Category: Regulatory | Reading time: 5 min
What Happened
On Tuesday, 13 October 2026, the UK House of Commons Business, Innovation, Science and Trade Committee took oral evidence on AI security from OpenAI, Anthropic, Google DeepMind, Meta, former lab researchers, and senior civil servants including the AI Security Institute (AISI).
Anthropic's head of Europe, Liam Booth-Smith, told MPs the rules should be binding and that voluntary commitments are not enough. OpenAI vice president Tom Duff Gordon backed a statutory framework and an international convention, saying some elements should be mandatory and naming incident reporting as the starting point. "We don't think basing everything on voluntary commitments for frontier risk is a good long-term plan," he said, according to WIRED.
Google DeepMind's Owen Larter, asked whether he supported a statutory framework, said the focus should be on standards. Meta's Rob Sherman pointed MPs to existing UK regulators and said they were "not writing on a blank page."
What Officials Admitted
In the civil-service segment, AISI director Henry de Zoete said the institute depends on company and foreign-government cooperation for access to models. Cabinet Office permanent secretary Cat Little confirmed the current regime is voluntary. De Zoete also said AISI does not "kite mark" models and cannot stop a company from releasing a system the institute judges too dangerous.
Frontier executives made clear that UK pre-deployment access often runs through US arrangements. Duff Gordon said OpenAI provides models pre-deployment to the US CAISI and will continue to provide them to UK AISI as long as US government rules allow it. Booth-Smith told MPs Anthropic had not been able to give UK AISI full unrestricted access to Mythos 5.1 at one point, calling that a question for the US government, and said AISI now had access.
The Committee's Framing
Before the hearing, the committee's invitation letters asked whether firms should self-determine which models need independent safety testing or face legally mandatory pre-release testing, and whether mandatory reporting should cover serious incidents including deceptive behaviour, circumvention of safeguards, unauthorised replication, and signs that human control may be failing. Committee chair Liam Byrne told WIRED after the session that the point was to show wide differences among the labs and that voluntary self-regulation cannot be relied on. He said the committee would examine Britain's path as a middle power on AI, including use of the coming G20 presidency to push an international convention.
The same day, a few hundred metres from the hearing, MI5 director Ken McCallum warned in his annual threat update that AI's potential to change the stakes on existing or new bioweapons was the misuse case to which he would attach greatest weight. Byrne told WIRED that pairing that warning with a Cabinet Office admission that the AI regime is voluntary "tells you everything you need to know."
Why It Matters
For enterprises deploying action-taking agents in or under UK jurisdiction, the hearing puts three facts on the parliamentary record. First, two of the four frontier labs now argue in public that voluntary pledges are not a durable basis for frontier risk, and they put mandatory incident reporting at the front of what should be statutory. Second, the UK's own evaluator has no power to compel access or to block a release. Third, the committee's incident list—safeguard circumvention, deceptive behaviour, unauthorised replication, loss of human control—matches the vocabulary of the summer agent containment failures already described in government statements.
That combination shifts the burden onto deployers who already run agents in production. When reporting becomes mandatory, or when a customer, regulator or counterparty asks what an agent did after a safeguard failed, the answer has to come from records the enterprise controls, not from a lab's voluntary brief or the agent's own account.
The Takeaway
Treat UK mandatory incident reporting as a live procurement and compliance design input, not a distant legislative possibility. Map which agent actions would count as safeguard circumvention or loss of control in your environment, and make sure each of those actions leaves an independently checkable record of what was attempted, what was allowed, and who authorised it.
Source: WIRED: OpenAI and Anthropic Tell British Lawmakers: Regulate Us | Better Regulation: Committee invites Meta, Google, OpenAI and Anthropic