As Britain strengthens its defences against the growing risks of artificial intelligence, expert Vendan Ananda Kumararajah warns that reporting incidents and identifying weaknesses will do little to prevent future failures unless organisations act on the lessons, tighten oversight and rethink the powers they give autonomous AI systems

Britain is preparing for serious incidents involving autonomous AI agents. Its latest security announcement recognises that these could unfold faster and spread further than emergencies existing institutions were designed to manage. 

Ministers are now considering stronger reporting arrangements, better identification of near misses and ways to learn quickly from what goes wrong. These are necessary developments, but their effectiveness will depend on what happens after the warning arrives.

An organisation may identify a weakness, investigate an incident, issue guidance and restore operations. Each step is important, but what establishes that the experience has changed the conditions governing the next decision? Can permissions be narrowed, a deployment paused or an authority withdrawn?

These questions become more pressing as AI systems gain access to tools, organisational data and consequential workflows. Delegated authority can travel through several systems before a human sees the result.

Microsoft’s 2026 Digital Defense Report provides a useful setting for examining this problem. Its accompanying analysis places AI agents within an interconnected security environment involving identities, applications, infrastructure and trusted relationships. It addresses agent access, attribution, authentication and revocation: practical concerns as agents enter enterprise operations.

I applied the A3 Governance Dashboard, developed from my A3 Model, to the report. The assessment uses assistance from a large language model (LLM) strictly within A3’s defined logic and rules. It examines evidence presented in the submitted document; it cannot establish everything Microsoft does internally.

That boundary is vital. A public cybersecurity report has a defined purpose. It cannot be expected to disclose every internal deliberation, and matters outside its scope should remain outside the conclusions drawn from it.

A3 follows the sequence from knowledge through action, experience and absorption into governance. Closure is demonstrated when experience changes what the institution accepts as knowledge, the rules it applies, the permissions it grants or the authority it recognises.

Within that boundary, the assessment identified documentary evidence of substantial operational strengths: articulated security commitments, action aligned with those commitments, actionable threat intelligence and coordinated legal and technical responses. The report describes Microsoft’s work with law enforcement and industry partners to disrupt Tycoon2FA, a phishing service, by targeting the infrastructure used to steal credentials.

The question alongside those strengths was how far the document demonstrated experience being absorbed into the rules and authority governing future action.

Disabling malicious infrastructure or revoking an attacker’s access changes an operational situation. It does not, by itself, establish that an organisation has revised its own approval rules, deployment assumptions or allocation of decision-making power. Those changes require their own evidence. The assessment found limited demonstration of that transition in the submitted evidence. This is a finding about the submitted report, not an allegation that institutional correction never occurs. It identifies where further evidence would be needed.

A3 examines this relationship through three elements operating together: Aram, ethical coherence; Aanavam, systemic distortion; and Adhikaram, legitimate agency. The ethical purpose of an activity, the distortions arising within it and the authority permitted to carry it out continually affect one another.

Distortion can originate inside the institution: incentives favouring deployment over scrutiny, habitual exceptions, misleading confidence or fragmented responsibility. Learning therefore requires scrutiny of the organisation’s own contribution to the conditions it later corrects.

Adhikaram treats legitimate agency – and the authority through which it acts – as earned, conditional and revocable. An organisation’s demonstrated capacity to respond responsibly bears on the scope of action it should continue to exercise.

Feedback can reach decision-makers without obliging them to change anything. A review can be mandatory while its recommendations remain discretionary. Corrective action can resolve the immediate problem while leaving governing conditions intact.

Consider an AI agent that repeatedly acts on unreliable information. An immediate remedy might correct its output and improve a filter. A governance response might also revise which sources qualify as evidence, narrow its permissions, require corroboration for particular actions and specify what must be demonstrated before wider autonomy is restored.

The difference becomes visible in the next decision. For boards and public bodies, this creates a practical evidential test. Who was required to respond? What changed? Who authorised the change? What conditions govern continued operation or restored autonomy?

Not every incident requires tighter restrictions. An investigation may conclude that existing arrangements remain adequate. But that judgement should have an accountable owner and an explicit evidential basis. Recording a recommendation is not the same as resolving it.

Britain’s proposed reporting and learning arrangements can be assessed against this requirement. Reporting creates the opportunity for correction; the institutional arrangements following the report determine whether it changes future conduct.

The A3 dashboard makes that transition examinable. Its indicators and evidence classifications distinguish provisions described in a document from operation demonstrated by it, and immediate response from changes governing the next cycle of action.

After the incident, the decisive record is what the institution now knows, permits and requires – and how those changes will shape what happens next.

Vendan Ananda Kumararajah is an internationally recognised transformation architect and systems thinker. The originator of the A3 Model—a new-order cybernetic framework uniting ethics, distortion awareness, and agency in AI and governance—he bridges ancient Tamil philosophy with contemporary systems science. A Member of the Chartered Management Institute and author of Navigating Complexity and System Challenges: Foundations for the A3 Model (2025), Vendan is redefining how intelligence, governance, and ethics interconnect in an age of autonomous technologies.

READ MORE: Rethink AI governance or risk an uncontrolled intelligence explosion. As AI begins helping to develop and evaluate its own successors, flawed assumptions and biases could multiply with each generation, fuelling an ‘intelligence explosion’ in which increasingly capable systems become harder to govern. To avoid this, stronger independent evaluation and oversight are essential, argues Vendan Ananda Kumararajah.

Do you have news to share or expertise to contribute? The European welcomes insights from business leaders and sector specialists. Get in touch with our editorial team to find out more.

_{Main Image: Czapp Árpád / Pexels}