Oral evidence: AI adoption, safety and governance, HC 689

Oral evidence, 13 October 2026.

Witnesses

Henry de Zoete, Cat Little and Alexandra Jones.

Chair

Welcome to this final panel in today’s hearings on AI safety and security. Thank you very much indeed to our witnesses for joining us today. Cat Little, congratulations to you on your new role in His Majesty’s Government. Cat Little, can I start with you? Was yesterday’s announcement an important announcement of Government policy?

Cat Little

In relation to the announcement that Minister Narayan made, yes. Ultimately, it is setting out the approach to safety and cyber-security, and the importance of working with our partners to protect the British public.

Chair

I know you will have memorised section 9.1 of the ministerial code, but, if you have not, let me read it to you: “When Parliament is in session, the most important announcements of government policy should be made in the first instance in Parliament.” Why was it briefed to the Telegraph on Sunday?

Cat Little

Our Ministers take their responsibilities very seriously. I am aware that there was some trailing in advance. I will report back to the Minister your concerns about his compliance with the code. I will support him and give him some advice on how best to respond to that. Ultimately, it is an important part of the overall work that we are doing on AI. I hope that we will be able to give you more information today at this hearing.

Chair

Why was there not an oral statement in the House?

Cat Little

I will need to come back to you on that. This was an important thing that Ministers wanted to talk about very quickly upon the closure of recess.

Chair

But not in the House of Commons.

Cat Little

Clearly, that is not the case—yes.

Chair

The announcement, which was confirmed in Minister Narayan’s letter at 10.31 pm last night, reiterates merely the contents of the written ministerial statement. It says that the Government are offering consideration but not commitments: no new regulatory powers, no timetable for amendments to the Cyber Security Bill and no binding duties on AI developers. Is that true? Have I understood the announcement correctly?

Cat Little

As the Minister set out, there are a number of different actions that we are taking to make sure that we both manage the risks and promote the opportunities of AI. There is a combination of things that we are working on. Part of it is regulation; part of it is the standards, the principles, the approach and the work that we are taking globally at the G20, which the Prime Minister has already spoken about; and, of course, there is the work of AISI. It is up to Ministers to set out the full timetable. I am confident that that will happen in due course.

Chair

Incident reporting remains undecided and, from my reading of the letter, it could place the obligations on affected essential services rather than the AI companies responsible. Is that true?

Cat Little

I am very sorry. What are you reading from?

Chair

Is the Government’s approach to mandatory incident reporting undecided?

Cat Little

It is one of the things that we are looking at. I know that in your previous panels you have been talking to industry about how this will work. Transparency, reporting, the standards, the regulation and the opportunities that we have to manage AI safety are part of the work that is under way. This is policy under development.

Chair

It is under development. The Minister says that systems should not be released if the risks cannot be controlled. Should the Government therefore make that requirement enforceable?

Cat Little

To the extent that we can, yes. Everything that we are doing has to have real-world delivery bite. A lot of the work that we are doing at the moment is on a voluntary basis in partnership with industry, but, for all the reasons that you have just discussed with your previous panels, that is exactly why we are doing further work on standards, principles, guardrails and regulation, and using our convening power to make sure that we are taking all the action that is necessary.

Chair

Today, UK testing still depends on voluntary co-operation from both the companies and foreign Governments. That is the case.

Cat Little

Yes.

Chair

Should that change?

Cat Little

At the moment, if you look at the evidence—Henry might want to add to this—we have a really good track record of working on a voluntary basis. We cannot guarantee it, but the success of the work that we are doing particularly with AISI is dependent on having access to models. We have really good relationships and a good track record of that being the case. We are very fortunate to have AISI as part of the package of levers that we have within the UK to manage risk.

Chair

Let us compare the Government’s approach to AI with its approach to, say, aviation, financial services, pharmaceuticals and food safety. In aviation, financial services, pharmaceuticals and food safety, you have proactive risk monitoring, independently set safety standards, authorisation of market entry, post-market monitoring, an independent regulator with enforcement powers, accountability measures, routes to redress, and transparency and reporting requirements that are mandatory. I cannot quite understand why the Government are not proposing to align the AI safety regime with the approach that we take in aviation, financial services, pharmaceuticals and food safety.

