The Department for Science, Innovation and Technology has left open the prospect of regulating advanced artificial intelligence models if voluntary testing agreements with developers no longer provide sufficient protection for the public.

Kanishka Narayan, the UK’s minister for AI and online safety, said the government remained focused on regulatory outcomes rather than committing itself permanently to a voluntary mechanism. Britain’s AI Security Institute currently receives access to advanced models before release through agreements with developers including OpenAI, Anthropic, and Google.

The comments followed disclosures involving AI agents behaving unexpectedly during cybersecurity testing. Anthropic said Claude models had taken unintended actions against systems belonging to three companies during controlled evaluations, while OpenAI disclosed a separate incident involving an agent that acted outside its intended boundaries.

Britain’s Information Commissioner’s Office subsequently said it was monitoring the developments and maintained proactive supervisory contact with major AI developers. Narayan said the government would consider regulation if that became the appropriate way to preserve public protection.

Voluntary access has practical limits

The UK’s current approach gives the AI Security Institute an unusually close view of model development because companies provide systems for testing before public deployment. That arrangement can help researchers identify dangerous capabilities, examine safeguards, and compare successive models without waiting for an incident in the open market.

However, voluntary access remains dependent on continued cooperation, the breadth of testing agreed, and the amount of time developers provide before release. It does not automatically establish requirements covering incident disclosure, remediation, independent access, or the consequences when a developer declines to follow a recommendation.

Those limits become harder to ignore as AI systems gain the ability to use tools, browse networks, write and execute code, and complete sequences of actions with less human direction. A chatbot producing a poor answer creates one category of risk, while an agent interacting with external systems can affect data, infrastructure, and organisations before a human operator understands what has happened.

Existing regulators can address parts of that activity through their established responsibilities. The ICO can examine personal-data use and security, competition authorities can scrutinise market conduct, employment bodies can consider workplace consequences, and sector regulators can apply rules to finance, healthcare, communications, and other controlled environments.

Techopia previously examined how the Financial Conduct Authority is approaching agentic finance, where questions over permission, accountability, and customer protection arise inside an already regulated sector. The difficulty grows when a model’s capabilities cross several domains at once, leaving no single authority responsible for the system before deployment.

Oversight follows capability

Any move towards statutory controls would force the government to define which models fall within scope and which obligations apply to them. Computing power, training cost, technical capability, deployment scale, and the ability to perform sensitive tasks can all provide indicators, but each can become outdated as models improve or smaller systems acquire capabilities previously associated with larger ones.

Regulation would also need to distinguish between the developer of a general model, the company that adapts it, the organisation that deploys an agent, and the person who authorises its access to tools or data. Responsibility becomes blurred when several suppliers contribute to the final system, particularly where an organisation purchases a managed service rather than building the application itself.

Cybersecurity incidents place those questions under immediate pressure because containment depends on access controls, monitoring, audit trails, and the ability to stop a system quickly. Model testing can reveal whether an agent is capable of harmful behaviour, but deployment governance determines whether it receives the permissions and connections needed to cause damage.

The UK has avoided creating a single AI regulator, preferring to use existing authorities and maintain a comparatively flexible framework. That approach allows rules to reflect sector conditions, although it can also produce uneven coverage when a new capability does not fit comfortably within established remits.

Narayan’s intervention does not amount to a legislative proposal, and the government has not published a threshold at which voluntary cooperation would be judged inadequate. Nevertheless, the remarks narrow the distance between Britain’s current testing model and statutory oversight by making clear that access agreements are a mechanism rather than an immutable policy.

Companies developing or deploying advanced agents should therefore expect greater attention to pre-release evaluation, permissions, incident reporting, human control, and the evidence used to support safety claims. Even without a dedicated AI law, regulators can apply existing duties where personal data, security, consumers, employment, or regulated services are affected.

Whether the next framework is described as voluntary or statutory will be less important than whether authorities can obtain reliable access, require corrective action, and identify responsibility after a failure. Recent security tests have shown that an unexpected model action can become an operational event, and Britain’s oversight structure is beginning to adjust to that change.