A rule about “loss of control” only works if someone held control to begin with. The UK government’s factsheet on agentic AI resilience measures for the Cyber Security and Resilience (Network and Information Systems) Bill is built on that assumption. It says the measures are intended to cover incidents where operators are unable to adequately monitor or control AI agents. An inspector appointed under future regulations would ask an early question: who held the authority to stop that agent?
That question has a reliable answer only if the record exists before the incident, because an account assembled afterward is weaker evidence.
What the government tabled, and what still waits
The House of Lords held report stage on October 26 and completed third reading on November 2, 2026. The bill now returns to the House of Commons for consideration of Lords amendments. For report stage, the government tabled a new clause titled “Functions of the Secretary of State: loss of control of artificial intelligence agent.” The clause would let regulations confer functions on the Secretary of State where a security or operational compromise of a relevant network and information system “is or may be attributable to loss of oversight or control of an AI agent,” or where there is a risk of one.
The clause leaves the key terms to later regulations. Both “AI agent” and “loss of oversight or control” would have “the meaning given by regulations made by the Secretary of State.” The powers those regulations could confer are broad. A regulated person could face inspectors appointed by the Secretary of State, entry and search of its premises, seizure of documents, requirements to obtain, generate, collect, or retain documents or information, tests or interviews, and sanctions including financial penalties.
No agent-specific duty is in force today. The factsheet says all of the agentic measures will be brought into force through secondary legislation after Royal Assent, and that using the power requires consultation and the affirmative procedure in Parliament. It also limits its own reach. The government will work with industry and oversight authorities on the detailed scope, including definitions of “loss of control,” and the measures “are not intended to establish a comprehensive framework for AI governance or to tackle general AI harms.”
That gives regulated entities a working window. Existing reporting duties still apply, and the evidence an inspector would want is far easier to build before an incident than after one.
Four intended measures, four records
The factsheet lists four measures the government intends to introduce after consultation. Each one depends on a record that someone has to keep.
- Security and resilience requirements. The requirements would be technical and organizational, with monitoring of agents’ actions and agent risk assessments as the factsheet’s examples. A risk assessment needs a list of agents and what each is permitted to do. Monitoring needs a named person who receives the flag.
- Affected-party notification. Entities that report an incident caused by AI agents may have to tell other organizations those agents affected. An operator can notify only the parties it can identify, which means knowing what each agent could reach.
- Evidence preservation. Entities that report an incident would preserve the information they hold about how AI agents could have caused it. The factsheet’s examples are actions taken by agents and operator attempts to control them. The second example covers the human side, and a useful record of those attempts shows who tried to stop the agent, when, and with what result.
- Post-incident review powers for Ministers. Ministers could task government technical experts to review incidents, request information, and conduct tests, then share lessons with regulated entities.
The factsheet’s hypothetical example shows the sequence. A monitoring system flags that an agentic system is taking actions outside the areas it has permission to access. The operator’s initial attempts to control the system fail. The operator reports the incident, and government experts assess the record it kept of the agents’ actions and the logic they followed. Each step in that example implies the operator knew what the agent was permitted to do and who was supposed to act on the flag.
Where Responsible AI ends and AI Governance begins
In Basil C. Puglisi’s terms, Responsible AI means a machine checking a machine, with no human review. A monitoring tool that flags an agent acting outside its permissions does that work. It produces a signal, and nobody has decided anything yet.
AI Governance starts at the point where a named person takes that signal and rules on it, with accept, modify, or reject as the options. That is a checkpoint under Checkpoint-Based Governance, where the person who rules has binding authority. A flag with no owner is a log entry. A flag that reaches a named person, who records a decision and its time, documents oversight, and the operator still has to test that the person can actually stop the agent.
This is where the coming definition of loss of control will be tested. If an operator cannot show who held stop authority, an inspector would have little basis to tell an agent that escaped control from an agent nobody was ever assigned to control. The second case is a governance gap that existed before the agent did anything.
Basil C. Puglisi has published two HAIA designs that address this record. HAIA-CARCS (Compliance Accountability Record and Case Study) is a structured documentation protocol that converts the raw evidence of an AI work session into a portable record that an internal reviewer or an outside auditor can read. It captures what happened, who decided, what the evidence was, and what comes next, and each decision closes on accept, modify, or reject. A CARCS record could support an operator’s answer to an inspector, alongside the control register below, though it can’t by itself prove that control worked. HAIA-Overwatch is a monitoring design that watches a pipeline from a separate trust boundary and escalates to a human governance authority when it detects a discrepancy. Its code is built and has never been deployed. The structural point carries over to any regulated operator: the monitor sits outside the agent’s own authority, and its output ends with a human decision.
