United Kingdom raises the alert due to the behavior of Anthropic and OpenAI's AI after detecting attempts to deceive real people

With the information available from the sources consulted, there is no record that the British Government has announced, following a specific recent report, a new bill or a specific parliamentary timetable to strengthen the oversight of artificial intelligence. What is observed is a progressive strengthening of oversight through existing regulators (data protection, financial supervisor, digital regulators network) and infrastructures such as the AI Safety Institute, mainly using the already existing regulatory framework. Since I specialize in the Spanish context, and information about the United Kingdom is limited, I can only describe these general lines without specifying a precise parliamentary procedure.

1. Context: regulatory strengthening through existing authorities

In the United Kingdom, much of the AI oversight is being articulated through sectoral regulators rather than through a new broad horizontal law:

• Information Commissioner’s Office (ICO): it is the independent regulator for data protection and access to information. In several communications about AI, the ICO insists that the current framework (Data Protection Act 2018 and UK GDPR) already allows it to supervise the development and use of AI systems, including the design phase. See its guides on AI in selection processes, where it reminds the obligations regarding personal data when using AI in recruitment (note on AI in recruitment), and its position on the “myths” of AI regulation, where it emphasizes that it can look “up to the design stage” of systems (myths about data protection in AI).
• The ICO has also demanded more transparency from generative AI developers about the use of data for training, in line with the principles of information and legitimacy of processing (statement on generative AI and transparency).
• Financial Conduct Authority (FCA): in its reaction to the Chancellor's Mansion House speech, the FCA recalls its role as a financial regulator already working on challenges related to AI, algorithms, and crypto, in coordination with other international regulators (FCA statement).
• British Digital Regulators Network (DRCF): in dialogue with BEREC, mechanisms of collaboration between British regulators to address challenges in telecommunications and digital services, including AI, are described (BEREC study trip to the UK).

This strategy points to a “networked” oversight, supported by existing regulators rather than a single AI supervisor created ex novo by law.

2. Role of the AI Safety Institute and international cooperation

Several European documents note that the United Kingdom has created an AI Safety Institute that cooperates with other supervisors to evaluate frontier models before their public deployment. The algorithmic risk report from the Dutch data protection authority mentions joint evaluations by the UK AI Safety Institute and its US counterpart on advanced models (Dutch report summer 2024; ARR report February 2025).

However, these sources do not detail specific British parliamentary procedures linked to these works (for example, a bill to grant additional powers to the institute), but rather a practical evolution of the technical supervision of models.

3. Debate on copyright and possible legislative changes

In the field of intellectual property, a critical analysis of the British Government's proposals warns that London is studying a reform to allow certain uses of protected works in AI model training, arguing to “provide legal certainty” to creative sectors. That text points out that the Executive has already tried twice to push through changes and remains interested in approving this legislation, although it does not specify the exact parliamentary status (analysis on UK proposals and copyright).

From this perspective, the British Government does seem to consider regulatory adjustments regarding copyright and transparency of training data, but the sources consulted do not allow identifying whether there is already a registered bill, specific amendments, or a formal “AI Bill” in process.

4. What is missing in the sources: the “report” you refer to

The consulted databases do not clearly identify the specific “report” you mention (for example, from a select committee of the House of Commons or an independent British AI commission) nor the corresponding “Government response” with precise legislative commitments. Reports from other countries or the EU on algorithmic risks and prohibited practices are found (ANACOM note, entry into force of the European AI law, approval of the European law, annual report of the European Commission, guidelines on the AI Act), but not an equivalent document clearly linked to a British parliamentary response.

In parallel, Spain does have a much more defined regulatory response following the European AI Regulation: draft bill, consultations, sandbox, and finally a governance and sanctions AI bill, as explained by the Ministry and other notes (Spanish bill on human oversight, Spanish AI sandbox, analysis of the Spanish draft bill, Spanish AI law, AI sandbox in Spain, guide on transparency by AESIA, European public consultations).

5. Limitations and specialization

Since my specialty is policy and regulation in Spain, and the sources handled do not record a clear commitment from the British Government to bring a specific bill to Parliament following that report, I can only conclude that, to date, AI oversight in the United Kingdom is being strengthened mainly via regulators (ICO, FCA, DRCF, AI Safety Institute) and international cooperation, with no record in these sources of a new detailed legislative initiative in parliamentary process equivalent to the Spanish or European one.

