cyber.hendryadrian.com
Security News · keplernewsletter.substack.com

NCSC Sets Out Agentic AI Safeguards as Privacy and Security Rules Shift

· Original article ↗

Summary

A newsletter roundup covers NCSC guidance for securing agentic AI, new and proposed U.S. privacy and surveillance laws, child-safety requirements, data-broker enforcement, and joint agency advice on outage communications.

Key points

  • The UK NCSC recommends limiting agent autonomy, using sandboxing and least-privilege identities, monitoring activity, and maintaining emergency shutdown capabilities.
  • Delaware amended its privacy law to expand coverage and sensitive-data rules, and require contracts and due diligence for third parties receiving personal data.
  • A U.S. House-passed bill would set limits and judicial requirements for government nondisclosure orders, with customer notification after orders expire.
  • California’s SB 690, awaiting the governor’s action, would restrict private lawsuits over certain website-tracking claims under CIPA; SB 574 would set rules for generative AI use by lawyers and arbitrators.
  • California’s privacy agency warned data brokers that inaccurate registry disclosures can create enforcement exposure.
  • New Jersey enacted an age-appropriate design code requiring covered online services to adopt child-protective privacy settings and other safeguards.
  • Cyber agencies from five countries issued guidance urging service providers to plan outage communications, distinguish confirmed facts from unknowns, and coordinate disclosures during cyber incidents.

Article Details

Event Type
Cybersecurity guidance and privacy, AI, and online-safety legislation and regulatory developments.
Impact
The NCSC guidance recommends stronger controls for agentic AI, including sandboxing, least-privilege access, monitoring, human oversight, and emergency shutdown capabilities. Joint agency guidance sets out outage-communication practices for service providers. The legislation and regulatory developments described introduce or propose new privacy, data-broker, website-tracking, legal-AI, and child-safety obligations, with potential enforcement and liability consequences for covered organizations.

People

Gavin NewsomCalifornia Governor to whom SB 690 was presented for action.Matt MeyerDelaware Governor who signed House Bill 380.Mikie SherrillNew Jersey Governor who signed A4015/S3413, the New Jersey Kids Code Act.

Products

Delete Request and Opt-Out Platform (DROP)Since January 2026, registered data brokers must also establish an account with the Delete Request and Opt-Out Platform (DROP) to process deletion requests submitted through California’s centralized mechanism.

Countries

AustraliaCanadaNew Zealand2, 2026, CISA, the FBI, the Australian Cyber Security Centre, the Canadian Centre for Cyber Security, New Zealand’s NCSC and the U.K. NCSC published joint guidance on how service providers should communicate duringUnited KingdomThe UK National Cyber Security Centre (NCSC) has published interim practical guidance for organizations deploying agentic AI systems, focusing on the risks created when autonomous agents act outside their intendedUnited StatesThe U.S. House of Representatives passed H.R. 6048, the NDO Fairness Act of 2025, on August 31, 2026. The bill would amend the Stored Communications Act rules governing nondisclosure orders that prevent electronic

Industries

Critical infrastructureand operational technology outages. The guidance is aimed particularly at providers supporting critical infrastructure and emphasizes that incident communications should be treated as part of operational responseData brokerageLegal servicesTechnologyan attorney from “delegating the practice of law” to generative AI. Attorneys could still use the technology as an assistive tool, but would remain subject to their duties of competence and diligence.