The UK’s ability to maximise the benefits of AI depends on its ability to manage the risks. As models become more capable, can testing, safeguards and public oversight keep pace? Who can intervene when a model is unsafe, and who is accountable when things go wrong?
This long-term thematic inquiry will examine how the UK can support AI adoption while protecting the public and national security. It will investigate whether government, independent testers and safety bodies have the access, expertise and powers they need to identify dangerous capabilities and prevent harm. It will examine the responsibilities of AI companies and whether voluntary commitments provide sufficient protection or mandatory rules are needed.
Topics for scrutiny may include, but are not limited to:
- Definitions of AI, the role of government and the scope of necessary regulation.
- Responsible adoption, public confidence and economic opportunity: building on the Committee’s previous work, how effective governance can support business adoption, investment, productivity and innovation; protect consumers and workers; and ensure that the benefits of AI are broadly shared rather than restricted to the largest firms and best-resourced users.
- Safeguards, autonomy and control: evidence of models past and future deceiving users or evaluators, evading safeguards, acting beyond authorised instructions or pursuing unsafe routes to complete a task; the risks such behaviour may create for individuals, groups and society; and whether developers have built fences strong enough to keep increasingly capable systems within safe and authorised limits.
- Dangerous capabilities, security and resilience: risks to national security, cyber security, biosecurity and critical infrastructure; the potential for AI systems to facilitate fraud, cybercrime or other harmful activity; the potential for cyberthreats to be magnified by the advent of quantum; preparedness for serious AI incidents; and the implications of releasing model weights that can be copied, modified or stripped of safeguards.
- Testing and independent assurance: whether safety testing begins early enough in the development cycle to identify risks and secure changes before deployment; whether evaluators have sufficient access to models, training processes, tools and deployment environments; whether assessments are genuinely independent of developers; and whether findings can be reported without interference.
- Deployment, release decisions and incident reporting: what evidence informs decisions to release, scale or withdraw models and capabilities; who has, or should have, the power to delay release, restrict deployment or require remediation; whether safety assessments remain valid as models and their use change; and whether serious incidents, near misses, dangerous capabilities and safeguard failures should be reported on a mandatory basis, to whom and with what public disclosure.
- Liability, responsibility and redress: whether responsibility for harm caused by AI systems is clear between developers, deployers and users; whether standard consumer and business contracts provide meaningful remedies when safeguards fail; whether financial caps and exclusions leave consumers and small businesses carrying losses they cannot reasonably control; and whether the law requires clarification or reform.
- Voluntary commitments and enforceable duties: whether industry commitments and self-regulation provide adequate protection; where statutory duties, standards or powers may be needed; and how regulation can support responsible innovation while ensuring that developers and deployers are held accountable when systems fail.
- The role and powers of the AI Security Institute: whether AISI has the remit, independence, resources, technical capability and access needed to assess frontier models; whether it should have a statutory basis or stronger powers; and how responsibility for investigation, intervention, enforcement and democratic accountability should be divided between AISI, government and sector regulators.
- International access, rules and cooperation: how overseas policies and restrictions on sharing advanced models affect UK testing and oversight; what domestic powers are needed where developers refuse meaningful access; how the UK can work with allies to develop common standards on testing, incident reporting, dangerous capabilities and access for independent evaluators; and how the UK can crystallise a series of principles as part of its G20 presidency, and coordinate it with the Republic of Korea for delivery and implementation during the 2028 presidency and beyond.
This inquiry will remain open as individual pieces of work conclude, allowing the Committee to respond to developments and return to unresolved questions. The Committee will use a range of scrutiny tools – targeted evidence sessions, correspondence, visits, engagement and focused reports – depending on the particular issue and the impact sought. It will time interventions to inform decisions by government, regulators and industry, and test their accounts against independent evidence and the experience of those affected.
The Committee will track recommendations and commitments, revisit unanswered questions and assess changes in policy, regulation and business practice. Rather than a single call for written evidence launched immediately, individual targeted calls for evidence will set out specific questions and submission arrangements for particular strands of work.
The Committee has already undertaken an inquiry into Artificial Intelligence, business and the future of the workforce, on which it will report in due course. The new thematic inquiry will provide continuing scrutiny of AI safety, security, governance and adoption, including follow-up of that report’s recommendations.