Last week, the British government quietly tabled a new clause for the Cyber Security and Resilience Bill that would give the government powers to regulate AI companies located anywhere in the world. In its simplest form, this clause would mean that the government would have very broad discretion to inspect AI companies, test their platforms and require developers to test their models. If they don’t comply, politicians could then apply sanctions.

The clause has been introduced as a government amendment at the final substantive stage for amendments, and Monday is likely to be the only real chance to scrutinise the clause, in both the House of Lords and Commons. For the first time since AI has become widely available, the British state will be able to regulate the most economically promising and risky technology of our time. So, where is the democratic scrutiny?

AI risks are real, and the government has a role in mitigating them. The technology raises the risk of cyber attacks, but is also essential in fixing cyber vulnerabilities at the speed and scale with which attackers will be trying to exploit them. On Wednesday, a cyber vulnerability was discovered in PHP, a coding language that experts estimate is used in 70% of all websites. But this was discovered using OpenAI tools, a company that is controlled, owned and operated in America.

But the UK does not have its own developer of AI models designed to perform a wide range of tasks. As global models rapidly improve, speedy access to the most capable frontier models is crucial for competitive AI development and cybersecurity. Bluntly, Britain is dependent on access to US and Chinese models.

Regulatory friction is already delaying British access to frontier models. The Centre for Governance on AI research found that 7% of model releases were delayed or withheld in the UK compared with the US, while the figure for the EU was 11%.

So how would the otherwise obscure Cyber Bill regulate AI? If an energy company or data centre use an AI model or built on an open-weight model, the model and its developer could both fall within the Cyber Bill’s scope as a critical supplier. The new clause would then give the government broad discretion to regulate AI agents. The legislation doesn’t specify how the government will regulate AI or apply sanctions; it simply grants ministers broad discretion to introduce further rules.

This might be a quiet amendment, but regulation itself is unlikely to go unnoticed. In June, the Trump administration showed that it can and will restrict model access for the UK. But once the legislation has passed, Parliament will likely have little input in further regulation.

On Monday, the Lords could recognise the need for a more thorough debate. One simple balance would be to require the government to assess the risk of losing access to frontier models and the consequences of this, alongside the direct risks from AI, before it takes regulatory action.

Today, Britain is dependent on US and Chinese developers, with limited leverage. This doesn’t have to be the way forever. Britain could break the inertia of the planning system and grid queue to unlock data centre build-out and have sufficient capacity to run AI models domestically. A UK model developer could yet emerge behind the frontier, or a chip designer could make a capability breakthrough. But the world waits for the British state to shake off its dysfunction; could lawmakers at least debate the balance between model access and regulation?