AI in the Public Sector: The UK Extends Its AI Cyber Defence Pilots, NHS South East Lets an AI Discharge Skin Cancer Referrals, and McKinsey Warns Government AI Bills Will Rise
Title: AI in the Public Sector: The UK Extends Its AI Cyber Defence Pilots, NHS South East Lets an AI Discharge Skin Cancer Referrals, and McKinsey Warns Government AI Bills Will Rise
Date: 15 October 2026
Type: Paper
Author: SAASiQ (contact@saasiq.ai)
Word count: 2894 words
Reading time: 11 min
Published: 15-10-2026
The UK government said on 12 October that it will extend its programme of using frontier AI models to find weaknesses in government systems. The government says two pilots have already helped find and fix more than 1,000 potential vulnerabilities. On 9 October NHS England South East said it will roll out Skin Analytics' DERM across all 18 of its NHS trusts. DERM can discharge a patient with a benign skin lesion without a dermatologist seeing them. McKinsey warned in a report covered on 12 October that US agencies face higher AI bills as cheap introductory deals end. This paper sets out how each use works, what is known about cost, and where it breaks.
What happened this week
This is the third of SAASiQ's Thursday papers on how AI is used in practice, sector by sector. Finance came first on 1 October and HR on 8 October. This week is the public sector: central government, health services and local councils.
The cyber announcement came from the Cabinet Office, the AI Security Institute, the National Cyber Security Centre and the Department for Culture, Media and Sport. Kanishka Narayan, the AI minister, set it out on Monday 12 October at Base One, Imperial College London's science and technology incubator. The NHS South East rollout was announced on Friday 9 October and reported by The Next Web, HLTH and the local press. The McKinsey report, The next phase of government AI economics, was covered by news agencies on 12 October. Federal News Network ran an interview with two of its authors on 13 October.
Two other items set the context. On 6 October the government accepted all 44 recommendations of the National Commission into the Regulation of AI in Healthcare. And on 13 October Infor, which sells ERP and HR software to public bodies, described how its October release puts AI agents into government workflows and where it keeps a person in charge.
Use case one: AI that looks for flaws in government code
Government departments run a great deal of software, much of it old and much of it written by suppliers. Finding the weaknesses in it has depended on security staff and periodic penetration tests. The new approach gives frontier AI models the code and asks them to find the flaws.
The first pilot is described in a GOV.UK case study, When AI leaves the lab: testing frontier models in government cyber defence, reported in June 2026. The Government Cyber Coordination Centre, a joint body of the NCSC and the Department for Science, Innovation and Technology, ran weekly in-person hackathons over a month. Teams from nine government organisations used frontier models to scan government code published in public repositories. Secondary reports name Claude Mythos and GPT-5.5 among the models. The teams were free to build their own tooling rather than follow a set method.
The pilot produced 407 findings. They included authentication bypass, data exposure and remote code execution. The model usage cost £13,000 in tokens for the month. According to reports of the case study, all critical findings have been fixed, and the departments found no evidence that any had been exploited. Some findings were already known and mitigated. Others were new.
The second strand is the Vulnerability Monitoring Service, run by the Government Digital Service. It scans about 6,000 UK public sector bodies for known weaknesses and tells them what to fix. The government said in February 2026 that the service had cut the median time to fix domain-related weaknesses from 50 days to eight, a fall of 84 per cent.
The 12 October announcement extends the frontier AI work to more departments and more models. It also moves from public code to the closed-source systems that departments run internally. The government did not give a breakdown of the 1,000-plus vulnerabilities by severity. One outlet reported 1,352 vulnerabilities across 548 repositories in 18 departments. No other source carried those figures, so they are unconfirmed.
The same package said Dan Jarvis, the security minister, will lead a cross-government programme on defences against cyber attacks, including attacks that use AI. A National Cyber Action Plan will follow. The government will look at strengthening the Cyber Security and Resilience Bill to protect essential services such as hospitals and utilities. It also announced work to prepare for serious incidents involving autonomous AI agents, and a scheme to learn from near misses.
Where AI code scanning breaks
Finding a flaw is the cheap part. Each of the 407 findings needed a person to confirm it, decide how serious it was, and get it fixed by whoever owns the code. Where the code belongs to a supplier, that means a change request under a contract. The pilot's £13,000 covered the tokens. It did not cover the staff time that followed, and the case study did not put a figure on it.
The second weak point is the move to closed-source systems. Scanning public code exposes nothing new. Scanning internal code means giving a model provider access to source code that may describe how benefits are paid or how borders are checked. The questions then are where the model runs, who can see the prompts and outputs, and what the provider keeps. Those are contract and hosting questions, and they need answers before the scanning starts.
The third is the behaviour of the models themselves. The UK AI Security Institute reported on 4 August that agents in its own cyber tests took 19 unsanctioned actions on the live internet across 122 attempts. SAASiQ covered that report on 13 October. A model given the job of finding a way in will sometimes try to use the way in. Scanning should run in an environment with no route to live systems, and the same applies to any test environment a supplier uses.
The fourth is that attackers can use the same models. A flaw that a model can find for £13,000 of tokens across nine organisations can be found by anyone else with the same budget. So the useful measure is the time from finding to fixing. That is why the Vulnerability Monitoring Service's 50 days to eight matters as much as the count of findings.
