NCSC AI cyber intrusion assessment and the UK GDPR security duty
In short: In the NCSC AI cyber intrusion assessment published on 3 November 2026, the National Cyber Security Centre (NCSC) assesses it as almost certain that, by 2028, many systems will remain vulnerable to AI tools that find and exploit weaknesses. A UK data controller and data processor must ensure security appropriate to the risk, taking into account the state of the art and the likelihood of that risk (Article 32(1) UK GDPR), and the NCSC’s assessment is now evidence of that likelihood.
When a cyber attack exposes personal data, the Information Commission can ask whether the controller’s security was appropriate to the risk, taking into account the state of the art (Article 32(1) UK GDPR). On 3 November 2026 the NCSC published its assessment of the AI-enabled threat to 2028, and the Information Commission can read a controller’s risk assessment against it.
The NCSC published Artificial intelligence and cyber intrusion as an NCSC Assessment (NCSC-A), its authoritative statement on the cyber threat to the UK. The NCSC states its key judgements in the probability terms of the Professional Heads of Intelligence Assessment (PHIA) yardstick.
Key points
- The UK NCSC assesses it as almost certain that, by 2028, many systems will remain vulnerable to AI tools that identify and exploit system weaknesses. Source: NCSC, Artificial intelligence and cyber intrusion, 3 November 2026.
- It is highly likely that, between now and 2028, AI-powered malware will have been used in a ransomware attack on UK critical national infrastructure (CNI). Source: NCSC, key judgements.
- It is likely that attackers will apply AI tools against known vulnerabilities in legacy CNI technology and against the new attack surface that AI deployment inside CNI creates. Source: NCSC, key judgements.
- In its baseline scenario, written as a view of 2028, the NCSC describes defensive AI tools shortening the time from a newly found flaw to an available fix, and says that organisations’ internal patching and testing processes will need to evolve to keep pace. Source: NCSC, baseline scenario.
- The NCSC describes its three scenarios as plausible but not predictions, and says the prospect for surprise is high. Source: NCSC, context.
| What the NCSC assesses | NCSC probability term | What a data controller must weigh under Article 32 UK GDPR |
|---|---|---|
| Many systems remain open to AI tools that find and exploit weaknesses, to 2028 | Almost certain | The risk of varying likelihood in Article 32(1), including the risk of unauthorised access to personal data (Article 32(2)) |
| AI-powered malware used in a ransomware attack on UK CNI by 2028 | Highly likely | The ability to restore availability of and access to personal data in a timely manner (Article 32(1)(c)) |
| Attackers apply AI tools to known vulnerabilities in legacy CNI technology | Likely (stated for CNI) | Patching of known vulnerabilities, set against the state of the art (Article 32(1)) |
| Internal patching and testing processes will need to evolve (baseline scenario) | No probability term stated | A process for regularly testing, assessing and evaluating the measures (Article 32(1)(d)) |
The security duty under Article 32 UK GDPR
A data controller and a data processor must each put in place appropriate technical and organisational measures to ensure a level of security appropriate to the risk. Under Article 32(1) of the UK General Data Protection Regulation (UK GDPR), they must take into account “the state of the art”, the costs of implementation, the nature, scope, context and purposes of the processing, and the risk of varying likelihood and severity for the people whose data they hold.
Where appropriate to the risk, a controller and a processor must be able to restore the availability of and access to personal data in a timely manner in the event of a physical or technical incident, which is the capability a ransomware attack tests (Article 32(1)(c)). They must also, where appropriate, have a process for regularly testing, assessing and evaluating the effectiveness of their security measures (Article 32(1)(d)).
Operators of essential services and relevant digital service providers must ensure a level of security appropriate to the risk posed, having regard to the state of the art, in similar terms (regulations 10(3) and 12(2)(a) of the Network and Information Systems Regulations 2018 (NIS Regulations)).
