United Kingdom - AI Risk Management

Overview

The Central AI Risk Function (CAIRF) is a cross-government coordination and monitoring function established inside the UK Department for Science, Innovation and Technology (DSIT). Announced in ministerial statements on 19 September 2023 and set out as a central function in the government’s AI Regulation White Paper, CAIRF's core mission is to identify, measure and monitor existing and emerging AI risks across government, industry and academia. CAIRF maintains the UK AI Risk Register and provides a single, holistic picture of systemic and sectoral AI risks that can inform regulator action, policy design and international engagement, including inputs into outcomes from the AI Safety Summit (Bletchley Declaration). While CAIRF is non-statutory in form, it is intended to strengthen regulatory coherence and enable faster, evidence-based government responses to novel AI hazards.

Definitions

CAIRF uses the terminology established in the White Paper and related government papers. Key terms include: 'AI risk' (probability and impact of harms from development or deployment of AI systems), 'foundation models'/'frontier AI' (highly capable, general-purpose models with broad applicability and potential for systemic effects), 'systemic risk' (risks that affect multiple sectors or national infrastructure), and 'AI Risk Register' (a living catalogue of identified AI-related risks and mitigations). CAIRF also distinguishes between (a) near-term misuse and safety risks that are sector-specific and (b) longer-term, systemic, or existential-style risks that could require whole-of-government responses.

Governance and Institutional Framework

CAIRF is hosted in DSIT’s AI Policy Directorate and operates in close coordination with the AI Safety Institute (AISI) which conducts technical testing and evaluations. CAIRF convenes representatives from lead AI Ministers, sectoral regulators and independent expert advisers. It feeds evidence to the Digital Regulation Cooperation Forum (DRCF) pilots for multi-regulator advisory services and supports the delivery of regulator AI plans. The function reports into senior DSIT officials and provides briefings to ministers, while its outputs are used by regulators with statutory powers (for example the Competition and Markets Authority, Information Commissioner's Office, MHRA and others) who remain responsible for enforcement within their remits.

Key Focus Areas

CAIRF concentrates on a set of priority functions: (1) horizon scanning and early warning for emergent capabilities and misuse vectors from foundation and frontier models; (2) maintenance and publication (subject to security considerations) of a cross-economy AI Risk Register; (3) system-level risk assessment and scenario analysis to understand cascading effects across critical infrastructure, healthcare, finance and national security; (4) coordination of evidence flows between the AI Safety Institute’s technical evaluations and policy/regulatory decision-makers; (5) identification of regulatory gaps and recommended mitigations, including guidance for developers and deployers; (6) convening and capacity-building for regulators to embed AI-specific expertise; and (7) engagement with international fora to align testing, standards and incident response practices. These activities support the government’s principled, context-based approach by ensuring policy is grounded in current technical understanding.

Implementation Framework

Operationally CAIRF runs cross-government working groups, maintains an AI Risk Register updated through engagement with regulators, industry and academia, and commissions/adopts specific technical evaluations from the AI Safety Institute. It supports regulator readiness through playbooks, practical guidance and joint sandbox pilots (e.g., DRCF AI and Digital Hub). CAIRF also establishes escalation pathways so that high-severity risks prompt rapid ministerial and regulator-level action. Internally, CAIRF coordinates with lead AI Ministers and an Inter-Ministerial Group (IMG) to ensure policy coherence and to allocate responsibilities for mitigation measures across departments.

Monitoring and Evaluation

CAIRF’s monitoring framework combines structured risk metrics, qualitative scenario analysis and technical evaluation outputs to assess both likelihood and impact. The function tracks indicators such as concentration in FM markets, speed of capability development, misuse incidents, and regulator preparedness. Periodic reviews and a rolling evaluation feed into the government’s AI regulatory response — including whether further statutory duties for regulators or sector-specific rules are warranted. CAIRF also measures the effectiveness of mitigations recommended to regulators and reports on progress in closing identified regulatory gaps.

Penalties, Liability, and Appeals

As a policy/coordination body CAIRF does not itself levy penalties or adjudicate liability. Where CAIRF identifies harms or regulatory breaches, it refers matters to the relevant statutory regulator or law enforcement for investigation and enforcement. Penalties therefore remain those available under sectoral or cross-cutting laws (for example consumer protection, data protection, health and safety, competition law). CAIRF can, however, recommend legal or policy changes to tighten liability allocation, redress mechanisms, or sanctioning powers where existing instruments are insufficient.

Relationship to Other Instruments

CAIRF operates alongside and in support of the Government’s White Paper AI Regulation White Paper, the AI Safety Summit outcomes (the Bletchley Declaration), the AI Safety Institute establishment materials and the UK Science and Technology Framework. It is intended to complement — not supplant — sectoral regulatory regimes and to inform future primary legislation if and when the government decides statutory measures are necessary.

International Alignment

International alignment is central to CAIRF’s remit: by aggregating national risk intelligence and aligning testing and evaluation standards with partners, CAIRF supports the UK’s international commitments made at the AI Safety Summit and under multilateral fora (G7, OECD). CAIRF liaises with counterpart functions internationally to support interoperable assurance practices and to coordinate state-led testing or information sharing about frontier model capabilities and risks.

Implementation Timeline

Sources and References