The UK’s AI Security Institute (AISI), part of the Department for Science, Innovation and Technology, has published eight priority areas where frontier AI developers most urgently need shared technical practices. It follows the Prime Minister’s commitment on 22 September 2026 to work towards principles and standards for secure, transparent AI development.
Key points
- The approach is voluntary: AISI says it is not seeking to mandate requirements, but wants industry-developed practices that could later become international standards.
- The eight areas cover risk assessment and documentation, oversight across the AI life cycle, keeping oversight effective as capabilities grow, agentic AI incidents, sharing information on the pace of AI development, independent audit and evaluation, measuring security-relevant capabilities, and measuring alignment.
- For agentic AI incidents, it calls for shared definitions of unsafe agent behaviour, severity ratings, and reporting to affected parties, governments, and the public.
- AISI points to ETSI EN 304 223, which grew out of the UK’s AI cyber security code of practice, as the model for turning practice into standards.
The paper is aimed at frontier developers, but it signals where UK expectations are heading for organisations that deploy AI agents: clear incident definitions and reporting, auditability, and effective human oversight. Organisations building an ISO/IEC 42001 AI management system can use it to check whether their monitoring and incident processes cover agentic AI.
Source: AI Security Institute
This update is general information, not legal advice. If you would like help assessing the impact on your information security or privacy programme, contact us.
