Dates
Key dates in the NCSC's AI warning
No compliance deadline exists. The dates worth knowing are when the NCSC published its advice and the year its forecast runs to.
Last reviewed against NCSC, SecurityWeek and The Register. Sources
No deadline
Dates, not obligations
None of the NCSC's publications gives organisations a cut-off by which something must be done. The dates below show when guidance appeared and how far ahead the forecast looks.
Reading the dates
What each one tells you
First came the patch wave blog of 1 May 2026, which asked organisations to get ready for a surge in software updates [3]. It arrived roughly six months ahead of the review, so a team that acted on it has a head start.
The annual review covers the year from 1 September 2025 until 31 August 2026, and the agency released it on 3 November 2026 [7]. Its companion assessment looks out to 2028 [2].
How to read 2028
The assessment calls it highly likely that ransomware against essential UK services will use AI-built malware before then, and describes its scenarios as plausible medium-term possibilities, not predictions [2]. Plan now rather than treating 2028 as breathing space.
Next
Use the time
The preparation page turns these dates into an order of work, and a separate note explains what "highly likely" means in the agency's wording.
Keep reading
Read next
What to do
Practical, ordered steps for UK organisations after the NCSC's AI warning: exposure, access, backups, Cyber Essentials, legacy kit and AI use.
Read the guide
Patch wave
The NCSC expects a surge of software fixes as AI speeds up flaw discovery. Its priorities for exposed systems, legacy kit and update policy.
Read the guide
Legacy systems
End-of-life and underfunded technology is the weakness the NCSC says AI will expose. How to find it, rank it and plan its replacement.
Read the guideHow CyPro can help
Need a hand getting ready?
Reading the rules is one job. Mapping them to your organisation, closing the gaps and showing the evidence are several more. CyPro's consultants can take any of them off your plate.
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Get ready
Need to know what this means for you?
The NCSC points operators of essential services to the Cyber Assessment Framework. CyPro can assess how well your organisation meets it and set out the resilience work that matters most.