{
  "schema_version": "rangoon.article.v1",
  "id": "https://rangoon.ai/insights/archive-uk-ai-cyber-security-code-january-2025/",
  "url": "https://rangoon.ai/insights/archive-uk-ai-cyber-security-code-january-2025/",
  "markdown_url": "https://rangoon.ai/insights/archive-uk-ai-cyber-security-code-january-2025/index.md",
  "json_url": "https://rangoon.ai/insights/archive-uk-ai-cyber-security-code-january-2025/index.json",
  "title": "UK published an AI cyber-security code with 13 voluntary principles and an implementation guide",
  "summary": "The UK published its AI Cyber Security Code of Practice on January 31, 2025, pairing voluntary principles for developers and operators with a practical implementation guide.",
  "language": "en",
  "author": {
    "name": "Rangoon Editorial",
    "url": "https://rangoon.ai/insights/editorial/"
  },
  "publisher": {
    "name": "Rangoon",
    "maintainer": "Hypler",
    "url": "https://rangoon.ai/"
  },
  "format": "News analysis",
  "topic": {
    "slug": "governance",
    "label": "Governance",
    "url": "https://rangoon.ai/insights/topics/governance/"
  },
  "tags": [
    {
      "slug": "uk-government",
      "label": "UK government",
      "url": "https://rangoon.ai/insights/tags/uk-government/"
    },
    {
      "slug": "ai-security",
      "label": "AI security",
      "url": "https://rangoon.ai/insights/tags/ai-security/"
    },
    {
      "slug": "cybersecurity",
      "label": "cybersecurity",
      "url": "https://rangoon.ai/insights/tags/cybersecurity/"
    },
    {
      "slug": "ai-governance",
      "label": "AI governance",
      "url": "https://rangoon.ai/insights/tags/ai-governance/"
    }
  ],
  "dates": {
    "published": "2026-10-24",
    "updated": "2026-10-24",
    "event": "2025-01-31"
  },
  "event_source_id": 1,
  "retrospective": true,
  "reading_minutes": 3,
  "takeaways": [
    "The January event published a voluntary code and guide; its “shall” language operated within that voluntary code, not as a new statute.",
    "The 13 principles run from awareness and secure design through supply chain, testing, monitoring, patching and disposal.",
    "The implementation guide supplied examples, while later implementation, certification and standards status required separate evidence."
  ],
  "source_note": "Historical reporting: the UK government published the AI Cyber Security Code of Practice and implementation guide on January 31, 2025. The Code calls itself voluntary, defines “shall” and “should” in that voluntary context, and addresses developers, system operators and data custodians. The implementation guide gives example controls and threat contexts. Government also said it intended to submit the materials to ETSI as a basis for future global-standard work. Publication did not itself create an ETSI standard, certify an AI system, establish universal legal duties, or prove any organization had implemented the listed controls.",
  "sources": [
    {
      "id": 1,
      "title": "GOV.UK: AI Cyber Security Code of Practice",
      "url": "https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice",
      "published": "2025-01-31"
    },
    {
      "id": 2,
      "title": "GOV.UK: Code of Practice for the Cyber Security of AI",
      "url": "https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai",
      "published": "2025-01-31"
    },
    {
      "id": 3,
      "title": "GOV.UK: Implementation Guide for the AI Cyber Security Code of Practice",
      "url": "https://assets.publishing.service.gov.uk/media/679cae441d14e76535afb630/Implementation_Guide_for_the_AI_Cyber_Security_Code_of_Practice.pdf",
      "published": "2025-01-31"
    }
  ],
  "image": {
    "url": "https://rangoon.ai/assets/editorial/archive-uk-ai-cyber-security-code-january-2025-diagram-v1.webp",
    "thumbnail_url": "https://rangoon.ai/assets/editorial/archive-uk-ai-cyber-security-code-january-2025-diagram-v1-thumb.webp",
    "alt": "Original assurance explanatory diagram, AI-security lifecycle. Labels: Design, Data, Model, Supply chain, Monitor, Retire. Source boundary: dated primary release reporting; original editorial analysis.",
    "type": "original-diagram",
    "caption": "AI-security lifecycle. Original Rangoon explanatory diagram: Source boundary: dated primary release reporting; original editorial analysis. No vendor interface, photograph, measurement result, or endorsement implied.",
    "credit": "Rangoon / Hypler",
    "source_url": "https://rangoon.ai/brand/",
    "rights_url": "https://rangoon.ai/terms/#media-use",
    "rights_note": "Hypler artwork permissions do not grant rights to third-party marks or imply endorsement."
