Deploy First, Govern Never: How Britain Turned AI Recklessness Into Official Policy

On November 3, 2026, the UK's AI Minister Kanishka Narayan stood at an industry event and told the room, with evident satisfaction, that general AI laws developed ahead of the technology haven't worked out. He did not name the EU AI Act. He did not need to. The implication was sufficiently clear to anyone who has followed four years of Whitehall manoeuvring: Britain's deliberate refusal to legislate is not drift. It is doctrine.

The doctrine has a body count. Not metaphorical casualties, the kind that populate think-tank papers. Documented, regulatory ones.

The FCA's Verdict: Governance as an Afterthought

On October 19, 2026, the Financial Conduct Authority published its first detailed examination of how UK financial services firms actually deploy AI. The findings, drawn from direct supervisory engagement with regulated firms, were not ambiguous. Governance, the FCA stated plainly, remains the area of greatest under-investment across the entire sector. What regulators found, in case study after case study, was a consistent pattern: firms designed and deployed AI systems without first establishing accountability structures, then attempted to retrofit governance after key decisions had already been made.

One case study, labelled Case Study J by the FCA, describes a firm that deployed AI before establishing clear governance arrangements. Retrofitting governance after deployment proved difficult and exposed gaps in accountability. The language is measured. The reality it describes is not. These are regulated firms, operating under the Senior Managers and Certification Regime, Consumer Duty, and SYSC. Accountability is not optional. And yet, in an apparent display of collective amnesia, senior managers in some firms delegated AI development entirely to technical teams, without adequate challenge or documented rationale.

The Bank of England and FCA's fourth joint AI survey, published October 26, 2026 and covering 196 UK firms, found that 86% now report using AI, up from 75% in 2024. Among larger firms, 94% are running at least one production AI system. Meanwhile, 80% of respondents were already deploying AI agents. Post-deployment monitoring, leakage testing, and periodic review were significantly less common than pre-deployment controls. The institution had approved the deployment. Nobody was watching what happened next.

This is not Bhopal's missing methyl isocyanate scrubber. It is not the Challenger O-ring, cleared by managers who overruled engineers in a teleconference the night before launch. But the structural failure is the same: a governance gap treated as an acceptable operating condition, right up until it isn't.

The ICO's Confession, Dressed as Consultation

Four days after the FCA published its findings, the Information Commissioner's Office was still accepting evidence on what agentic AI even is. The ICO opened its call for evidence on agentic AI on October 8, 2026, covering data security, transparency, accountability, automated decision-making, fairness, and lawfulness of processing. It closes November 20.

Read that sequence again. The Bank of England and FCA's joint survey found that 80% of UK financial firms are already deploying AI agents with limited human oversight. The ICO is still gathering evidence on how to think about the data protection risks. The regulator has stated, with admirable candour, that the fact AI agents act with autonomy is not an excuse for poor compliance. What it has not yet produced is binding guidance on what compliance looks like. The industry is operating in that gap. It has been operating in that gap for years.

The ICO did, to its credit, secure data protection commitments from ten major foundation model developers on October 8: Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI, and Stability AI. Voluntary undertakings, from the largest AI companies on earth, obtained through a supervisory process that carries no statutory penalty for non-compliance beyond future enforcement action. Hannah Arendt, writing about the bureaucratic diffusion of responsibility, would have recognised the structure instantly: accountability distributed so widely across so many parties that it effectively belongs to no one.

The Minister's Logic, and Its Consequences

Narayan's argument, stated at Labour conference in September and again in his November 3 remarks, is that building British AI capability gives more leverage than rules. That regulation without capacity is theatre. This argument is not stupid. It is, in isolation, partially correct. The EU AI Act's high-risk system obligations, originally due August 2, 2026, were deferred to December 2027 under the Digital Omnibus, confirming that even Brussels could not operationalise its own framework on schedule.

But the argument has a hole large enough to drive an agentic system through. The UK has no AI Act. No dedicated statutory regulator. No consistent, system-wide obligation to monitor where AI is being deployed across the public sector. The Centre for Data Ethics and Innovation called this an "information gap" and a "governance gap." The LSE documented that government is already using AI to make decisions about policing, housing, and Universal Credit claims. No single body holds a dedicated mandate to scrutinise that deployment as a whole.

The Commons Library confirmed in a briefing dated October 14, 2026, that the UK has no AI-specific legislation covering AI as a technology. The Parliament's Joint Committee on Human Rights published its report on Human Rights and the Regulation of AI in September 2026, recommending a dedicated AI Bill and an independent statutory regulator. The government has not committed to either.

This is not an innovation strategy. It is a risk transfer. The costs of ungoverned AI deployment are being transferred to workers wrongly flagged by DWP fraud systems, to consumers in financial products whose AI-driven pricing no senior manager can fully explain, to anyone who needs to know who is accountable when the system fails. Because the system will fail. They always do.

Four Days: The Bill Nobody Will Back

On Friday, November 13, four days from today, Alex Sobel's Artificial Superintelligence Bill receives its second reading in the House of Commons. The bill would prohibit the development, deployment, and operation of artificial superintelligence systems, defining them by capability rather than architecture. More than 70 MPs and peers, including 15 former government ministers and former Cabinet Secretary Robin Butler, have written to Prime Minister Andy Burnham urging him to back it. The bill cites expert estimates of a 10% or higher extinction risk from superintelligent AI.

The government has already rejected a related "kill switch" proposal in the Lords. It says Sobel's bill is not the right approach. Without government backing, Private Members' Bills almost never become law.

The picture, assembled from regulatory findings published in the last three weeks, is this: UK financial firms are deploying AI agents faster than any regulator can track them, with governance structures the FCA describes as under-invested. The ICO is still taking evidence on the basics of agentic AI data protection, eleven days before its own deadline. The minister responsible for AI policy is publicly arguing that laws written before the technology appears don't work, while presiding over a regime with no laws at all. And the one bill that attempts to draw a hard line at existential risk will almost certainly die in committee, unaccompanied by government support.

Oppenheimer, watching the Trinity test, quoted the Bhagavad Gita: "Now I am become death, the destroyer of worlds." He said it because he understood that the thing had already been built, and the governance would follow, imperfectly, in its wake.

So what, precisely, is Britain's plan for the morning after?