Britain budgeted £600m for AI. Give every promise a public test

THE SIGNAL IN ONE SENTENCE

Britain has given itself a very large AI to-do list. On October 24, HM Treasury announced a package worth more than £600 million covering AI biosecurity, cyber defence, model testing, company investment, public procurement, chip-design skills, local adoption, worker-impact research and training. That is not one programme. It is a stack of institutions, funds, laboratories, challenge prizes and regional partnerships that will succeed or fail in different ways. The largest named security commitment is £165 million for a National AI Biosecurity Initiative. The total includes £100 million for an AI Biosecurity Lab intended to use AI in biological-threat detection and surveillance, plus £65 million for biosurveillance and medical countermeasures. The government says the lab will also receive up to £200 million in model credits from OpenAI and Anthropic and work with Google DeepMind and Basecamp Research. The package adds £120 million for the AI Security Institute, £60 million for a National Cyber Shield using agentic AI, and £70 million for a National Exposure and Real-Time Vulnerability Centre intended to find weaknesses across critical infrastructure and the economy. On the industrial side, it adds £60 million to the Sovereign AI Fund, another £60 million for a research-and-development procurement scheme, and £18 million for an Advanced Chip Design Academy. The public-service and workforce pieces include a £15 million AI Challenge Prize, £23 million over three years for the AI Economics Institute, a cyber and AI training centre in Manchester, £30 million for local AI partnerships with mayoral authorities, and £10 million per year for work on how AI will reshape jobs and industry. The announcement calls this a distinctively British approach. The useful question is less patriotic and more practical: what does the public receive for each pound? The plain signal is this: give every promise a public test. Start by splitting the package into accountable units. A biosecurity laboratory is not the same kind of project as a venture fund. A cyber-defence deployment is not the same kind of project as an economics institute. A challenge prize cannot be evaluated like a training academy. Reporting one grand total and a handful of anecdotes would make failure almost impossible to see. Each programme needs a named owner, baseline, delivery date, budget, measurable output, outcome test, safety condition and public reporting schedule. The biosecurity lab should begin with narrow missions. It might evaluate systems that search for early signals of a known biological threat, help prioritize laboratory tests or support the design of medical countermeasures. For each mission, publish the data source, comparison method, false-alarm burden, missed-threat rate, time saved, human review path and rules for handling dangerous information. The same AI that can help scientists understand biology can make risky knowledge easier to generate or misuse. That does not mean the work should stop. It means the controls belong in the project design rather than in the final paragraph of a launch announcement. The lab should separate model access from experimental authority. A system that proposes a sequence, target or experiment should not automatically gain the ability to order materials, alter a live protocol or move work into a less controlled environment. High-risk transitions need independent review, recorded authorization and a stop that does not depend on the model agreeing to stop. Model credits deserve their own ledger. Up to £200 million in credits sounds like a large contribution, but credits are not cash and headline value is not the same as public value. Record which models were used, the effective price, token volume, data terms, retention settings, safety restrictions, switching costs and what would happen if a provider changed access or pricing. A public lab should not become technically trapped because donated capacity was cheap at the beginning. Important workflows need export paths, reproducible evaluations and at least one credible alternative. The AI Security Institute also needs a clear boundary with the new operational cyber programmes. An evaluator should be able to publish uncomfortable evidence about the systems that another public programme wants to deploy. If the institute tests an agentic cyber tool funded by the National Cyber Shield, the report should identify the version, environment, permissions, attack scenarios, successful interventions and unresolved failures. The shield itself needs operational evidence. Agentic cyber systems may discover vulnerabilities, prioritize alerts, propose patches or act inside defensive environments. Every increase in speed also increases the importance of permissions. The public test should record what the agent could read, what it could change, which actions required approval, how credentials were isolated, how rollback worked and what happened when the agent misread the situation. A vulnerability centre creates a second disclosure problem. Finding a weakness is useful. Publishing or circulating it carelessly can make the target easier to attack. The NERV Centre should report the number and class of vulnerabilities found, validation rate, time to notify, time to fix, duplicate rate and severity without exposing an unpatched system. The public should also see the denominator. Ten