The U.K. Issues Frontier AI Guidance to Enterprises in Regulated Sectors

In Focus

• Regulators asked enterprises to mitigate risks posed by frontier AI models
• The U.K. said the impact of frontier AI models on cyber security could be significant
• Regulators identified five strategic areas where companies should take active steps

Regulators in the U.K. have issued a warning about frontier AI risks. In a statement released on May 15, 2026, the Bank of England and the Financial Conduct Authority (FCA) advised enterprises to plan for new AI models and mitigate risks that could arise from their deployment.

Why has the U.K. Flagged Frontier AI Cybersecurity Risks?

While acknowledging AI’s rapid evolution, British regulators noted that the impact of frontier AI models on cyber security and operations could be significant due to their capabilities. In the tech industry, the term frontier AI is used to refer to the most advanced, cutting-edge foundational AI models that exceed current state-of-the-art performance.

A good example is Anthropic’s Claude Mythos Preview, which debuted last month. Mythos AI is designed to identify security flaws and software vulnerabilities. However, the AI model sparked hacking fears with experts advising caution when interpreting Mythos vulnerability results.

“The cyber capabilities of ‌current frontier ⁠AI models are already exceeding what a skilled practitioner ⁠could achieve, and at a significantly higher speed, greater scale, and ​lower cost. These capabilities, if used maliciously, amplify cyber threats to firms’ safety and soundness, customers, market integrity, and financial stability,” The agencies noted in a published statement.

British watchdogs have advised enterprises in regulated industries, like the banking sector, to build capabilities for protecting, detecting, containing and responding to cyber threats.

What Actions Should Enterprises in the U.K. Take?

Regulators in the U.K. want companies to take active steps in five strategic areas. These include governance, protection, and risk management. According to the watchdogs, enterprises should ensure that their boards and senior management are sufficiently informed about the risks posed by frontier AI.

They should also build capabilities that enable them to assess, prioritize and mitigate vulnerabilities frequently, faster, and at scale. These capabilities should include automating such processes. To manage third-party risks, enterprises should strengthen their capabilities for identifying, tracking, and managing external apps.

The AI guidance by the U.K. government comes weeks after the Bank of England raised concerns about AI. BoE governor Andrew Bailey said that Mythos could pose major cybersecurity risks. Currently, Mythos Preview is only accessible to participants of Anthropic’s cybersecurity initiative, Project Glasswing.

British Regulators issued a frontier AI models warning as Japan’s largest banks prepare to access Claude Mythos starting June 2026. Even so, the country has established a working group to identify exposures in Mythos, execute defensive measures, and develop contingency plans that would guide the rollout of a patching process across the country’s financial system.

How Are Governments Responding to Mythos?

Regulatory authorities across Europe, Australia, and South Korea have initiated discussions with banks to assess vulnerabilities linked to the advanced AI model. Cybersecurity experts warn that Mythos could challenge the technology that currently supports the banking industry due to its potential to supercharge complex cyberattacks.