Westminster Policy News & Legislative Analysis

UK and Australia sign AI security MoU on cyber risks

On 25 May 2026, the UK and Australia signed a Memorandum of Understanding in Canberra linking the UK AI Security Institute with the Australian AI Safety Institute. Both governments presented the agreement as a response to fast-moving frontier AI risks and as a step towards closer safety and security coordination between the two countries. (gov.uk) The signatories were UK Minister for AI and Online Safety Kanishka Narayan and Australia’s Assistant Minister for Science, Technology and the Digital Economy, Dr Andrew Charlton. In policy terms, the announcement creates an institute-to-institute channel for technical cooperation, rather than a one-off ministerial declaration. (gov.uk)

According to the UK government and the Australian joint release, the MoU covers information-sharing on frontier AI capabilities and risks, joint research, cooperation on testing and evaluation methods, and staff exchanges. Australia also said the arrangement would support cooperation on the responsible development, deployment, governance and use of safe and trustworthy AI. (gov.uk) That scope places evaluation science and operational coordination at the centre of the partnership. For departments, regulators and operators of critical systems, the practical question will be whether both institutes can build compatible approaches to measuring capability, assessing misuse risk and identifying where AI can improve cyber defence. The final sentence is an inference drawn from the functions described in the official announcements. (gov.uk)

The immediate policy driver is cyber security. The UK announcement says recent AI Security Institute research shows advanced systems are improving quickly in their ability to carry out complex cyber-attacks, with consequences for both attackers and defenders. The National Cyber Security Centre, citing recent AISI work, said the best frontier models moved from barely making progress in a realistic enterprise attack simulation to completing more than half of it in 18 months, while the cost of a full attempt fell to about £65. (gov.uk) The same research also points to current limits. Models released before March 2026 were still short of completing those complex attack scenarios end to end. Even so, the evidence base is strong enough for ministers to treat shared testing, measurement and mitigation work as a current public-safety issue, not a distant research concern. The final sentence is an inference based on the official research and the terms of the MoU announcement. (ncsc.gov.uk)

The institutional background explains why this agreement matters. The UK says its AI Security Institute already shares best practice with international research bodies through the International Network for Advanced AI Measurement, Evaluation and Science and through bilateral partnerships. Australia, for its part, has been establishing an AI Safety Institute under its National AI Plan and says the body is intended to evaluate emerging AI capabilities, share information on risks and harms, support best-practice regulation and advise where legislative updates may be needed. (gov.uk) Set against that wider programme, the Canberra MoU is a mechanism for regular working-level cooperation between two institutes with closely related remits. It also gives both governments a clearer route for exchanging technical evidence as frontier models improve. (gov.uk)

The announcement does not set out new legislation, mandatory standards or immediate compliance duties for developers. Instead, it creates a framework for coordination on research, capability monitoring and evaluation practice, which may later inform domestic policy choices and international standard-setting. The second sentence is an inference drawn from the stated remit of the institutes and their role in wider international work. (gov.uk) For AI developers and public bodies, that points to closer attention on how advanced systems are tested, especially where cyber misuse, autonomy and system reliability are concerned. For organisations outside the AI sector, the signal is narrower but still material: governments are placing more emphasis on the security effects of frontier models, not only their economic use cases. The final sentence is an inference based on the cited government material and AISI cyber research. (gov.uk)

Taken together, the agreement shows AI safety policy moving from broad declarations towards technical cooperation between specialist state institutions. The emphasis on measurement, evaluation and cyber risk suggests a more operational phase of AI governance, where ministers are relying on institutes to produce evidence that can keep pace with model development. The second sentence is an inference based on the official announcements and published AISI material. (gov.uk) For the UK, the government says AISI research is already informing policy intended to protect businesses, critical infrastructure and the public. For Australia, the AI Safety Institute is being positioned within a wider domestic framework for safe and trustworthy AI. The MoU does not resolve the regulatory choices facing either country, but it does indicate that future policy will rest increasingly on shared testing evidence and cross-border technical coordination. The final sentence is an inference based on the announced functions of the two institutes. (gov.uk)