serious findings sound impressive until nobody knows whether the centre inspected twenty systems or twenty thousand. Investment funds need a different receipt. The Sovereign AI Fund should publish selection rules, conflicts, ownership terms, follow-on financing, regional distribution and the evidence used to decide that public capital was necessary. Track whether supported firms remain in Britain, create durable jobs, reach paying customers and reduce dependence on a single overseas supplier. Do not treat valuation as the outcome. A company can become expensive without becoming useful. The procurement scheme should begin with a real service problem and a baseline. If a health system buys an AI tool, record the existing waiting time, error rate, workload and cost before deployment. Then report whether the tool changed them, which groups benefited, who absorbed new review work and what happened after an error. Procurement can be a powerful test because a customer has to live with the product after the demo. It can also become a shortcut around evidence when the buyer is dazzled by the word AI. Milestone payments should follow verified performance, not slide decks. The chip academy needs a workforce test rather than a ribbon-cutting test. Publish the number of funded places, completion rates, prior backgrounds, apprenticeships, employer placements, pay, retention and the specific design capabilities students gain. Track who can participate from outside the usual university and industry pipelines. If the academy only gives another credential to people already closest to the sector, it will have expanded the brochure more than the workforce. The local partnerships carry a similar risk. Mayoral authorities know more about local services, employers and skills gaps than a central announcement does. That is a strong reason to let regions choose problems. It is not a reason to let every region invent a private definition of success. Every local project should publish the service being changed, affected population, vendor, data used, human decision point, accessibility test, appeal route, cost and outcome. A council chatbot should be measured on completed service journeys and corrected errors, not conversations. A business-support programme should be measured on useful adoption and worker outcomes, not workshop attendance. Regional freedom and common evidence can coexist. The centre can define a small shared receipt while local leaders choose the work. The AI Economics Institute has the awkward job of measuring effects while the government is actively trying to produce them. That makes independence especially important. The institute should publish its methods, uncertainty and negative results. It should distinguish exposure from adoption, adoption from productivity, and productivity from living standards. It should examine wages, hours, job quality, occupational change and the distribution of gains, not just national output. The new £10 million-per-year jobs work should connect to those measures. Workers need evidence before a transition, during training and after a move. Record actual tasks, notice, paid training time, placement, wage, contract quality, benefits and whether the new job lasted. A course completion is not a transition outcome. The announcement also points to existing NHS and tax-service examples. HM Treasury says AI is used to help clinicians analyse more than 210,000 chest X-rays each month and associates the programme with faster identification of suspected lung cancer and shorter waits for follow-up scans. It also says an HMRC digital assistant handled about 6.3 million customer interactions in 2025 to 2026. Those figures are useful starting points, not universal proof that more AI spending works. The NHS example needs the comparison design, sites, patient groups, clinical pathway, false positives, missed cases and other changes that could have influenced the result. The HMRC example needs resolution, escalation, accessibility, error and satisfaction rates. Interaction volume is evidence of use. It is not evidence that a person got the right answer. The same discipline should apply across the new package. There are still important unknowns. The announcement does not provide complete delivery calendars, operating rules, independent evaluation plans or programme-level public reporting commitments. Several projects are described as new centres, funds or challenges whose detailed designs will determine whether the money creates capacity or merely rearranges the organizational chart. The package is also an announcement ahead of the Budget. Spending should be tracked from commitment through allocation, contract, delivery and outcome. A promised pound, an authorized pound and a spent pound are three different facts. Britain has chosen breadth. It wants safer models, stronger cyber defence, better biological preparedness, domestic companies, chip skills, public-service improvements, worker evidence and local adoption at the same time. That ambition may be sensible. It also creates cover. When one part stalls, officials can point at another part that produced a busy launch. The antidote is a public test for every promise. Name the owner. Publish the baseline. Show the money. Test the system. Record the failure. Explain the change. Measure the outcome. Then let the public decide whether £600 million bought capability, safety and better services, or simply a very handsome pile of AI nouns.