Westminster Bridge and the Houses of Parliament across the River Thames

Security first, then scale: what the UK's new AI and cyber package means for CIOs

On 24 October 2026, HM Treasury set out a package of AI spending worth more than £600m, to be made part of the Chancellor's Budget. Much of the coverage has focused on the headline items, a new AI Biosecurity Lab and extra money for the AI Security Institute. For IT leaders, though, the more useful story is how tightly the package ties AI adoption to cyber resilience.

The government's own framing makes the point plainly: "The economic opportunities from AI will only be realised if our critical infrastructure, public services and businesses are resilient to cyber, biological and emerging AI-enabled threats." The Chancellor, John Healey, confirmed the plans in a written statement to Parliament on 26 October.

Here is what is in the package for CIOs, and what to do with it.

What was announced

On the security side, the measures most relevant to IT leaders are:

£60m for a National Cyber Shield, which will use agentic AI to improve the UK's cyber defences. It includes a £25m challenge fund for UK AI and cyber security innovators, plus scoping work for a new regulatory sandbox to support the use of agentic cyber security tools across critical national infrastructure, the public sector and industry.
£70m for a new National Exposure and Real-Time Vulnerability (NERV) Centre, which will use AI tools to find cyber vulnerabilities across critical infrastructure and the wider economy.
An extra £120m for the AI Security Institute, for testing new AI systems and developing technical standards.
A further £24m to support "the systematic hardening of the public sector technology estate", according to the written ministerial statement.

On the adoption and capability side, there is:

An extra £60m for the Sovereign AI Fund, including a new focus on physical and industrial AI.
An extra £60m for Sovereign AI's R&D Procurement Scheme, aimed at challenges in health and care and in "AI security, assurance and safe adoption".
£30m to start local AI partnerships with Mayoral Strategic Authorities, bringing councils, businesses, universities and colleges together on AI adoption.
£15m for an AI Challenge Prize, with the first award focused on health.
A new NCSC AI Cyber Security Centre of Excellence in Manchester to train government cyber and AI experts. No figure has been given for this.

Why this matters for IT leaders

Adoption and security are now one conversation

The clearest signal is that government no longer treats AI security as a brake on adoption. It treats it as the thing that makes adoption possible. The package says it "gives investors and innovators confidence to build here, and will help drive adoption across businesses and public services".

For CIOs, that is a useful line to take into the boardroom. If your AI roadmap and your security roadmap sit in separate plans with separate owners, now is a good time to bring them together. The question to answer is not "how fast can we roll out AI?" but "how fast can we roll it out safely, and what do we need in place first?"

Expect more scrutiny of where your technology comes from

There is a strong sovereignty theme running through the package. AI Minister Kanishka Narayan said: "We cannot afford to rely entirely on technology built overseas. By backing British science, advanced chips and our own AI companies, we can strengthen our national security."

That does not mean every organisation will have to buy British. But it does suggest that resilience and dependence on a small number of suppliers will come up more often, especially in the public sector and critical sectors. The £60m R&D Procurement Scheme and the £25m Cyber Shield challenge fund will also bring new UK suppliers into the market. CIOs who keep an eye on these programmes may find useful tools earlier than their peers.

Agentic AI is coming to defence, carefully

The National Cyber Shield builds on a blueprint the NCSC set out in July 2026, which it is developing with the Department for Science, Innovation and Technology. It describes a future where AI agents find weaknesses and defend against threats in real time, working "under the control and authority of their owners".

The regulatory sandbox is the part to watch. If it goes ahead, it should give organisations a safer route to try agentic security tools. In the meantime, the NCSC's advice on agentic AI in general is to walk before you run: start with tightly bounded pilots and low-risk tasks, never give an agent unrestricted access to sensitive data or critical systems, and be clear that humans stay accountable for what it does.

Get ready for a heavier patching load

The NERV Centre is about finding vulnerabilities across the economy faster. That is good news, but it also means more issues will come to light, and more quickly. Back in May, the NCSC warned organisations to prepare for a "vulnerability patch wave" as AI helps attackers exploit years of technical debt. Its advice includes patching external systems first, turning on automatic updates where you can, replacing unsupported technology, and, for larger organisations, getting assurance from commercial and open source supply chains that they are ready to respond.

For a CIO, that is as much a capacity and budget question as a technical one. Change processes, maintenance windows and support contracts all need to be able to handle faster, more frequent updates.

Public sector CIOs have the most to gain

The £24m for hardening the public sector technology estate, the £30m for local AI partnerships and the new Manchester centre of excellence are all aimed at public bodies. If you run IT in local government, health or another public service, it is worth finding out early how this money will be shared out and how to take part.

What we do not know yet

This is a funding announcement, not a set of new rules. The government has not yet published dates, eligibility rules or an application process for the challenge fund. It also has not said how the NERV Centre will work, who will run it, or how it will work with the organisations whose systems it looks at. More detail may follow with the Budget.

Five questions for CIOs this week

Do our AI plans and our security plans have a shared owner and a shared set of priorities?
How dependent are our most important AI and cloud services on a small number of overseas suppliers, and does the board know?
Could we handle a sharp rise in critical patches without breaking our change process?
Which agentic AI pilots are we running, and does each one have clear limits and a named owner?
Who on our team is tracking the challenge fund, the sandbox and the procurement scheme so we can take part when details are published?

The money in this package is modest next to what large organisations spend on technology each year. Its real value is the direction it sets. Government is betting that the UK can only get the benefits of AI if it secures the systems AI runs on. That is a good principle for any IT leader to adopt now.