Info Gov

The Cabinet Office has added seven new risks to the National Risk Register, including interference in the UK's democratic process and cyber attacks on data infrastructure, water infrastructure and police systems.

In his Annual Resilience Statement on 14 July, Chief Secretary to the Prime Minister Darren Jones told Parliament that the evolution of artificial intelligence demand attention, with the register citing a rapid increase in the sophistication and proliferation of AI as context for the new cyber risk entries. "AI offers new ways for criminals to carry out cyber-attacks against us, as well as offering huge opportunities for our economy and security," Jones said.

The additions to the register comprise: the risk of interference in the UK's democratic process, following the announcement last week of new safeguards including tougher checks on company donations and a cap on overseas donations; cyber attacks on data infrastructure, water infrastructure and police systems; and "digital resilience failure", an entry building on lessons learnt from the CrowdStrike IT outage of July 2024. #

The National Risk Register is the government's assessment of the most significant risks facing the UK and the public-facing version of the classified National Security Risk Assessment. It is a planning tool designed to help professionals prepare for risks rather than a prediction of future events.

A consultation launched today will explore giving regional mayors a formalised, broader role in local resilience alongside existing structures such as Local Resilience Forums, under a review of the Civil Contingencies Act 2004. The government considers the Act broadly fit for purpose, with the consultation fulfilling its duty to carry out regular reviews of the legislation.

A national resilience campaign will launch later this year to encourage the public to take simple steps to improve household resilience to risks including cyber attacks, flooding and severe weather. Building on existing guidance on GOV.UK Prepare, the campaign will bring the UK in line with European peers and include new resources for schools and colleges.

Jones also announced that the Home Defence Programme will deliver the largest UK home defence exercise in decades in 2027. The multi-day exercise, named Operation ALBISTON SHADOW, will test government preparedness for hybrid attacks against the UK, with the precise scenario remaining classified, and will complement NATO's forthcoming CMX27 exercise. Classified government crisis plans known as the "War Books", coordinated by the Cabinet Office, are also being updated for the first time since 2004.

Louise Sandher-Jones MP, Minister for the Armed Forces, said Russia was not only a threat to NATO's eastern flank but a direct threat to the UK homeland, and that the exercises and updated War Books would help prepare the country to meet that threat.

Professor Dame Angela McLean, Government Chief Scientific Adviser, said the science was clear that taking simple, practical steps in advance strengthens collective resilience and helps keep people safe if disruption occurs.

The updated National Risk Register and the Annual Resilience Statement are available via GOV.UK: https://www.gov.uk/government/news/risk-of-democratic-interference-added-to-national-risk-register.

Also in this section

Sep 11, 2026

Anthropic discloses fourth incident of AI model attacking real systems and hands investigation to independent evaluation organisation

Anthropic has published details of four incidents in which its Claude models gained unauthorised access to real third-party systems during cybersecurity evaluations, downloading and modifying user records at a real company, reading the personal information of an individual, harvesting credentials and accessing a security vendor's live database, after the test environments were mistakenly…
Sep 10, 2026

Welsh environmental watchdog hit by data breach

Environmental regulator Natural Resources Wales (NRW) has reported itself to the Information Commissioner's Office after a data breach saw personal details of staff made public.
Aug 24, 2026

Ministers seek power to ban tech risky vendors from critical sectors and bar recipients from discussing the order

The government has tabled amendments to the Cyber Security and Resilience (Network and Information Systems) Bill that would allow the Secretary of State to direct operators of essential services, data centres, managed service providers and other designated organisations to stop buying from, restrict the use of, or remove and disable products from a named vendor on national security grounds, with…
Aug 12, 2026

ACRO Criminal Records Office reprimanded by ICO following cyber security failings

The Information Commissioner's Office (ICO) has urged organisations to strengthen “patching and security monitoring processes” after cyber security failings at ACRO Criminal Records Office left the personal information of up to ten-thousand people, including some individuals’ sensitive data, potentially exposed.
Aug 06, 2026

AI agents sent malicious files to real developers and planted prompt injections in unmonitored test: AISI

The AI Security Institute (AISI) has published an incident report disclosing that AI agents under evaluation in its research environment took sustained, unsanctioned action against real people and organisations on the live internet, including researching the human maintainers of an open-source project, creating fake online identities to pressure one of them into approving malicious code, and…
Aug 05, 2026

Third AI platform goes rogue during cyber testing

The AI Security Institute (AISI) has reveaked a security incident in which AI agents being evaluated for their cyber capabilities took sustained, unsanctioned action directed at real people and organisations, including an attempted supply-chain attack on a publicly used open-source software project.

InfoGov Masthead Newsletter 800