Cat Little

The Committee will be aware that our approach to the regulation of general technology is to regulate within context. One of the big policy questions at the moment is whether that continues to be enough. Given the pace at which the frontier models are moving and the level of risk that we are seeing, yes, regulation has a really important part to play. Ministers have made it very clear that we will see regulation where we think it is enforceable, useful and will have an impact. That has to be part of a total framework that includes the work that we do in pre-testing deployment, the convening power that we have with other countries and the work that we do with the labs, and it also has to be part of the guardrails that can be enforced on a day-to-day basis. The pace at which these risks are potentially manifesting needs an urgent and comprehensive response. Regulation is part of the answer, but it is not everything.

Chair

Given the urgency that you have underlined, can we expect amendments to the Cyber Security Bill by the time that it gets to the Commons?

Cat Little

I do not know whether Alex might want to add to this. It is probably worth explaining our different roles. I am here as the Permanent Secretary of the Cabinet Office, which is responsible for AISI. Alex Jones is the director general responsible for AI policy in my new Department, the Department for Business, Innovation, Science and Trade.

Alexandra Jones

DCMS is responsible for the Bill, but we are proposing, in the speech that the Minister made yesterday, to use the Cyber Security and Resilience Bill to consider changes to improve preparedness for AI cyber and loss-of-control risks, and to look at how serious incidents and near misses are identified and reported, and how AI-driven disruption across the organisations is contained.

Chair

Alex, just to interrupt, you cannot consider something in a Bill. You have to legislate for something in a Bill. Given the urgency that Cat Little has just underlined, by the time the Cyber Security Bill hits the Commons, will there be Government amendments to deal with some of the risks that we have identified?

Alexandra Jones

The consideration is that we are looking at that live—developing the policy to look at whether we use the cyber Bill to do that.

Chair

“We’re thinking about it.”

Alexandra Jones

We are developing the policy very rapidly, given the pace at which the technology is developing.

Charlie Maynard

To whoever would like to answer, if AISI decides that a model is too dangerous to deploy or should be withdrawn, what plan do the Government have to effect that?

Cat Little

Henry, do you want to explain what happens when we do our testing and how we work with laboratories?

Charlie Maynard

Importantly, if you say no, so you do not approve it—that is what I am asking—and they carry on, what do we do?

Cat Little

That is what Henry is going to explain for us.

Henry de Zoete

I will try. Chair, if you do not mind, I want to say at the start that I owe an apology to all the Members. We were bad at getting back to your letters. It slipped between my predecessor and me, with the change of Government.

Chair

We call it the change of Administration.

Henry de Zoete

Well, it was the machinery of government change. I would like to apologise to everybody for that.

Chair

That is understood. We are grateful.

Henry de Zoete

As I said in my letter, I am keen to invite everybody into the security institute so we can do an afternoon or a day to talk about all these things in depth.

Chair

We had better break this to you now. The Committee has just agreed an ongoing inquiry into the UK’s AI safety regime, which will unfold from today over the course of the next 12 months, with its first report in the months ahead.

Henry de Zoete

It is hugely welcome to hear that. We are keen to help as much as we can and to provide whatever you need for it. On the specific question, right at the start it is worth saying what AISI is and what it is not. It is a part of the Cabinet Office. It is a directorate there. It is a research organisation that is not making policy. What are we doing when we test models? When an AI company says, “We want you to test a model,” we say to it, “How powerful is it?” We need some information about it. We will not test every single model that is out there. It is not worth our time or resources to test some of the less powerful ones. We will then go through a process of testing that model—I can talk in depth about that—and then we will write back to the company with what we have found. Then the company will take actions to improve things, depending on what we have done. What we are not doing is kitemarking. We are not saying yes or no to any model. That is not what we are doing in our role.

