The UK government has launched its Code of Practice for the Cyber Security of AI, a voluntary framework designed to enhance security in AI development. The code sets out 13 principles aimed at reducing risks such as AI-driven cyberattacks, system failures, and data vulnerabilities.

The guidelines apply to developers, system operators, and data custodians (any type of business, organisation or individual that controls data permissions and the integrity of data that is used for any AI model or system to function) responsible for creating, deploying, or managing AI systems. Companies that solely sell AI models or components fall under separate regulations. According to the Department for Science, Innovation, and Technology, the code will help ensure AI is developed and deployed securely while fostering innovation and economic growth.

Key recommendations include implementing AI security training, establishing recovery plans, conducting risk assessments, maintaining system inventories, and ensuring transparency about data usage. One of the principles calls to enable human responsibility for AI systems and prescribes to ensure AI decisions are explainable and users understand their responsibilities.

The code references existing standards and best practices for secure software development and security by design, as well as provides useful definitions.

The release of the code follows the UK's AI Opportunities Action Plan, which outlines strategies to expand the nation's AI sector and establish global leadership in the field. It also coincides with a call from the National Cyber Security Centre urging software vendors to eliminate 'unforgivable vulnerabilities'-security flaws that are easy and cost-effective to fix but are often overlooked in favour of speed and new features.

This code also builds on NCSC's Guidelines for Secure AI Development which were published in November 2023 and endorsed by 19 international partners.