Story
Nov 5, 2026
Britain’s AI cyber warning is clear: compliance will not be enough
Britain’s cyber authorities see AI as an accelerating threat to essential services, while industry voices argue that the country’s response cannot stop at regulation. Both sides agree the danger is moving faster than conventional compliance programmes.
Britain’s cyber warning has sharpened into a timetable: officials believe artificial intelligence could help bring attacks against critical infrastructure into the mainstream by 2028.
The immediate concern is not simply more phishing emails or noisier scams, but AI being used by criminal groups and hostile states against systems the country relies on. Britain’s cyber chief said the UK would likely face AI-enabled attacks on critical infrastructure within two years, identifying China and Russia among the countries increasingly using the technology in cyber activity.1
The National Cyber Security Centre’s assessment goes further, forecasting that AI-powered malware could be used in a ransomware attack on UK critical infrastructure by 2028. It also expects China, Russia and other states to use AI routinely in cyber operations by then.2 The agency’s chief executive, Richard Horne, said the AI revolution must “force UK organisations to reckon with the current state of their cyber security”.2
The warning comes amid a mixed picture. Of 1,831 cyberattack reports in the year to 31 August 2026, 80 were judged nationally significant, according to the NCSC account. Yet it attributes 88% of incidents at large organisations to four familiar entry points: public-facing applications, phishing, valid accounts and remote services.2 In other words, AI may amplify the attacker, but it will often exploit old weaknesses.
That is where Heigor Freitas of the cybersecurity body CREST parts company with a compliance-first response. He says the fall in nationally significant incidents “should not overshadow the wider rise in reported cyber attacks”, and argues that mandatory baselines are only a starting point.2
Freitas’s prescription is continuous testing, independent assurance and higher operational standards. “Industry leaders do not wait for regulation to drive improvements,” he said.2 The shared conclusion is stark: government can build defensive infrastructure, but organisations will have to make resilience a daily practice before the 2028 deadline arrives.