techUK/Ofcom Industry Roundtable: Trust and Assurance challenges for AI Cyber Defences

Ofcom is the independent regulator enforcing the Electronic Communications (Security Measures) Regulations 2022 in the telecommunication sector and the Network and Information Systems Regulations 2018 in the digital infrastructure subsector. When the Cyber Security and Resilience Bill passes, we will also be the regulator for the newly created data infrastructure subsector, which includes data centres. 

As AI changes the cyber threat landscape, we are considering how companies will react and how our regulatory supervision might need to be adapted. One area where we foresee challenges for companies adopting AI for cyber defence at pace is trust and assurance. Different types of AI have different trust and assurance limitations that could be, to varying degrees, difficult to reconcile with cyber security principles and any regulations based on them. We therefore want to seek perspectives from across the industry on how trust in AI systems used for cyber security can be justified, using what assurance techniques. 

Potential discussion topics 

Technological solutions and constraints 

What are the technological solutions available right now, and what are the constraints of using them in a telco setting? For example, will the solutions offered by vendors require backhauling or will they work at the edge to avoid latency? 

Uplifting our supervision 

How does industry overcome evidence and verification gaps in AI systems to deliver on internal compliance and regulatory requirements? We could touch on technical and procedural means here, as well as standards we can all coalesce around. 

Current capabilities 

What is the consensus view on where the assurance market is now? If we have time, we could touch on how we expect this to develop in the coming years. 

*Ofcom will not recommend any vendor to the companies we regulate, so please not this is not a session for commercial pitching