With the information available from the sources consulted, the United Kingdom's AI Safety Institute (AISI) appears as a government body specialized in the technical evaluation and identification of risks of the most advanced AI models, with a strong component of international cooperation. However, none of the analyzed sources reproduce the text of the British law establishing the AISI nor an official and exhaustive list of its statutory powers. Therefore, its function can only be described based on indirect references and documents from other regulators that mention its role.

General basis and nature of the AISI

The AISI is described in documentation from European supervisors as an AI safety institute created by the UK Government, focused on frontier models and systemic risks. The Algorithmic and AI Risk Report (Summer 2024) from the Dutch data protection authority (AP) indicates that “in the United Kingdom and the United States an AI Safety Institute has been created” and functionally equates it to the European AI Office, emphasizing that its main objective is to expose the dangers of large language models by testing and evaluating them in different ways.

These sources do not cite a specific British law (Act of Parliament) or regulatory instrument detailing its mandate, so it cannot be legally specified whether it is a purely administrative executive body or has its own statutory framework. It is inferred that it acts as the Government's technical arm in AI safety, in coordination with other sectoral regulators (for example, the data authority ICO, described in this ICO blog).

Identified operational functions

Indirectly, several sources allow outlining the main functions of the AISI, although without a legal “numerus clausus” rank:

• Technical evaluation of advanced models: the Dutch AP highlights that a key objective of AI safety institutes is to test and evaluate large language models before their public deployment, precisely to “expose their dangers.” This “pre-market testing” function is mentioned again in the AI Risk Report (Winter 2024/2025), which cites as an example a joint pre-implementation evaluation carried out by the UK AI Safety Institute (UK AISI) and its US counterpart on the Operai O1 model.
• Identification of systemic risks: alongside the European Union AI Office — described by the Commission in this note — AI safety institutes are attributed a role in detecting high-impact risks in very capable models (e.g., malicious uses, cybersecurity, information manipulation, or impact on fundamental rights).
• Testing and “stress-testing” of systems: Dutch documentation highlights that tests can be conducted even before models are publicly available, suggesting that the UK AISI operates as an independent testing laboratory against developers, with the capacity to design test batteries, adversarial scenarios, and “red-teaming” exercises.
• International cooperation and regulatory coordination: the “International Network of AI Safety Institutes” was launched in 2024 in San Francisco with UK participation, according to the Spanish Administration in this note. The network's mission statement speaks of promoting safety, research, testing, and guidance on AI, which also reflects the AISI's functional mandate as a global cooperation node.
• Support to other regulators and policymakers: the Bank of Spain and other European actors, in speeches and analyses (for example, the BdE governor when talking about “AI safety institutes”), describe these institutes as technical interlocutors for central banks, data authorities, or market regulators, who can turn to them for advanced model testing or to share best practices in risk assessment.

Relationship with other regulatory frameworks

The AISI does not appear as a full sectoral regulator (that function remains, for example, with the ICO in data protection or the FCA in financial services, as inferred from notes such as the FCA's on live AI testing services: FCA note). Rather, it acts as a common technical evaluation infrastructure that other regulators can leverage within their own competencies.

In the European context, reports such as the 2024 AI Safety Report position the UK AISI as a comparative reference on how to articulate, at the state level, an expert center for testing and risk analysis aligned with frameworks like the European AI Act, described in this news.

Limitations of available information

The sources consulted are mainly documents from European and national authorities (Dutch AP, European Commission, Spanish administrations) and communications from other British regulators such as the ICO. None reproduce the founding text of the AI Safety Institute nor its internal “framework document.” Therefore, it is not possible to precisely enumerate all its powers and functions according to current British legislation; only general lines can be inferred: evaluation of advanced models, risk identification, pre-deployment testing, technical advice, and international cooperation.

Since it is a UK body and my main specialization is the Spanish and European regulatory context, no more detailed or directly legislative information about the AISI is available beyond what these documents reflect.