Charlie Maynard

Let us say you write back saying, “We are absolutely terrified about what this model is.” You are relying entirely on their good graces to say, “We agree with you.” Let us say that they do not agree with you and they proceed. I am worried about that model then being put out into the public domain, the world. Your job and our job is to protect 70 million UK citizens. How do we protect them?

Cat Little

If I could just add to what Henry has said, it is really important to understand that AISI is not a regulator.

Charlie Maynard

I am clear on that.

Cat Little

Of course, the research, evaluation and testing that is undertaken is publicly and transparently reported. If we look back at the incident that happened in July, we very quickly reported the evaluation and what we had found. Ultimately, we are not just reliant on voluntary good will. A really important part of it is transparency, so that everyone can see what we have found and what the risks are. Ultimately, like many products, this is about making sure that people are informed and aware of what risks are there.

Chair

The challenge we have is that Ken McCallum has warned this afternoon about low-capability terrorists being given a capability uplift using AI to develop bioweapons. Mr Maynard is asking what powers are available to stop that technology entering the UK market. What is the answer to that, Mr de Zoete?

Henry de Zoete

Specifically on that biosecurity, I will give an example of the work we have done with an AI company. Last year, before OpenAI released GPT-5, we did our testing. We found 12 biosecurity vulnerabilities.

Chair

Say that again. You found 12 biosecurity vulnerabilities?

Henry de Zoete

We have talked about this publicly. We found 12 biosecurity vulnerabilities in GPT-5 before it was released in our pre-deployment testing. That also included a universal jailbreak, which is where you can remove all the safeguards very easily. We took that back to OpenAI. It made a whole bunch of changes to the model and publicly praised the work that it did with AISI to make those changes. That is a real example of how we have made the world safer.

Charlie Maynard

There are a whole load of Chinese models too, for which you do not have these agreements in place. You might be looking at the US and they might do everything that you want them to do, but the Chinese do not and the people with those Chinese models do not. The key question is, “What controls do we have?” By the way, I am not saying that there is an easy answer or that I have the answer. I am not. I am worried; I am scared. What can we do, as a country, to protect ourselves against a very dangerous model? Is there a plan? Maybe that is the first question: is there a plan?

Cat Little

Yes, and Alex should add to this. I must come back to what the Prime Minister and Ministers have already said. Fundamentally, this is about working with international partners and using our convening power, especially at the G20 during our presidency year, to tackle this issue. This is not something that the UK alone can lead on. We have to work with all of our foreign colleagues and industry partners to make the most effective response to exactly your question. The work that goes into the G20 is very much under way, but, Alex, you should add to that.

Alexandra Jones

Building on that, and also on your specific issues around biosecurity, for example, we have the UK biological security strategy, which is all about making sure that we are resilient to a whole range of biological risks. The Ministry of Defence announced an investment of £115 million earlier this year to make sure that we are raising our defences against AI. That includes using AI to improve our biological security. AI clearly has real opportunities in relation to developing drugs, but also massive challenges. The MOD investment is about improving biological security and mitigating some of the risks posed by autonomous AI agents, and that is alongside investments in biosecurity centres. I know that that does not respond to all those risks, but there is definitely a particular plan.

Chair

We might as well nail this down, just so that we all know where everything is. We have had a pretty stark warning from Ken McCallum this afternoon. We have heard a range of views today from AI companies on statutory regulation and the role of international conventions. The truth, though, Henry de Zoete, is that we do not have the power to stop dangerous AI models becoming available to bad actors in this country, do we?

Henry de Zoete

AISI is a research org. It is up to Ministers what they want to do with—

Chair

I just want to clarify where we are right now. We do not have the power to stop bad actors getting hold of dangerous technology.

Cat Little

The truth is that there are lots of factors at play here. There is not one single thing that is a silver bullet to answering your question.

Chair

I know that. I am just trying to establish a single view of the truth, which is that we do not have the power to stop that dangerous technology becoming available to bad actors. Mr de Zoete?