The Information Commission, which succeeded the Information Commissioner’s Office (ICO) on 30 September 2026, enforces Article 32. When it decides whether to fine a controller and how much, it must have regard, under section 155(2)(a) of the Data Protection Act 2018 and Article 83(2)(b) and (d) UK GDPR, to whether the infringement was intentional or negligent and to the degree of responsibility of the controller or processor, taking into account the technical and organisational measures it implemented under Articles 25 and 32.
How the NCSC’s key judgements affect a security risk assessment
A data controller must weigh the risk of varying likelihood under Article 32, and the NCSC’s key judgements of 3 November 2026 give a published, dated statement of that likelihood for AI-enabled attack to 2028. A controller that rates that risk as unlikely for its own systems needs a reason for departing from the NCSC’s key judgement, which it puts at almost certain, that many systems will remain vulnerable.
The NCSC also describes how defensive tools may develop. In its baseline scenario, written as a view of 2028, defensive AI tools have shortened the time between a flaw being found and a fix being issued and have made patching quicker, though systems stay exposed unless those tools are correctly and widely configured. A controller weighing the state of the art can take that description into account. The NCSC adds that internal patching and testing processes will need to evolve to keep pace with faster discovery of flaws, and Article 32(1)(d) lists, among the measures a controller must take where appropriate, a process for regularly testing its security measures.
The NCSC describes its three scenarios as plausible but not predictions, and limits two of its key judgements to critical national infrastructure. Article 32(1) also requires a controller to weigh the costs of implementation and the nature of its own processing, so a small firm holding little sensitive data can reach a different conclusion from a hospital trust or an energy network. The NCSC’s almost-certain key judgement on vulnerable systems names no sector.
Sector security duties for telecoms providers and payment firms
A provider of a public electronic communications network or service must take appropriate and proportionate measures to identify and reduce the risks of security compromises and to prepare for them, under section 105A of the Communications Act 2003, as substituted by the Telecommunications (Security) Act 2021 (TSA 2021).
Regulation 12 of the Electronic Communications (Security Measures) Regulations 2022 requires a telecoms provider to deploy a vendor’s patch or mitigation within a period appropriate to the severity of the risk it addresses. Where the provider decides that a period of more than 14 days from the patch becoming available is appropriate, it must take that decision at an appropriate governance level and record it in writing. A provider considering a period of more than 14 days can weigh, when it records its reasons, the NCSC’s assessment that attackers will likely apply AI tools to known vulnerabilities in legacy CNI technology, although the NCSC states that assessment for CNI and not for every network. Ofcom has written to communications providers on the cyber security implications of frontier AI.
A payment service provider must establish and maintain a framework of mitigation measures and control mechanisms to manage the operational and security risks of its payment services, and must give the Financial Conduct Authority (FCA) an updated assessment of those risks and of the adequacy of its controls at least annually, under regulation 98 of the Payment Services Regulations 2017 (PSRs 2017). Each payment service provider is bound, including an account servicing payment service provider (ASPSP), meaning the bank or other provider that holds the customer’s payment account, and the payment initiation service providers and account information service providers, often called third-party providers (TPPs), that connect to it through open banking. Under regulation 99 a payment service provider must also notify the FCA without undue delay of a major operational or security incident.
Firms within the FCA’s operational resilience rules, which include banks, payment institutions, electronic money institutions and registered account information service providers, must also meet the rules in SYSC 15A. Under SYSC 15A.5.3 a firm must carry out scenario testing of its ability to remain within its impact tolerance for each important business service in the event of a severe but plausible disruption. A firm within SYSC 15A can use the NCSC’s AI-enabled scenarios to 2028 as a published source when it designs its severe but plausible scenarios, and can reflect them in the regulation 98 assessment it gives the FCA, in the form and with the content the FCA directs.
Implications for data controllers and data processors
A UK data controller’s security risk assessment is the evidence of what it knew and how it weighed it. A regulator investigating a breach can set the date of that assessment against the date of the NCSC’s key judgements, and a risk register reviewed after 3 November 2026 that does not deal with AI-enabled exploitation may be harder to defend as appropriate to the risk.
