Internet Explorer 11 (IE11) is not supported. For the best experience please open using Chrome, Firefox, Safari or MS Edge

Article Insight

AI in the public sector New NCSC cyber security guidance

Insights Public Law 16 Sep 2026 4 min read

Public sector organisations adopting AI may expose sensitive data and critical services if cyber security is not built into the technology throughout its lifecycle. New NCSC guidance provides a practical framework for managing these risks, from initial design through to decommissioning. Our Public, Regulatory & Investigations and Artificial Intelligence teams examine the measures organisations should consider when deploying and managing AI systems.

What you need to know

  • The NCSC has published an AI Cyber Security Risk Assessment along with guidelines to support the secure adoption of AI across the public sector.
  • Organisations should take a whole-lifecycle approach to AI cyber security across five stages: design, development, deployment, maintenance and end-of-life.
  • These publications sit within a broader package of support, complementing the Department for Public Expenditure, Infrastructure, Public Service Reform and Digitalisation's Guidelines for the Responsible Use of AI in the Public Service.

Introduction

The National Cyber Security Centre (NCSC) has published two companion documents for public sector organisations deploying artificial intelligence (AI):

  1. The NCSC AI Cyber Security Risk Assessment, which maps the threat landscape, and
  2. An accompanying guidance document “Securing AI Adoption in the Public Sector”, which translates those findings into practical guidelines.

Both documents are firmly supportive of AI adoption. They acknowledge, however, that AI fundamentally alters an organisation’s cyber security risk profile. The guidelines are advisory rather than mandatory and are designed to give organisations a proportionate framework for deploying AI securely, in compliance with their regulatory obligations.

Design

At the design stage, the NCSC identifies four key risk areas:

  1. The absence of a comprehensive AI threat model
  2. Unclear governance and accountability structures
  3. Unmanaged use of third-party AI-enabled tools, and
  4. Inadequate security requirements in procurement processes.

The first principle calls for security to be embedded from the outset. Specific recommendations include establishing human oversight mechanisms and “human-in-the-loop” controls where the risk profile demands it. It also recommends that organisations complete a Data Protection Impact Assessment and rigorously evaluate vendors on data handling, data residency and incident notification before any procurement decision is made.

Development

The development stage introduces risks relating to data collection, model building and supply chain vulnerabilities, particularly unvetted third-party components, which could compromise system integrity. Additionally, failure to adequately secure the training environment may expose a model to data poisoning. The concept of data poisoning relates to the deliberate corruption of training data to skew model outputs.

The NCSC’s guidelines call for full visibility and control over all system components, including AI-specific assets such as training data, prompts and models. Supply chain assurance requires that every external component is identified, traceable and vetted. Training environments must be segregated from production systems, and all data pipelines should be secured against injection or poisoning attacks.

Deployment

Unlike traditional software, AI systems produce probabilistic outputs that can behave unexpectedly. Organisations must therefore ensure that systems are subject to robust testing before deployment. Clear performance benchmarks and readiness criteria must be set in advance. Roll-back and fail-safe mechanisms should also be defined and tested to ensure that systems can be safely deactivated if a system behaves unexpectedly.

The NCSC identifies three pillars of accountability which all deployers of AI systems should keep in mind:

  1. Human oversight
  2. Explainability, and
  3. Transparent communication with users.

Nominated personnel must have the authority to review, override or suspend system decisions. Exposed user interfaces and AI application programming interfaces (APIs), weak identity and access management, and insecure integration and networking are all identified as deployment-stage risks that must be addressed before systems go live.

Maintenance

The maintenance stage carries four distinct risk categories:

  1. Limited AI-specific monitoring
  2. Slow patching that prolongs exposure to known vulnerabilities
  3. Unintended or inappropriate model outputs, and
  4. Data leakage.

Dedicated response plans should be prepared for each category of risk.

Models can also “drift” from their original performance over time, either due to changing data or adversarial techniques not present during initial testing. Continuous monitoring with defined alert thresholds is essential to detect drift and respond rapidly. Organisations should actively monitor for the use of “shadow AI” and verify that staff are employing sanctioned AI tools. Security patches should be tested in an isolated environment before deployment, and third-party dependencies retested whenever the dependency itself is updated.

End-of-life

Decommissioning an AI system requires the same rigour as operating one. Orphaned assets, such as model weights, training datasets, logs, outputs, system prompts and configuration files, can become vectors for data leakage or unauthorised access if not properly disposed of.

Organisations should follow a formal decommissioning plan that covers secure deletion or archiving of all AI-specific artefacts, revocation of all credentials and API keys, and notification to affected users. Data owners must be actively involved, and third-party vendors should be required to confirm the deletion of artefacts from their own systems. A final residual risk assessment and clean audit trail should close out the process.

Comment

The NCSC’s publications make clear that AI cyber security is a continuous commitment, not a one-time exercise. A compromise at any stage of the AI lifecycle could jeopardise the entire system.

As AI adoption accelerates across the public sector, organisations should act now to establish governance frameworks, identify assets at risk and integrate AI security into existing cyber security processes.

Organisations should read the NCSC’s risk assessment and guidelines alongside DPER’s Guidelines for the Responsible Use of AI in the Public Service, which together form a coherent package on the safe deployment of AI. We can assist organisations in navigating these requirements and assessing how the guidance applies to their specific AI deployments.

Contact our team

The content of this article is provided for information purposes only and does not constitute legal or other advice.

People also ask

Shadow AI refers to ungoverned use of AI tools by individual staff members, and respondents to the NCSC’s survey identified it as a current concern. It reflects the gap between the pace of AI adoption and the pace at which governance frameworks are being put in place.

The EU AI Act distinguishes between “providers” and “deployers” of AI, imposing less onerous obligations on the latter. “Provider” refers to those developing AI systems or models and placing them on the EU market. People, companies, agencies or public bodies who merely use an AI system in a professional context will qualify as a “deployer” of that AI system. The majority of public organisations who use AI in the performance of their functions will qualify as “deployers”.

Agentic AI refers to advanced AI systems that can operate independently to achieve specific goals with limited human intervention. Their deployment can result in substantial efficiency gains. However, their autonomous nature can give rise to cyber security risks where AI agents are deployed in the absence of robust safeguards.

Related Content

View All →