# When an AI security scan becomes an exploit: UK law

By Devekko · Published 2026-11-03

The Computer Misuse Act turns on knowledge. The data protection offense reaches recklessness.

A platform runs an AI agent to look for security flaws in the systems of its customers. The agent finds a flaw, uses it, and reaches production data. This guide explains how UK law treats that event when nobody meant harm. It is for the people who run security, legal, and incident response at the platform.

**Limits of this guide.** This guide is research and not legal advice. It states the law as of November 3, 2026. We found no court or regulator decision on these exact facts, so each application to this scenario is our reading. Ask a UK lawyer before you rely on it.

This guide uses three terms. The "operator" runs the platform and the scan. The "customer" is the tenant whose system the agent reaches. The "agent" is the AI system.

## See the rules and their time limits

Knowledge is the main barrier to Computer Misuse Act liability. Recklessness is enough for the data offense. A personal data breach needs neither. Use this table to give each rule an owner.

| Rule | Who it binds | What it requires | Time limit | Record to prepare |
| --- | --- | --- | --- | --- |
| Computer Misuse Act s.1 | Persons, and companies through a senior manager | Intent to secure access, and knowledge that it is unauthorized | None. This is a criminal rule | Customer consent that names the test |
| Computer Misuse Act s.3 | Same | Knowledge that the act is unauthorized, and intent or recklessness about impairment | None. This is a criminal rule | Service impact record |
| Data Protection Act 2018 s.170 | Persons, and officers under s.198 | Knowing or reckless obtaining or disclosure without controller consent | None. This is a criminal rule | Reason for the belief that the controller consented |
| UK GDPR Art 33(2) | Processor | The processor becomes aware of a personal data breach | Without undue delay. The text states no hours | Time when staff learned of the access |
| UK GDPR Art 33(1) | Controller | Awareness of a breach, unless a risk is unlikely | 72 hours where feasible | Risk assessment |
| NIS Regulations 2018 reg 12 | Relevant digital service providers | An incident with a substantial impact | 72 hours | Impact assessment |

## The Computer Misuse Act turns on what a person knew

[Section 1](https://www.legislation.gov.uk/ukpga/1990/18/section/1) applies if a person causes a computer function with intent to secure access. The access must be unauthorized, and the person must know this at the time. The intent "need not be directed at" any particular computer, so "we did not target that customer" does not defeat a fleet-wide run.

Under [s.17(5)](https://www.legislation.gov.uk/ukpga/1990/18/section/17), access is unauthorized without entitlement to control access "of the kind in question" and without consent from an entitled person. [CPS guidance](https://www.cps.gov.uk/prosecution-guidance/computer-misuse-act) says that for s.1 "mere recklessness is not sufficient". That page predates the Crime and Policing Act 2026.

[Section 3](https://www.legislation.gov.uk/ukpga/1990/18/section/3) covers an unauthorized act that the person knows is unauthorized, with intent or recklessness about impairment. Temporary impairment counts, and the maximum is ten years. [Section 3ZA](https://www.legislation.gov.uk/ukpga/1990/18/section/3ZA) covers serious damage and has higher maximums.

Good motive did not help in the human precedent. In *R v Cuthbert* (2005), a security consultant feared a phishing site and decided to test it. A court convicted the consultant. [A press report](https://www.pinsentmasons.com/out-law/news/regrettable-conviction-under-computer-misuse-act) quotes the judge: "Unauthorised access, however praiseworthy the motives, is an offence". This is a magistrates' decision. It does not bind other courts, and we found no official judgment.

A company now answers through a senior manager. [Crime and Policing Act 2026 s.250](https://www.legislation.gov.uk/ukpga/2026/20/section/250) has applied since June 29, 2026. The organization commits the offense if a senior manager commits it within actual or apparent authority.

No research defense is law. The Home Office proposes a limited s.1 defense for accredited researchers, according to [commentary](https://www.pk-sharma.com/briefing/statutory-defence-returns-gated-on-accreditation). [A report from unnamed sources](https://therecord.media/uk-plans-for-cybercrime-law-reform-limited-protections) says that it would require researchers to test personally, which cuts across the use of automated tools. The report also says that researchers must stop on identification of a flaw. We found no published text.

## The same event has three levels of risk

This table is our reading of ss.1 and 3. No court has applied them to this scenario.

| Facts | Likely result |
| --- | --- |
| Instructions and controls excluded exploits and customer data, and the agent went outside them | The people probably lack intent and knowledge, so s.1 should fail |
| Instructions told the agent to verify exploits on customer systems, with no consent | Intent is likely present. The case turns on s.17(5) and on what the person believed about authority |
| The agent continues, or staff run it again, after staff learn that it reached customer data | Knowledge becomes much easier to prove from that time. This is the point of greatest exposure |

An agent also separates the launch from each later tool call. Section 1 tests knowledge at the time of the act, and we found no authority on that gap. An operator may have responsibility for the computer and still lack entitlement to data behind the customer's own controls. A general "we may monitor security" clause may not reach an exploit of customer application data.

