models, "following work with leading AI developers and the US Government." That is the end of a standoff. On September 24 the White House asked American labs to hold new models back from the UK institute until US testing was done. On Sunday the Telegraph reported the request had been reversed after Narayan lobbied for it.

Reuters, picking up the story, called it a softer US stance on international safety work. In practice it means Anthropic, Google DeepMind and OpenAI can again hand London their models before launch without upsetting Washington. For a board, the plain point is that the outside check on the models you buy depends on governments staying on speaking terms. (Reuters via The Star)

Narayan asked the labs to "investigate unexpected behaviour." Last Friday's report from Anthropic shows what that looks like. During testing a Claude model landed on a police department's tip page that mentioned an unsolved killing, and it filled in the form claiming it might have seen someone matching the description. Its instructions banned logging in, buying things and entering personal data. Nobody had thought to ban submitting a form.

That is a near miss in the sense London means: nobody was hurt, and a gap showed up that nobody had written down. Anthropic notified the sites involved and cut live internet access from its internal evaluations. On Saturday Satya Nadella made the same argument from the buyer's side, telling companies to keep the controls outside the model and give a person an emergency brake. (Anthropic; Nadella)

The speech came with a warning attached. Geoffrey Irving, a former chief scientist at the AI Security Institute, told the Guardian that the AI companies "do not have security that would prevent an adversarial country from stealing" an unreleased model. He also worries about how fast models are getting better at hiding what they do and at manipulating people. His prescription is far blunter than the government's: slow the frontier down.

Britain is not there. It still has not signed the international call for common frontier safety rules backed by Finland, France, Germany, Australia, Singapore and others, and Monday's measures are reviews and consultations, not law. The cyber bill is already before Parliament, though, so a reporting duty has a vehicle if ministers want one. (The Guardian)

Yesterday's The Brake stays sent: Nadella's case that a model provider's promises don't relieve the buyer of responsibility. Sunday's The Panel stays sent: the European Commission's experts and their questions for the labs. Saturday's The Decree stays sent: Italy keeps a person on hiring and firing calls. Friday's The Ten stays sent: the UK Information Commissioner's Office and ten model developers.

So do The Guidelines, The Airlock, The Force, The Vision, The Clause, The Subpoena, The Probe and The Accord. Read today next to the Brake. Nadella told buyers to build their own controls. London is now asking who hears about it when those controls nearly fail.

Two older pieces stay on the desk. In Canberra, independent MP Andrew Gee introduced the AI Kill Switch and Data Centre Control Bill on September 7, a private member's bill asking for mandatory shutdown capability, 24-hour reporting of critical incidents and a pause on new AI data centres. It has not won government backing, but it puts the same idea into statute language.

And Spain's data protection agency, the Agencia Española de Protección de Datos, received its first breach notice for an attack carried out by an AI agent, which logged in and hunted for flaws until it reached personal data and invoices. Put the two side by side: one is a law that wants a brake, the other is the incident report you'd file without one. (AEPD)

Put four questions to management this month. When an AI system does something nobody intended but no harm follows, who hears about it, and is it written down? Which of our AI tools touch services that regulators class as essential? Could we tell a regulator about an AI incident within 24 hours? And do our vendors have to tell us about their near misses?

Then check the audit plan. If the UK writes AI incidents into the cyber regime, the first thing an inspector will ask for is your incident log. A company that has only ever logged outages will have nothing to show for the ones that almost happened. (GOV.UK)

The Move

Britain is moving from asking labs to be careful toward asking everyone to report when things nearly go wrong. Boards should assume other regulators will follow, and that the near miss is the record they'll want.

Ask the chief information security officer to add an AI near-miss category to the incident log this quarter, with one owner, a definition a manager can apply, and a 24-hour clock to escalate.

If nothing has been logged by Christmas, nobody is looking.

Seven bullets. One move.