Quarterly BAS Due (July–September)
Form 1099-NEC & Contractor Payment Reporting Check
Why this matters.
The UK Department for Science, Innovation and Technology published the AI Cyber Security Code of Practice in January 2025, setting out thirteen principles covering the secure design, development, deployment, maintenance and end-of-life of AI systems. It was developed with the National Cyber Security Centre specifically because general software security guidance doesn’t address AI-specific risks such as data poisoning, prompt injection, model theft, adversarial inputs and unintended behaviour from third-party or fine-tuned models. The Code has since been developed into a global technical standard through the European Telecommunications Standards Institute (published as ETSI TS 104 223), meaning it is rapidly becoming the reference baseline that procurement teams, cyber insurers, and enterprise customers point to when assessing whether a supplier’s AI product or integration is secure.
The Code is voluntary rather than a legal requirement, but that doesn’t make it optional in practice for most UK businesses building, integrating or deploying AI features. It sits alongside the Cyber Security and Resilience Bill’s push to strengthen supply chain security, and businesses selling AI-powered products or services into the public sector, financial services or larger enterprise customers are increasingly being asked to demonstrate alignment with it during procurement and due diligence. Startups and SMEs building on top of third-party large language models, chatbots, or AI-driven decision tools often assume responsibility sits entirely with the model provider — but the Code makes clear that system operators and data custodians integrating AI into their own products carry direct responsibility for secure configuration, access control, monitoring and incident response.
