UK lawmakers declare AI a national security threat; no bill

The practical contradiction is the point. By the end of 2025, UK ministers, security officials, peers, MPs, devolved representatives, campaign groups, and commissioned researchers were all treating advanced AI as a live national-security issue. A lawyer asking which UK rule governs AI-assisted drafting, disclosure review, client advice, or firm procurement still could not point to an enacted AI Act, an AI-specific professional safe harbor, or a new statutory checklist for legal practice.

That does not make the 2025 cascade trivial. It makes it awkward. For legal risk purposes, “lawmakers warned,” “government announced,” “campaign demanded,” and “Parliament enacted” are different verbs with different consequences. The UK moved far enough to create a serious regulatory signal, but not far enough to replace the ordinary duties that already sit on lawyers: competence, confidentiality, supervision, client communication, verification, and professional judgment.

The 2025 Shift Began With Security Language, Not Drafting Instructions

The baseline was already there. The UK’s 2023 National Risk Register had classified AI as a chronic risk, but that is not the same as saying Parliament had created operational legal duties for lawyers using AI tools. The sharper change in 2025 was vocabulary and institutional placement: AI moved from broad risk management into security, criminal misuse, and state capability.

On February 14, 2025, the UK government renamed the AI Safety Institute as the AI Security Institute. The GOV.UK announcement said the institute would focus on “serious AI risks with security implications,” including chemical and biological weapons, cyber-attacks, and AI-generated child sexual abuse material. It also announced a new criminal misuse team in partnership with the Home Office.[1]

That renaming matters because operational-security language changes the compliance temperature. It does not tell a solicitor how to document a hallucination check or whether a particular vendor clause is adequate. It does, however, signal that the government is no longer speaking only in the soft language of innovation governance. The risks being named are criminal, strategic, and security-facing.

The next step came through the National Security Strategy 2025, published on June 24. Bird & Bird’s analysis described the strategy as placing AI across three pillars: Security at Home, Strength Abroad, and Sovereign Capabilities. On that account, AI was no longer treated only as a technology-sector matter; it was embedded as a cross-cutting national-security priority.[2]

A firm policy committee would still need to be careful with that source. Bird & Bird is a law firm analysis, not the statute book. But the point it tracks is relevant: national-security strategy can alter official posture without creating a direct rule for a lawyer’s AI query, model choice, client notice, or court filing.

MI5 Put Autonomous AI Into the Security Frame

On October 16, 2025, MI5 Director General Sir Ken McCallum gave the warning that made the national-security framing harder to dismiss as ordinary tech-policy anxiety. The House of Lords Library later recorded his reference to “potential future risks from non-human, autonomous AI systems which may evade human oversight and control,” and his warning that “AI may never mean us harm. But it would be reckless to ignore the potential for it to cause harm.”[3]

For legal practitioners, the important feature is not the science-fiction edge of the phrase “autonomous AI.” It is the source and setting. A domestic security service warning is not a practice direction, but it is a materially different signal from a consultation blog post or vendor ethics pledge. It tells risk teams that AI misuse, loss of control, and security exposure are being discussed at the level of state protection.

That matters for firm governance even before legislation arrives. A partner approving an AI research tool, a GC reviewing data-transfer terms, or a knowledge lawyer updating internal guidance does not need to prove that MI5 created a legal duty. The narrower and safer point is that national-security framing strengthens the case for documented procurement, access controls, output verification, and escalation pathways under existing professional and risk-management duties.

December Produced the Clearest “Lawmakers Declare” Moment

The event closest to the phrase “UK lawmakers declare AI a national security threat” arrived on December 8, 2025. More than 100 elected representatives across all four UK legislatures joined the Control AI statement calling for regulation of the most powerful AI systems. The signatories included MPs, peers, and members from Scotland, Wales, and Northern Ireland.[4][5]

Procedurally, that was not an Act, a statutory instrument, a select committee finding, or an official resolution of either House. It was a cross-party campaign statement. Substantively, it still deserves attention because of its breadth and the language used by senior political figures.

Former defence secretary Des Browne, a Labour peer, described superintelligent AI as “the most perilous technological development since we gained the ability to wage nuclear war.” Former AI minister Jonathan Berry, a Conservative, called for binding regulation with “tripwires” that would trigger mandatory safety testing. Former environment minister Zac Goldsmith, a Conservative peer, said governments were “miles behind the AI companies” and that there was “virtually no regulation.” Bishop Steven Croft called for an independent AI watchdog.[4][5]

The “tripwires” proposal is particularly relevant because it sounds like a threshold mechanism rather than a general ethical aspiration. In plain terms, the proposal would not leave powerful developers to decide entirely for themselves when safety testing becomes mandatory. It would require binding triggers. But the December materials were advocacy for such a regime, not evidence that the regime had already been enacted.

The Control AI materials also relied on public-safety pressure. YouGov polling cited by the campaign found that 87% of the British public wanted AI developers to prove safety before release. Andrea Miotti, Control AI’s CEO, alleged that AI companies were “lobbying governments to stall regulation.”[4]

Those details should not be flattened into a claim that public opinion had created a legal rule or that lobbying allegations had been adjudicated. The poll measures expressed public preference. The lobbying statement is a campaign claim reported in the context of an advocacy push. Both add political pressure; neither supplies the missing statutory hook for a legal-practice policy.