Henry de Zoete

With open-weight models, I do not think that anybody necessarily has that power. There is a bunch of things to think about here. These companies, which are either American or Chinese, are building at the frontier the stuff that is the most powerful. There is only so much that we, as the UK, can do in that context. We are doing extremely good work at the AI Security Institute and in diplomatic engagement to try to move things in the right direction on it. At AISI, that is not just pre-deployment testing of the models, but post-deployment testing of the models. We are doing research. We are publishing things to move the field onwards. We have built six or seven tools that we have open-sourced to carry out evaluations, which all the AI companies are currently using. The US AISI equivalent uses it. The South Korean equivalent uses it. Japan uses it. The EU uses it. We are at the heart of the international network of AI security institutes. The UK is doing a hell of a lot to try to move things in the right direction.

Chair

Yes, without doubt, but it is on a voluntary basis.

Cat Little

At the moment, yes, it is, but the implicit point that you are making goes to the question of whether that is adequate. That is exactly why we are using our unique position, as Henry has just set out, to make sure that we really tackle and address that question.

Sarah Edwards

I am sure that we will return to that, but let me move on briefly to some slightly more positive potential for artificial intelligence. Ministers have talked a lot about how we could deploy it to improve the economy and support public services. I just wonder how we can get the balance right. If we are going to train these models and to work collaboratively, as we have heard, what do we have to bear in mind when we consider that there is still going to be a risk there, but we know that there are lots of benefits that we could achieve? Cat, you may wish to comment, but, Henry, perhaps from the institute’s perspective, how can we make sure that we are not just being completely permissive and that we still have some safeguards, so that, when we are deploying this in public services, hopefully to great effect, we do have that confidence?

Cat Little

Do you mind if I start?

Sarah Edwards

Of course—that’s fine.

Cat Little

I know that Henry will want to give an AISI perspective, but your question is primarily a policy question about how we manage the very best opportunities that come from AI while balancing that with the risks. The simple answer is that AI is the defining opportunity and the biggest challenge of our generation. There is absolutely no doubt about it. We should not be forced to choose between the opportunity for progress, productivity and prosperity, and safety. They are totally intertwined, and I do not believe that we can deliver the benefits of AI if we do not also have trust and safety at the heart of our agenda. We know that we have to be able to do both. It is not a decision between the two.

Sarah Edwards

Thank you. Henry, can you add some flavour to that? We have just had quite a debate in this Committee about whether that is even possible, whether there is that trust, and whether we can deploy those things. I know that we want all the good things from it, but we are all now starting to panic slightly about the bad things that come from it. Are we sure about that deployment, particularly in public services? I am not clear, for example, on why we need to train them on everything in the world entirely, to be perfectly frank. If we are going to deploy them in the public sector, are we going to be looking at models that are looking at very specific tasks? That would be a much easier way, surely, to contain what they do and how they do it.

Cat Little

Yes, absolutely. If you do not mind me saying so, the question is probably less for AISI and possibly more for Alex and me. AISI does not do the sort of policy balance that you are pointing to.

Alexandra Jones

It is testing the frontier models. If you look across the economy, most people are not using frontier models. They are using different models. One of the things that we are trying to do to increase resilience, but also to make sure that we are looking at the opportunities, is to have a diverse set of models and think about how to apply them and what to use them for. We are helping people to trust those models. We have been introducing, as the Minister said yesterday, some more AI assurance around how you make sure that the models are doing the things that you think they should be, and how you can test that and have some tools available. As we deploy it, it is about trying to get that domestic capability, but not at the frontier. In some businesses and in public services, you do not always need the frontier; you need tailored models. It is about trying to get that resilience, making sure we have that AI assurance so that we can trust it and test it in the businesses, while still testing and understanding the frontier models and making sure we have access to them where we need to, which is not going to be across the spectrum. All of that also needs to be done with workers and people, and the opportunities that it creates, in mind.

Sarah Edwards

Is that differential between AI models and frontier models clear in terms of how Ministers are talking about the benefits to the economy, to public services and the like?

Cat Little

Yes, absolutely.

Sarah Edwards

Perhaps you can enlighten us on how they are going to approach that, because we are not quite clear on whether we are going to be taking the upcoming opportunity of the Cyber Security and Resilience Bill to regulate.

