Dates
Key dates in the NCSC's AI warning
There is no compliance deadline attached to this warning. The dates below mark when advice was issued and the year the NCSC is looking towards.
Last reviewed against National Cyber Security Centre, SecurityWeek and Cyber Security News. Sources
Advice, not a deadline
How to read the dates
Nothing in the sources we read sets a date by which organisations must act, or creates a new legal duty [1]. The dates are a record of when guidance and funding appeared, and the year the NCSC is planning around.
The review itself covers 1 September 2025 to 31 August 2026, the NCSC's tenth year as part of GCHQ [3]. Its incident figures describe that period, so do not compare them directly with calendar-year numbers from elsewhere.
The horizon
Why 2028
The NCSC's assessment looks ahead to 2028 and sets out three scenarios: a baseline of rising global threat, a pessimistic one in which proliferation outstrips defence, and an optimistic one in which development slows [2]. It describes them as plausible possibilities rather than predictions, and says the potential for surprise is high [2].
Treat 2028 as a planning horizon
The forecast concerns attacks on critical infrastructure between now and 2028 [9]. Your own patching and recovery plans should not wait for the end of it.
Related
Plan around the dates
The funding announced the week before the review is covered in what the government is funding. For steps to take now, go to what to do.
Key dates
The dates that matter
1 May 2026
NCSC publishes its advice on preparing for a vulnerability patch wave[4]
24 October 2026
Government announces funding for the Cyber Shield, a vulnerability centre and an AI security unit[8]
3 November 2026
NCSC publishes its Annual Review 2026 and its assessment of AI and cyber intrusion[3]
2028
End of the period in which AI-powered malware is highly likely to feature in a ransomware attack on UK critical infrastructure[2]
Keep reading
Read next
What to do
A practical order of work for UK organisations preparing for AI-assisted ransomware, based on the NCSC's advice. Start with what you expose.
Read the guide
AI ransomware
What the NCSC says about AI-powered malware in ransomware attacks on UK critical infrastructure, what is a forecast and what has been observed.
Read the guide
The assessment
The NCSC's four key judgements and three scenarios for AI and cyber intrusion to 2028, summarised for UK security and risk leads.
Read the guideHow CyPro can help
Need a hand getting ready?
Reading the rules is one job. Mapping them to your organisation, closing the gaps and showing the evidence are several more. CyPro's consultants can take any of them off your plate.
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Get ready
Need to know what this means for you?
The NCSC expects ransomware to get faster and cheaper to run. CyPro can help you plan and rehearse your response before an attack and take charge of containment and recovery if one happens.