Today there is no single closed global standard to evaluate and control advanced artificial intelligence models, but rather an ecosystem of converging norms and frameworks. In Europe, the core is the AI Regulation (AI Act), which combines mandatory legal requirements, conformity assessment procedures, and ongoing technical guides and codes of conduct. In parallel, specific ISO/IEC standards (AI governance, data quality) and audit frameworks promoted by data protection authorities and sectoral bodies are consolidating. Regarding NIST, OECD, ITU, and IEEE, the sources consulted do not provide concrete details of standards, although it is emphasized that complementary global technical frameworks will be needed.

1. European AI Regulation and conformity assessment

The European Artificial Intelligence Regulation (AI Act) is today the basic pillar for high-impact systems in the EU. According to the note on its entry into force from the Spanish Electronic Administration Portal, the regulation classifies systems by risk (limited, high, and prohibited) and establishes, for high-risk systems, strict requirements of:

• Risk management, data quality, activity logging, and detailed documentation.
• Clear user information and human oversight.
• Robustness, accuracy, and cybersecurity, with market access conditioned on passing a conformity assessment before notified bodies.

This is reflected both in the piece “Governing data to govern artificial intelligence” from the Ministry (governing data) and in notes about the Council's final approval (global AI rules) and the law's entry into force (entry into force, and the Commission note).

For general purpose models (GPAI/LLM), the AI Act introduces specific transparency and systemic risk management obligations, with centralized oversight at the European AI Office. A draft Code of Good Practices for these models, promoted by the European Commission, develops risk taxonomies, evaluation methodologies, and mitigation measures for advanced model providers (GPAI good practices code). The AI Office itself is gathering evaluators to align methodologies on general purpose models (model workshops).

2. ISO/IEC standards and technical standardization

In parallel to the AI Act, ISO/IEC standards are being deployed that serve as a basis for audits and certifications. The newspaper Demócrata reports the case of Iberdrola, the first Spanish multinational to certify its corporate use of generative AI under ISO/IEC 42001, a global AI management systems standard that reviews transparency, process traceability, data protection, and responsible governance (Iberdrola certification).

Additionally, the BOE has ratified as Spanish standards several parts of the ISO/IEC 5259 series on data quality for machine learning — including part 3 on requirements and guidelines for data quality management — as recorded in the July 2025 European standards resolution (BOE resolution). These standards are key to homogeneously evaluating the quality of training, validation, and test datasets required by the AI Act.

From an operational perspective, Demócrata emphasizes that only an approach “based on implementable standards, integrable into governance, risk, and compliance tools” will allow real compliance in critical sectors such as health, transport, or finance (the operational challenge of AI).

3. Technical guides, sandboxes, and audit frameworks

Spain is using regulatory sandboxes as a laboratory to implement these standards. The Government has completed the first EU AI sandbox, coordinated with the Commission and linked to the AI Act, which has generated technical guides to facilitate compliance of high-risk systems while definitive standards are approved (AI sandbox).

Other European data authorities are also promoting audit methodologies. The Dutch algorithmic risk report proposes that public AI systems with impact — from simple algorithms to complex models — be audited by professionals following clear criteria and standardized frameworks (Dutch risk report). The European Data Protection Board, in its 2024 annual report, mentions specific projects on risk assessment and robust AI audit methodologies (EDPB report).

In the Ibero-American sphere, the Ibero-American Data Protection Network has updated its Standards, expressly reinforcing traceability, effective human oversight, continuous risk assessment, and periodic auditing of automated systems and AI (Ibero-American standards).

4. Global trends: frontier models and continuous oversight

From the Demócrata Digital Observatory, a clear trend is highlighted: moving from a model focused only on prior certifications to one based on continuous supervision, especially for so-called “frontier models.” Recent reports call for an international body to subject these systems to independent testing before deployment, focusing on dangerous capabilities (offensive cybersecurity, biological weapons, autonomous action) and with the power to delay or prevent launches if tests are not passed (race to control AI).

In summary, the “hard core” of standards today is formed by the AI Act and its conformity assessment procedures, ISO/IEC standards (42001, 5259-x, and others to be ratified), the European AI Office's codes of good practice, and audit methodologies developed by data authorities and regional networks. Regarding NIST, OECD, ITU, and IEEE, no detailed information is available in the sources consulted, but all indications are that their technical frameworks will be a necessary complement to this European regulatory edifice.