The Missing Bill Is the Legal Point

The UK did not lack warnings, proposals, or institutional concern in 2025. It lacked enactment. That distinction is what determines whether a firm can update its policy by citing a new AI statute, or must instead explain why existing professional obligations continue to do the work.

The legislative trail was already uneven. The King’s Speech in 2024 had promised an AI Bill, and Lord Holmes of Richmond introduced a Private Members’ Bill in March 2025 that defined AI. That Bill did not proceed beyond first reading.[6]

By July 21, 2025, the government position was still consultation rather than timetable. In a Lords debate recorded in Hansard, Lord Vallance confirmed that the government would run a consultation on AI legislation, but he did not provide a date for legislation.[7]

That is not a minor drafting delay for compliance purposes. A consultation may foreshadow duties, but it does not itself tell a litigation team whether an AI-generated chronology needs a prescribed disclosure label, whether a legal research model must meet a UK statutory certification standard, or whether an internal-use tool falls under a new developer or deployer obligation. Without the Bill, those questions remain routed through existing law, professional conduct, contract, confidentiality, data protection, privilege, and court-facing duties.

The House of Lords Library’s January 2026 briefing later confirmed the continuing gap. It recorded that Secretary of State Liz Kendall had declined to commit to an “AI bill,” preferring to focus on “specific areas where we may need to act.” The same briefing noted a government-commissioned RAND Europe study, published in July 2025, recommending mandatory reporting mechanisms, disclosure channels, and whistleblower safeguards for AI companies.[3]

The RAND Europe recommendations are useful for understanding what a future regime might contain. They are not a substitute for one. A mandatory reporting mechanism proposed in a study is not the same thing as a mandatory reporting obligation imposed by Parliament.

The government’s public line sharpened the mismatch. The Guardian reported the Department for Science, Innovation and Technology position that “AI is already regulated in the UK” through existing frameworks, even as campaigners pressed for AI-specific legislation.[4]

There is a legally coherent version of that position. Many AI uses already touch data protection, equality law, consumer protection, product safety, employment law, financial regulation, cybersecurity, confidentiality, and professional conduct. But for a lawyer using AI in practice, that is not the same as a statutory safe harbor. Existing regimes impose duties by subject matter and context. They do not answer every AI-specific practice question in one place.

Public Support Raised Pressure, Not Enforceable Duties

Public opinion evidence in 2025 reinforced the political case for legislation. The Ada Lovelace Institute reported that 72% of the UK public would feel more comfortable with AI if it were regulated, and it proposed five tests for an effective AI Bill that would affect sectors including legal and professional services.[8]

That finding is worth using carefully. It shows public comfort with regulation, not measured effectiveness of a specific rule. It supports the proposition that ministers faced pressure to legislate. It does not prove that any particular AI control would reduce litigation risk, prevent professional misconduct, or satisfy a court if a lawyer filed unverified AI-generated material.

What This Meant for Legal Practice in 2025

For UK-facing legal practitioners, the consequence is narrower than the public debate but more immediate. The 2025 national-security cascade did not create a new AI-specific professional rule. It did not give lawyers a statutory safe harbor for using generative AI. It did not displace the need to verify outputs, protect confidential information, supervise delegated work, understand the limits of a tool, and comply with court and client obligations.

A sensible 2025 file note or procurement memo therefore could cite the AISI security remit, the National Security Strategy, the MI5 warning, the Control AI campaign, and the stalled legislative process as risk context. It should not cite them as if they were the operative rule. The operative analysis still had to start with existing professional conduct materials and the particular use case: client data in the tool, human review, privilege risk, accuracy controls, vendor terms, jurisdictional exposure, and who signs the final work product.

The answer also differs by question. If the question is whether UK lawmakers and security institutions treated AI as a national-security threat in 2025, the answer is yes, with the December Control AI statement as the clearest lawmaker-led pressure point. If the question is whether Parliament enacted binding AI regulation for legal practitioners in 2025, the answer is no.

That leaves the uncomfortable middle ground: serious enough to document, not settled enough to rely on. Law firms and in-house teams had to brief partners on an escalating national-security posture while still telling them that no UK AI statute had arrived to replace professional judgment.

The Prequel to the Current UK AI Obligations Tracker

As of the end of 2025, the legal-practice position was still the gap itself: AI had been pulled into UK national-security policy, but no binding AI-specific UK statute had arrived for lawyers to use as their compliance anchor. For the post-July 2026 position, including how UK AI policy moved after the department restructuring and which existing regimes now matter in practice, see What UK AI Regulation Applies After the Tech Department Breakup?.

References

1. Tackling AI security risks to unleash growth and deliver Plan for Change — GOV.UK
2. UK government releases the National Security Strategy 2025 — Bird & Bird, 2025
3. Potential future risks from autonomous AI systems — House of Lords Library
4. Scores of UK parliamentarians join call to regulate most powerful AI systems — The Guardian, December 8, 2025
5. Parliamentarians call for AI regulation — CARE, December 2025
6. EU & UK AI Round-up – July 2025 — King & Spalding, July 2025
7. Artificial Intelligence: Legislation — Hansard, July 21, 2025
8. Will the UK AI Bill protect people and society? — Ada Lovelace Institute