Cat Little

There is that very clear distinction. Our experience of adoption so far, particularly in the public sector, is that our real challenge is scaling and adopting to get the benefits of productivity, efficiency and service outcomes for the public, using very openly available AI tools. We have ambitions to use AI right in the frontline of public services just to boost productivity in the way that we know it is capable of. There is brilliant work under way that is nowhere near using some of these frontier models for the work that we do. Part of our job in the public sector, when we are looking at adopting AI, is to know which technological tools are best suited in our value streams for delivering the productivity and service improvements that we are looking for. Frontier models are not necessarily always the best tool for the sorts of service outcomes that we are looking for.

Martin Wrigley

What have you learned about your testing processes after the breach in July? Do you trust your environment?

Henry de Zoete

That is a very good and important question. The thing to be clear on about our incident, which was an incident, is that there was no security breach. It was not like some of the other incidents that we have heard about, where the models have worked out an exploit to get out of their sandbox and to go and do bad things. When we set up our evaluation, we connected the models to the internet. We did that on purpose because we wanted to see what the models’ capabilities would be to go out there. Bad people are going to connect these things to the internet, so there is a very fine line between doing testing in a simulated environment and connecting it to the real world and seeing what is going on. What the model then went and did was definitely bad behaviour. When we became aware of it, we shut it down within an hour, and published a full report on it within a week. I could talk through the things that we have changed. Essentially, we reviewed when we give internet access to the models to make sure that we know when we are doing it. We have made our sandboxes harder anyway, even though there was not a security breach. We have improved our monitorability, creating a synchronous monitor that looks at what the AI is doing. Frankly, the speed and change of the capabilities caught us off guard at that point, because we did not think that the model would have the capabilities to go out and do the kinds of things that it went and did. On reflection, we should not have connected it to the internet, but these things are judgment calls. Previously, we had done that and things had not gone wrong, and we learned lots of important things. It is very important to test in real-life situations in order to see what is happening, but we have improved the simulated environments. The speed of improvement across these models is quite something to behold.

Martin Wrigley

Is there any other environment in which you would try something in a live environment when you did not know how it worked? The way that we are trying to evaluate these models is just so dangerous.

Henry de Zoete

This is a nascent science. Evaluation of these models is very new. It started only in the last two or three years, and we are learning all the time. The kinds of things that we are doing now include creating very detailed cyber-ranges, where we simulate a computer network for a model to attack. This time last year, the models were able to do very simple, narrow cyber tasks of a certain nature. We have now created cyber-ranges that involve 32 steps, covering everything from reconnaissance to exploit identification, lateral movement inside the system, and then data exfiltration. These take a human 20 hours to do. We found in April this year that the models were able to do these autonomously, and now they can all do it. We are having to build more and more difficult cyber-ranges, and doing lots more difficult tasks to get them. We have one that is called the cooling tower. It is a harder task, but it involves the models making things happen in the real world physically. That is also a cyber-range that has now been completed by the models, so we are having to use all our resources and talent to keep building these simulated things in order to keep on top of the speed of the capabilities of the models.

Martin Wrigley

Are you faster than Anthropic, OpenAI and everybody else?

Henry de Zoete

My team is great. We are very lucky. We have 240 staff, with brilliant civil servants and a brilliant technical team who are taking pay cuts to be involved in AISI, because they believe in the mission and want to work with Government on all of this stuff. We now do four times as many tests as we did back in 2024. When we tested a model, it used to be a whole team exercise that would take a month, or even two, to do, and we could run only one model test at a time. We are now able to run multiple tests of models at the same time and get results within days, so we are speeding up as hard as we can.

Martin Wrigley

All of that is laudable, but you are chasing people who are chasing a $2 trillion IPO.

Antonia Bance

AISI has no statutory powers to regulate AI. Given what we have heard this afternoon, can that be right? Would you like statutory powers?

Henry de Zoete

We are a research body.

Cat Little

This comes back to the question of what should be regulated and what we need more powers for. That is ultimately part of the policy work that is under development. If Ministers decide to have more regulation, and if Parliament legislates, the question of who does that is a really important one, but, right now, AISI is not a regulator. It is here to do really valuable work. If you do not mind me saying so, it is doing fantastic work. You have heard today from many people just how important it is to the overall regime globally. We are very lucky to have it.

