Summary
- The Business, Innovation, Science and Trade Committee has opened an ongoing AI governance inquiry.
- Its scrutiny covers model safety testing, incident reporting and company decision-making.
- The committee will use targeted evidence sessions and reports rather than a single immediate call for submissions.
MPs have opened a long-term parliamentary inquiry into artificial intelligence safety, security, and governance, with the Business, Innovation, Science and Trade Committee planning continuing scrutiny of how developers test powerful models and account for incidents.
The committee announced the new work on 14 October following an evidence session involving former employees of AI companies, representatives from OpenAI, Anthropic, Meta, and Google DeepMind, officials from the UK’s AI Security Institute, and government representatives. Its programme is designed to revisit unresolved questions as models, deployments, and policy proposals change.
The inquiry will examine corporate processes for safety evaluation and incident reporting and assess the new protections proposed under the Cyber Security and Resilience Bill regime. This does not mean that the committee has already recommended particular statutory duties or that the legislation automatically applies to every frontier model developer.
Parliamentary select committees take evidence, challenge witnesses, and make recommendations. They cannot enact binding rules by themselves. The inquiry’s findings may influence ministers and regulators, but any change to statutory obligations will depend on subsequent policy and legislative decisions.
That distinction matters in a sector where voluntary evaluations and private agreements with laboratories coexist with existing obligations affecting data protection, security, and consumer services. A model that passes a supplier’s own test may still create operational risk when connected to tools, accounts, and third-party services in a customer’s environment.
The committee intends to examine how responsibility should be allocated when increasingly capable systems operate across organisational boundaries. A provider controls model development and access conditions, while a deploying organisation may determine instructions, available data, and the actions an AI agent can take. Those responsibilities are not interchangeable, particularly when an incident involves a combination of model behaviour and weak enterprise permissions.
Former employees’ warnings formed part of the opening hearing, but the existence of testimony does not independently confirm every risk scenario presented to MPs. Current company representatives and public officials also gave evidence. The process will need to distinguish demonstrated incidents, laboratory evaluations, commercial claims, and longer-term forecasts.
Chair Liam Byrne described the inquiry as an effort to map risks and develop rules appropriate to the UK’s wider work on AI governance. The committee’s statement refers to the UK’s forthcoming G20 presidency and the international dimension of technology oversight. Such ambitions remain part of the political programme rather than an agreed international standard.
Instead of opening one permanent general call for written submissions, MPs plan targeted sessions, correspondence, visits, and focused reports. They also intend to monitor undertakings made by companies and government bodies, returning to unanswered questions when further evidence becomes available.
The evidence-gathering model may make corporate commitments more testable over time. A company can describe evaluation procedures or publish a voluntary safety framework at one hearing, then face later questions about an incident, a changed model capability, or whether a promise has been implemented. That ongoing scrutiny differs from an inquiry which concludes with one report and no follow-up. It also requires public accounts to be assessed against confidential model information that parliamentary witnesses may be unable to disclose in full. How much technical evidence MPs can obtain, and how consistently they compare rival providers’ claims, remains an open question for the committee’s work programme.
The committee says the inquiry will remain open as individual strands conclude, giving it scope to return to earlier evidence rather than treating every session as a one-off hearing. This continuing model also leaves the timing and scope of future submissions uncertain. Organisations preparing material for MPs will need to respond to the particular questions issued for each strand, while the eventual balance between industry-led standards and binding requirements has yet to be determined by government.
The new work follows other UK activity concerning AI-assisted cyber defence and security assessment, but it addresses the governance framework rather than announcing a deployment or product. The committee has not published a final report, timetable for recommendations, or set of agreed regulatory changes. Its first evidence sessions establish the questions that subsequent scrutiny will test.
