The UK government is pushing ahead with its AI ambitions yet is dragging its feet on replacing aging IT systems that leave departments vulnerable to cyberattacks, according to a damning assessment from Parliament's spending watchdog. Sir Geoffrey Clifton-Brown, chair of the House of Commons Public Accounts Committee (PAC), warns in his second annual report that Whitehall is failing to tackle its longstanding technology problems, even as AI gives criminals and hostile states new ways to attack government systems. "AI is approaching government like a tsunami, and I remain sceptical that government is prepared for the enormity of this challenge," Clifton-Brown writes. The Conservative MP says ministers have announced reforms to improve digital capability but have yet to explain how they will close the civil service's skills gap, or when. He also fears another Whitehall reshuffle, this time involving the creation of the Department for Business, Innovation, Science and Trade, will make matters worse. The numbers aren't encouraging. Just 6 percent of civil servants work in digital and data roles, well short of the government's 10 percent target. Senior specialists are particularly thin on the ground, and the PAC warns that meeting the target will mean recruiting, and retaining, many more of them. And then there's the technology itself. "Government is also showing a worrying lack of urgency in addressing the long-standing issue of legacy IT systems, which create significant risks for its cyber security and mean it cannot reap the benefits of new technologies," the report states. The report also warns that generative AI is giving fraudsters increasingly sophisticated tools, while government departments risk falling further behind. Fraud and error already cost taxpayers an estimated £55 billion to £81 billion annually, according to figures cited by the PAC. Clifton-Brown isn't impressed with efforts to reduce those losses either. The Department for Work and Pensions reckons it overpaid £9.9 billion in benefits through fraud and error in 2025-26, or 3.2 percent of its spending. Its plan is to get that down to 2.8 percent by 2028-29, but Clifton-Brown points out that even if that succeeds, billions will still be going out the door. Things aren't looking much better at the Home Office, where years of asylum backlogs and mounting costs have prompted what Clifton-Brown calls "counterproductive quick fixes." The Home Office and Ministry of Justice spent around £4.9 billion on asylum in 2024-25, and ministers have since promised an entirely new system without explaining how it will work. That criticism comes as digital rights campaigners at Open Rights Group have called for the Home Office to scrap its AI asylum tools over concerns about accuracy, transparency, and human oversight. Elsewhere, the report offers another reminder that government IT modernization has a habit of going wrong. Take National Savings & Investments (NS&I), which began overhauling its IT in 2020 in the hope of cutting running costs. By December 2024, the price tag had reached an eye-watering £3 billion, £1.3 billion more than first expected. The project has been rated red since 2022-23, meaning successful delivery looks unlikely, and NS&I couldn't even give MPs an up-to-date spending figure or a realistic completion date. The Bank of England, by contrast, managed to overhaul its Real-Time Gross Settlement system for £431 million, finishing the job in April 2025. The PAC was impressed enough to direct its recommendations at Whitehall rather than the Bank, suggesting ministers might want to take notes. Whitehall could start by applying those lessons to the systems it already runs. ®

The US Cybersecurity and Infrastructure Security Agency (CISA) has killed many of the industry partnerships it used to enhance security, but don't tell the organization's acting director. Speaking on Tuesday at a virtual public sector cyber resilience summit hosted by infosec firm Rubrik, Nick Andersen claimed that CISA’s public-private partnerships are the most critical aspect of his agency’s mission. “We don’t see everything. We’re not a law enforcement agency, intelligence agency, or a regulator,” Andersen said during a discussion at the summit. CISA, he added, relies on intelligence and insight not only from other government agencies and international partners, but from the private sector as well. CISA’s mission simply can’t succeed without motivating those various partners to share what they’ve seen, heard, and dealt with in order to build a comprehensive threat model. “It’s all carrots and partnerships,” Andersen added, referring to motivating partners to get on board with programs like CISA’s CI Fortify initiative for building resilient critical infrastructure. Were that actually the case, we wouldn’t really have a story to write here, but anyone who’s been following CISA’s trials and tribulations during the second Trump administration is likely to have raised an eyebrow at Andersen’s claims. Trump returned to office riding a wave of plans to cut government spending, which included massive reductions at CISA. Among the first CISA programs axed was the Cyber Safety Review Board, a public-private body set up by the Biden administration. In addition to that closure, the Trump administration also shuttered the Artificial Intelligence Safety and Security Board, Critical Infrastructure Partnership Advisory Council, National Security Telecommunications Advisory Committee, and US Secret Service Cyber Investigations Advisory Board, all bodies consisting of government and private players working together toward cybersecurity goals. Some of those bodies have since been stood up again or reformed under new names, wasting time and money that could have been better spent by cyber defenders doing things like, you know, advising CISA and other government agencies on security matters. CISA also terminated funding for and ties to the Center for Internet Security in late 2025. One of CISA’s bodies affected by the cut was the Multi-State Information Sharing and Analysis Center, a public-private partnership that shares threat intelligence and filters essential alerts down to the local government level. CISA staff has also been slashed considerably, with around a third of the Agency’s headcount, about 1,000 people, departing since Trump returned to office. CISA has since committed to rehiring around 300, but the Trump administration’s most recent budget request proposes eliminating an additional 900 positions at the agency, along with slashing nearly a billion dollars from CISA’s 2027 budget. When we asked about the apparent contradiction, CISA reached out to point us to initiatives like its reformed councils, CI Fortify, and security exercises it hosted with industry partners to test cyber resilience to point to the continued priority the agency places on its public-private partnerships. “CISA works with critical infrastructure owners and operators to assist them in securing both the physical security and cybersecurity of the systems and assets that support essential services,” an agency spokesperson told us. “Our regional teams assist industry and government partners across the country by assessing risks, helping entities bolster defenses and improve resilience, and responding promptly to threats.” But with so many outreach employees and general staff still missing, Andersen’s claims ring a bit hollow. Either the acting administrator is misrepresenting the continued importance of private industry partnerships at CISA, or he’s in denial about the state of his agency. Neither is great, especially with more budget and staffing cuts looming, and the price will be unprepared critical infrastructure. ®