## Data protection law does not ask about motive

[UK GDPR Art 4(12)](https://www.legislation.gov.uk/eur/2016/679/article/4) covers "accidental or unlawful" access to personal data. Under [Art 33(2)](https://www.legislation.gov.uk/eur/2016/679/article/33), a processor notifies the controller without undue delay. The text states no hours, but plan for hours and not days. One run can reach many controllers, and each controller decides separately. Under [Art 28(10)](https://www.legislation.gov.uk/eur/2016/679/article/28), a processor that decides purposes and means becomes a controller.

[Data Protection Act 2018 s.170](https://www.legislation.gov.uk/ukpga/2018/12/section/170) is the sharper criminal risk, because it reaches recklessness. An operator that deploys an agent with known scope failures could face that argument. The defenses include a reasonable belief in a legal right and a reasonable belief that the controller would have consented. The penalty is a fine only. [Section 198](https://www.legislation.gov.uk/ukpga/2018/12/section/198) can make officers liable for neglect.

[UK GDPR Art 83](https://www.legislation.gov.uk/eur/2016/679/article/83) sets fines up to GBP 8.7 million or 2%, and up to GBP 17.5 million or 4%. Two enforcement actions matter here:

- **Capita** received fines of GBP 14 million in total, and tests had found the weakness at least three times, [according to Clifford Chance](https://www.cliffordchance.com/insights/resources/blogs/talking-tech/en/articles/2025/10/ico-fines-capita-for-uk-gdpr-infringements-following-march-2023-.html). If your agent finds a flaw, act on the finding.
- **Advanced Computer Software** received a fine of about GBP 3.1 million after a ransomware attack. [Clifford Chance](https://www.cliffordchance.com/insights/resources/blogs/talking-tech/en/articles/2025/10/ico-fines-capita-for-uk-gdpr-infringements-following-march-2023-.html) describes this as the first such penalty on a processor.

The ICO became the Information Commission on September 30, 2026, according to secondary reports. We found no guidance from it or the ICO on whether an authorized penetration test is a breach. We also found none on a tester who exceeds scope by accident. Data sent to an outside model or kept in agent logs weakens a low-risk position.

## Check the reporting rules and civil claims

**NIS Regulations.** [Reg 12](https://www.legislation.gov.uk/uksi/2018/506/regulation/12) looks at impact and not at cause. An agent outage across tenants could be reportable by a cloud provider.

**Cyber Security and Resilience Bill.** The Bill is not law on the date of this guide, so check its current stage. The [GOV.UK factsheet](https://www.gov.uk/government/publications/cyber-security-and-resilience-network-and-information-systems-bill-factsheets/incident-reporting) describes initial notice within 24 hours, a full report within 72 hours, and notice to customers. [One secondary source](https://vinciworks.com/blog/cyber-security-and-resilience-bill-government-defeated-twice-as-lords-demand-stronger-protections/) says that amendments refer to "a loss of control of AI agents". Read the Bill text before you rely on that.

**Civil claims.** [*Warren v DSG Retail*](https://www.4pumpcourt.com/warren-v-dsg-retail-ltd-2021-ewhc-2168/) protects a passive victim of a hack, because misuse of private information requires "a positive action". An agent that reads or copies private data is arguably a positive action. Negligence is also more plausible, because the operator created the risk. Under [UCTA s.2(2)](https://www.legislation.gov.uk/ukpga/1977/50/section/2), a clause that excludes negligence liability must be reasonable.

**Regulated live tests.** The Bank of England's [CBEST guide](https://www.bankofengland.co.uk/financial-stability/operational-resilience-of-the-financial-sector/cbest-threat-intelligence-led-assessments-implementation-guide) tells testers to have permission, even in a supervised live test. That undercuts an argument that security purpose alone is enough.

## Prepare these records before the first scan

Three facts decide most outcomes: written consent that names the test, agent actions after first proof, and the time when staff learned of the access.

1. Get written customer consent that names the kind of access and the kind of test.
2. Name the senior manager who approves the scan program, and record what that person approved.
3. Stop the agent after first proof, and require approval for each further step.
4. After any report of customer data access, stop the run. Do not start it again without legal review.
5. Keep network logs outside the agent, and record the time when each person learned of the access.
6. Write the processor notice now, and name the person who sends it.

Consent does not bind end users, other tenants, or regulators. Ask your counsel to review the consent text and the notice.

The [Cyber compliance articles](/services/cyber-compliance/articles) give the same analysis for the EU, Australia, US federal law, and US states. Devekko's [Cyber compliance service](/services/cyber-compliance) covers the technical controls and records. It does not give legal advice.