What regulated entities can do before the consultation
The scope is still open, so these steps prepare for rules that don’t yet exist. Regulated persons that run agents, which UK Parliament describes as operators of essential services, digital service providers, managed service providers, and critical suppliers, can start now. Each should also confirm whether its activities fall within the bill’s scope.
- Build an agent control register. One row per agent: the agent, its permitted actions, the named holder of stop authority, and a named backup. The accountable executive signs the register and re-signs it each quarter and after any change in agent permissions.
- Preserve a decision log. For every monitoring flag, record the time of the flag, the person who received it, the decision (accept, modify, or reject), the reason, and any attempt to stop or restrict the agent. Store it where the agent cannot write to it.
- Keep control attempts as evidence. Log each stop or restrict command, whether it worked, and who issued it. The factsheet lists operator attempts to control agents among its examples of information an entity may be asked to preserve.
- Measure it. Track the share of agents with a named control holder and a named backup, with every agent as the target. Track the time from monitoring flag to recorded human decision, as a median and a worst case, against a threshold the risk owner sets.
- Test the register. Each quarter, a person outside the team that runs the agents should confirm that each named holder can actually reach and stop the agent.
The consultation will set the definition of loss of control, and that definition will decide which of these records an inspector can ask for. Operators that test their control holders and decision logs now will know before then whether those records hold up.
Sources
- Department for Digital, Culture, Media and Sport, & Department for Science, Innovation and Technology. (2026, November 3). Agentic AI resilience measures [Policy paper]. GOV.UK. https://www.gov.uk/government/publications/cyber-security-and-resilience-network-and-information-systems-bill-factsheets/agentic-ai-resilience-measures
- House of Lords. (2026, October 21). Cyber Security and Resilience (Network and Information Systems) Bill: Running list of all amendments on report. UK Parliament. https://bills.parliament.uk/publications/68247/documents/8952
- UK Parliament. (2026, November 3). Lords completes examination of Cyber Security and Resilience Bill. https://www.parliament.uk/business/news/2026/october-2026/cyber-security-and-resilience-bill-lords-third-reading/
- Puglisi, B. C. (2026). HAIA-CARCS: Compliance accountability record and case study. https://basilpuglisi.com/haia-carcs-compliance-accountability-record-case-study/
- Puglisi, B. C. (2026). Overwatch: The cognitive monitoring shield for GOPEL. https://basilpuglisi.com/overwatch-cognitive-monitoring-shield-gopel/
FAQ
Does the UK agentic AI loss-of-control power apply to my organization today?
No. The GOV.UK factsheet says the government will consult first and that any measures will be brought into force through secondary legislation after Royal Assent, under the affirmative procedure. The bill itself is still in Parliament, and UK Parliament says it has returned to the House of Commons for consideration of Lords amendments.
What would the new clause let the government do?
The clause the government tabled would let regulations give the Secretary of State functions where a compromise of a regulated system is or may be attributable to loss of oversight or control of an AI agent. Those functions can include inspectors, entry and search of premises, requirements to keep documents or information, tests and interviews, and financial penalties.
What counts as loss of control?
The bill leaves that to regulations, and the factsheet says the government will develop the definition with industry and oversight authorities. Its stated intention is to cover incidents where operators are unable to adequately monitor or control AI agents.
What are the four intended measures?
The factsheet lists security and resilience requirements, affected-party notification, evidence preservation, and post-incident review powers for Ministers. Each is subject to consultation before any regulations are made.
How do Responsible AI and AI Governance differ here?
In Basil C. Puglisi’s terms, Responsible AI means a machine checking a machine, with no human review, such as a monitor that flags an agent acting outside its permissions. AI Governance adds the named human who receives the flag and records an accept, modify, or reject decision. The first produces the signal, and the second produces the accountability.
What should an operator prepare now?
Keep an agent control register listing each agent, its permitted actions, a named stop-authority holder, and a backup. Preserve a decision log of every monitoring flag and the human decision on it. Track the share of agents with a named control holder and the time from flag to recorded human decision.
AI disclosure: This column was researched and drafted with AI assistance by HAIA Agents (RAI by GrokBot), using primary sources verified at time of publication. #AIgenerated
Leave a Reply