The UK Cabinet Office has scrapped a recruitment platform, recording a £7.8 million loss, while disclosing a potential penalty of up to £8.9 million over its handling of contractors' tax status. The department's annual report for 2025-26 said the Civil Service Jobs Applicant Tracking System (ATS) Programme, a central government plan for a unified, cross-departmental hiring system, was being closed to "align with the Shared Services for Government Strategy," which the Prime Minister's department also manages. The report said axing the program resulted in a "constructive loss" of £7.8 million. In March, a report from the National Audit Office said the ATS was an example of an interdependency that has not been effectively managed in the Shared Services Strategy, which is designed to bring Whitehall departments onto a common set of software-as-a-service (SaaS) enterprise applications. The Cabinet Office's annual report says closure will allow a new project better aligned with that strategy. "The program consistently identified lack of adoption from shared services clusters as a risk. At various points between 2023 and 2025, some shared services clusters raised concerns about the ATS program and stated that they would prefer to use the ATS functionality of their own ERPs over the new central platform. Despite this, Cabinet Office did not assess the need for a reset as soon as it could have, which made it challenging to assess alternative options for delivering an ATS. The ATS program was reset in October 2025," the report said. At the time, the Cabinet Office estimated that the total costs of the program reset would be £26 million to £38 million. The annual report estimates the Cabinet Office's liability for unpaid tax and National Insurance under IR35 off-payroll working rules, including interest, at £38.5 million. The rules affect many tech contractors working through their own companies. It paid £15 million toward settlement in February 2026, leaving a £23.5 million provision at year-end. The final settlement remains under negotiation. The department also disclosed potential HMRC penalties of up to £8.9 million, but considers payment unlikely because penalties can be suspended subject to compliance conditions. The report said: "The department has identified a remote contingent liability regarding potential financial penalties from HMRC relating to historic off-payroll working (IR35) compliance. In October 2025, HMRC concluded that the department's historic processes were inadequate and reasonable care was not taken, which can attract a penalty of 15 percent to 30 percent against the net tax liability before interest." Dave Chaplin, CEO of IR35 tax compliance firm IR35 Shield, said the HMRC assessment raises serious questions about compliance at the very heart of government. "The lesson for every organization engaging contractors is that claiming to take reasonable care is not the same as being able to demonstrate it. IR35 determinations must be supported by robust processes, accurate information, and evidence that the rules have been applied properly. Getting it wrong can have consequences far beyond the original tax bill," Chaplin said. ®

The Home Office's latest attempt to speed up asylum decisions with AI has hit an awkward snag: a new report says more than one in five interview summaries checked by experts failed accuracy tests. A 20-page investigation by the Open Rights Group (ORG) claims the department is pressing ahead with AI tools despite concerns about their accuracy, oversight, and promised efficiency gains. The findings, based on Freedom of Information requests and correspondence with ministers, concern two systems used by Home Office caseworkers: Asylum Case Summarisation (ACS), which summarizes asylum interviews, and Asylum Policy Search (APS), a chat-style tool helping officials search country policy information. Both use OpenAI's GPT-4o model through Microsoft's Azure AI Foundry. The government insists humans remain responsible for asylum decisions, but ORG questions how reliably caseworkers can spot mistakes in AI-generated information. Figures obtained by the campaign group show that 45 of 203 AI-generated interview summaries failed initial expert checks after the system was rolled out in April 2026. That's a 22 percent failure rate, compared with the 9 percent rejection rate recorded during the original pilot. Another 19 summaries were flagged for further review. The figures also record 56 second-stage reviews, of which 30 failed to meet the required standard. The errors can include factual inaccuracies and misrepresentations of what asylum seekers said during interviews. ORG also found that summaries could pass the checks even if they omitted important details, as long as the information they did include was accurate. Despite those results, relatively few summaries have been examined. ORG estimates that Home Office experts checked only 0.3 percent between April and July, based on the department's projected monthly caseload of 17,515. ORG also questioned whether the tools were saving much time. It says the average monthly number of initial substantive asylum decisions since April 2026 fell about 42 percent compared with the same period in 2025, while the mean time from interview to decision rose 29 percent. While those figures don't prove that AI caused the slowdown, they offer little evidence of the productivity gains ministers have promised. Oversight of the separate Asylum Policy Search tool also appears lacking. The Home Office confirmed in August that expert testing had stopped, despite previously telling MPs that checks were continuing. ORG says no summary of the testing results was produced. Meanwhile, asylum applicants are not specifically told when AI has been used in their cases and cannot inspect or correct the summaries generated from their interviews. ORG also questions the Home Office's claims of human oversight. The department's own data protection assessment says ACS automates work previously done by technical specialists, who reviewed and summarized asylum cases before passing them to decision-makers. ORG warns the tool could remove an experienced layer of scrutiny, rather than simply save staff time. The group is calling for both tools to be suspended and independently audited, arguing that the current safeguards are inadequate for decisions that determine whether someone can remain in the UK. It's not the first time the Home Office's technology plans have come under fire. In June, more than 60 rights groups urged ministers to abandon plans for AI-powered age estimation of asylum-seeking children, warning that the technology was unreliable around the crucial 16-to-18-year-old age range. Later that month, an inspection found that the department's long-delayed Atlas immigration system was failing to provide caseworkers with feedback from asylum appeals, forcing staff to rely on workarounds. The Home Office did not respond to The Register's questions. ®