Chair

It is inevitable, though, is it not, that it is going to need a statutory basis?

Cat Little

That is a matter for Parliament.

Chair

You are going to be the lead architect on the policy framework. You are going to supply the policy advice to the Secretary of State and to the Minister of State.

Cat Little

I repeat what Ministers have said. Ultimately, we are setting out the whole framework. We are looking at a comprehensive package. If Ministers look at that analysis and say, “Yes, we really do need to put in place further regulation,” that is absolutely on the table.

Chair

In your own mind, do you know what you will recommend?

Cat Little

We are doing the work now. By the way, I have not even started to take up office yet in my new role, but—

Chair

I know that you have been thinking about it very hard.

Cat Little

This is very live in terms of the work that we are doing. To assure this Committee, it is comprehensive and very thoughtful analysis that is not just about the UK; it is about how we work in a really collaborative, open way with our counterparts internationally.

Alex Sobel

We do not have our own sovereign AI frontier model. Google DeepMind is based in London but is US-owned. We are seeing and have heard today that we are having more and more powerful frontier models, and there is a relative rather than an absolute view of safety among those developing them. What role can a country such as the UK play in preventing a global race to the bottom in safety standards?

Cat Little

I come back to the very unique strengths that the UK has. We have unique convening power. It is fortunate that we have the G20 presidency next year. That is a really important moment for us to put AI at the heart of the global agenda. We are very fortunate to have AISI. From an economic perspective, we have thousands of AI businesses here. We are underpinned by world-class research and fantastic tech talent, which puts the UK in a good position to convene and to lead this agenda in a respected and trusted way, and that is absolutely our intention.

Henry de Zoete

You might have seen that, yesterday, AISI published its approach on best practices. This was following the Prime Minister’s discussion on standards for safety and security and what could be done. Specifically on your question of preventing a global race on safety standards, we are engaging with industry along these lines, and working with our brilliant partners in Government, such as the National Cyber Security Centre, on what the next step for standards and best practices could be, such as monitoring or preserving oversight over these systems. We have laid out eight areas that we want to get into. I feel quite strongly about monitoring, and I can talk about that if you would like me to. Working with industry, working with brilliant people in Government, and working across Government in this area, the technical capability that we have in this Government to write these standards and best practices is genuinely quite unique in the world. That is what we are going to try to do, with other people’s help.

Alexandra Jones

There are also some examples of sector regulations. The Medicines and Healthcare products Regulatory Authority regulates not AI but medical devices. It is running a sandbox to check whether there are AI-specific questions. It has been accepting recommendations from the National Commission into the Regulation of AI in Healthcare to make sure that we monitor those devices throughout their lives. There are a number of sector-specific sandboxes and regulations coming into play where they are not regulating AI specifically, but regulating within. That is true for the Financial Conduct Authority as well. We are looking across the piece and asking, “Is that enough? Is that effective enough? How is that working?”, but there are a number of sector examples that are useful too.

Alex Sobel

Superintelligent AI poses a different but similar-level existential threat to climate change. The UK legislated on climate change in the Climate Change Act 2008, seven years before the Paris agreement, which is a global agreement. As you say, we have convening power. AISI is the first one to have been established. Would the UK legislating not create momentum towards a global agreement in the same way that the Climate Change Act did?

Cat Little

That is, of course, a matter for Parliament and for Ministers, but that is exactly the sort of work that is under way as we go across all of the things that we have just discussed.

Chair

The clock is against us, so I am sorry that that session was cut slightly short, but we will aim to generate a special report from today’s session in order to help inform Parliament ahead of potential Government amendments to the Cyber Security Bill once it reaches the Commons. A new inquiry on AI safety and security has been launched today by the Committee, which will help us contribute to this debate over the course of the next year. For now, thank you very much indeed for your evidence. Henry, we look forward to coming to visit you sometime soon on a mutually convenient date, but, for now, that is it.