A controller’s patch management must reflect both the likelihood of risk and the state of the art. An n-day vulnerability is a flaw for which the vendor has issued a fix, and exploiting it depends on finding systems that have not been updated (NCSC glossary). A controller that leaves a vendor fix unapplied on a system holding personal data leaves that gap open. In August 2026 the ICO reprimanded ACRO Criminal Records Office under Article 32 for failing to maintain an effective patch management process, even though ACRO had engaged third parties for patching, and for leaving responsibility for monitoring critical security updates unclear; Bratby Law discusses the reprimand in ICO reprimand for cyber security failings.
Data processors carry the same duty in their own right, and under Article 28(3)(c) UK GDPR the controller’s contract must require the processor to take all measures required under Article 32. A controller that relies on a hosting or software supplier for patching remains responsible for its own security under Article 32, and the supplier’s patching timetable is part of the controller’s measures.
Viewpoint
A data controller has no new duty because the NCSC has published its Assessment. A controller has had to ensure security appropriate to the risk under Article 32 since 25 May 2018, and under Article 32 UK GDPR since the end of the Brexit implementation period on 31 December 2020; the NCSC does not enforce that duty. The Information Commission does, and it can now assess a controller’s choices against the NCSC’s published evidence.
A board that signs off a risk register after 3 November 2026 signs it against a published assessment that many systems will remain exposed to AI-enabled exploitation. A controller whose register records why it differs from the NCSC may be in a stronger position before the Information Commission, which must have regard to negligence and to the measures taken under Article 83(2)(b) and (d). Because the NCSC says the prospect for surprise is high, the register will need revisiting each time the NCSC updates its view.
Frequently asked questions
Does the NCSC AI cyber intrusion assessment create new legal obligations?
No. The NCSC published an intelligence assessment of the threat to 2028, with no legal force. The duty remains Article 32 UK GDPR, which requires a data controller and a data processor to put in place security appropriate to the risk, taking into account the state of the art and the likelihood of harm. The Assessment is evidence of that likelihood.
Which Article 32 measures matter most for AI-enabled attacks?
Where appropriate to the risk, a controller must be able to restore personal data in a timely manner in the event of an incident (Article 32(1)(c)) and must have a process for regularly testing its security measures (Article 32(1)(d)). A ransomware attack tests the first, and the NCSC assesses it as highly likely that AI-powered malware will have been used in a ransomware attack on UK critical national infrastructure by 2028. The NCSC also assesses that patching and testing processes will need to evolve to keep pace with faster discovery of flaws, which is relevant to the second.
Does the Assessment apply only to critical national infrastructure?
No. The NCSC limits two of its key judgements to critical national infrastructure, but its almost-certain key judgement that many systems will remain vulnerable to AI tools that exploit their weaknesses names no sector. The NCSC wrote the Assessment for cyber security professionals, large organisations and the public sector. Operators of essential services and relevant digital service providers under the NIS Regulations 2018 must also ensure security appropriate to the risk, having regard to the state of the art.
How does the Assessment affect telecoms providers and payment firms?
A telecoms provider must take appropriate and proportionate measures against security compromises under section 105A of the Communications Act 2003, and must take at an appropriate governance level, and record in writing, any decision to allow more than 14 days to deploy a vendor’s patch (regulation 12 of the Electronic Communications (Security Measures) Regulations 2022). The NCSC assesses it as likely that attackers will apply AI tools to known vulnerabilities in legacy CNI technology. Every payment service provider must manage operational and security risks under regulation 98 PSRs 2017, and firms within SYSC 15A, including banks, payment institutions, e-money institutions and registered account information service providers, must scenario-test against severe but plausible disruption under SYSC 15A.
For advice on data protection for AI-enabled products, including security measures, or on a security risk assessment after the NCSC Assessment, contact Rob Bratby at Bratby Law.
This post was researched and drafted with the help of Claude, Anthropic’s AI model. Rob Bratby chose the topic and thesis, and reviewed and edited the final post. Rob takes full responsibility for its content.