  },
  "sections": [
    {
      "id": "voluntary-code",
      "url": "https://rangoon.ai/insights/archive-uk-ai-cyber-security-code-january-2025/#voluntary-code",
      "heading": "The release was a voluntary baseline with named roles, not a system certification",
      "paragraphs": [
        "On January 31, 2025, the UK government published its AI Cyber Security Code of Practice alongside an implementation guide. The publication says the materials set out baseline principles to help secure AI systems and the organizations that develop and deploy them. The Code explicitly calls itself voluntary and explains that “shall” denotes a requirement within the voluntary Code, while “should” is a recommendation. It identifies developers, system operators and data custodians as its main roles, and notes that vendors that only offer components may instead fall under other software and cyber guidance. This framing matters: publication established an official voluntary reference point. It did not say every UK AI supplier was certified, that each control was legally mandatory, or that an organization’s system had passed a security assessment."
      ],
      "bullets": [],
      "source_ids": [
        1,
        2
      ]
    },
    {
      "id": "principle-map",
      "url": "https://rangoon.ai/insights/archive-uk-ai-cyber-security-code-january-2025/#principle-map",
      "heading": "Thirteen principles made AI-specific security work visible across a lifecycle",
      "paragraphs": [
        "The Code’s structure names 13 principles: awareness of AI threats; secure design; threat evaluation and risk management; human responsibility; asset protection; secure infrastructure; secure supply chain; documentation of data, models and prompts; testing and evaluation; communication with users and affected entities; updates and patches; monitoring; and data and model disposal. That inventory is important because it reaches beyond a model-only checklist. For example, the secure-design section calls for documented business requirements and associated AI security risks, and for audit trails covering the operation and lifecycle management of models, datasets and prompts. The source establishes what the Code asks organizations to consider. It does not provide a one-size-fits-all technical configuration, a risk tolerance decision, or proof that a control works in a specific deployment."
      ],
      "bullets": [],
      "source_ids": [
        2
      ]
    },
    {
      "id": "guide-examples",
      "url": "https://rangoon.ai/insights/archive-uk-ai-cyber-security-code-january-2025/#guide-examples",
      "heading": "The companion guide translated principles into examples without turning examples into completion evidence",
      "paragraphs": [
        "The 50-page implementation guide gives example measures and controls for the Code’s principles. Its first-principle examples discuss role-tailored training and changing threat knowledge, including data poisoning, adversarial attacks and prompt injection. That gives readers a concrete picture of the intended bridge from a principle to organizational practice. Yet examples are neither an attestation nor a substitute for a threat model, secure architecture review, testing record or incident process for a particular system. The guide itself draws on many cited resources and frames its material as implementation support. A company could copy a training label without demonstrating that its permissions, datasets, model interfaces, supply chain or monitoring path are secure. The event delivered practical guidance; it did not deliver measured assurance results."
      ],
      "bullets": [],
      "source_ids": [
        1,
        3
      ]
    },
    {
      "id": "standards-path",
      "url": "https://rangoon.ai/insights/archive-uk-ai-cyber-security-code-january-2025/#standards-path",
      "heading": "Government described an ETSI path as future standards work, not an instant global standard",
      "paragraphs": [
        "The publication says DSIT and NCSC intended to submit the Code and implementation guide to ETSI for use as a basis for a prospective global standard and accompanying guide, and that government would update its material to mirror the future ETSI work. That is a standards-development statement with a clear state boundary. An intent to submit a code and guide does not mean that ETSI had adopted the final text, issued a conformity scheme or declared compliance by organizations. The January sources also do not quantify implementation uptake, incident reductions or attack resistance. The careful historical record is that the UK placed a voluntary AI-security baseline and implementation resource in public view, while formal standardization and real-world adoption remained later questions requiring their own dated records."
      ],
      "bullets": [],
      "source_ids": [
        1
      ]
    }
  ],
  "project_context": null,
  "related_links": [],
  "permissions_url": "https://rangoon.ai/permissions.txt",
  "content_hash": "sha256:79d04583a5ccd8088a4e3e0b0cebbb418b29a4e5d66aa60f08bef005dea07e0b"
}