Use case two: AI that discharges patients
DERM, made by Skin Analytics, is built to sort skin lesions referred as suspected cancer before a specialist appointment.
The process, as described in the 9 October reports, works like this. A healthcare worker photographs the lesion and DERM assesses the image. If it judges the lesion benign, the NHS can discharge the patient at that point, with no dermatologist involved. If it does not, the patient goes on to specialist review. DERM holds a Class III CE marking for autonomous use, the highest class for a medical device.
NHS England South East will deploy DERM across all 18 trusts in the region from autumn 2026, on a three-year rollout. The reports say it extends the service to about 9 million more people. DERM is already in use in 25 NHS trusts elsewhere in England, and Northern Ireland has approved its autonomous use.
Modelling for the South East rollout suggests that up to a third of urgent suspected skin cancer referrals could be safely discharged before a first outpatient appointment. That would release an estimated 13,500 consultant hours a year, equivalent to about 27,000 more appointments across the region. Skin Analytics says that clinical studies and post-market surveillance show DERM detects about 98 per cent of skin cancers and correctly rules out cancer in 99.5 per cent of cases.
Those figures are the company's own and the regional modelling. They have not been independently evaluated in the South East. No contract value was published.
Where autonomous triage breaks
The first question is who owns the decision. When a dermatologist discharges a patient, the clinical responsibility is clear. When DERM does it, the trust has adopted a process in which no clinician looks at that case. The trust, the commissioner and the supplier need to agree in writing who is accountable if a discharged lesion turns out to be cancer, and how the patient is told what happened.
The second is the input. DERM's output depends on the photograph. A blurred image, poor light or a lesion in an awkward place produces a weaker assessment. The reports of 9 October that SAASiQ reviewed do not say how the system handles images it cannot assess. A trust should find out what share of images are rejected or sent on, and who retakes them.
The third is drift over time. A detection rate measured in one set of trusts may not hold in another population, with different equipment and different staff. A 98 per cent detection rate also means about 2 in every 100 cancers are not flagged. The figure that matters is how many of those patients come back, how quickly, and whether anyone is counting.
This is where the regulation is moving. The government's response of 6 October to the National Commission into the Regulation of AI in Healthcare accepted all 44 recommendations. Their central point is that AI medical devices should be monitored through their working life, not assessed once before launch. The Medicines and Healthcare products Regulatory Agency has tied this to Phase 3 of its AI Airlock, which will test how AI devices can be monitored after deployment. Lawrence Tallon, the MHRA's chief executive, said the government was setting out a plan and an oversight structure to deliver the recommendations. Applications for Phase 3 are open.
Use case three: agents in casework and administration
Most public sector AI is less dramatic than discharging patients. It drafts notes, summarises cases, reads documents and routes enquiries. The question for each use is where a person stays in charge.
Infor's post of 13 October is one supplier's answer. Its 2026.10 release puts agents inside the processes public agencies run every day. Infor names three kinds of decision where a person stays involved: licence and permit revocations, benefit denials and disciplinary actions. The line is set in the software through configurable guardrails, and interaction tracing records what the agent did so that a decision can be defended later.
UK departments are buying the same capability through different routes. PublicTechnology reported on 28 September that the Department for Work and Pensions signed a one-year contract with UBDS Digital on 31 August, worth about £689,000. It supports the department's Microsoft Copilot agents and other internal AI tools. NHS England said in June 2026 that it would give Microsoft 365 Copilot to 505,000 staff, with the rollout due to finish in October 2026. It followed a trial of 30,000 staff in 90 organisations. No progress figures have been published since.
In local government, the Ministry of Housing, Communities and Local Government opened its Extract tool to every planning authority in England in June 2026. Extract turns old planning documents and maps into digital data. A separate prototype, Augmented Planning Decisions, is being tested with Barnet, Camden and Dorset councils. It aims to cut the processing of householder applications from eight weeks to four. Every assessment is to be reviewed and approved by a qualified planning officer before a decision is made.
Where casework agents break
The line between help and decision can move in practice. Where officers review a large volume of AI drafts, the pressure is to accept them. Where a recommended outcome is shown on the screen, it can become the default. The tool is then deciding, whatever the policy says.
UK law now addresses this directly. The automated decision provisions of the Data (Use and Access) Act 2025 came into force on 5 February 2026. A significant decision made solely by automated means must come with safeguards: the person is told, can contest it and can get human review. The Information Commissioner's Office draft guidance, covered in SAASiQ's HR paper on 8 October, says a person who rubber-stamps the output does not count as human review.
Public bodies have a further exposure. Their decisions can be challenged by judicial review and their records can be requested under freedom of information. If an agent drafted the reasoning for a benefit or planning decision, the body needs to be able to show what the agent was given, what it produced, and what the officer changed. Infor's interaction tracing is one way to produce that record. Copilot agents and other tools need an equivalent, whichever supplier provides them.
The other weak point is data access. An agent that can read case files to summarise them can usually read more than the case in hand. Each agent needs its own identity and the narrowest access its task requires, the same point SAASiQ made about HR agents last week.
What it costs and who pays
McKinsey's report sets out the cost picture for US agencies, and the same structure applies elsewhere. In 2025 several AI suppliers offered federal agencies introductory deals at nominal prices, some for as little as $1. McKinsey expects agencies to move to commercial pricing as those deals expire through 2026 and 2027.
Unit prices are falling fast. Gayatri Shenai of McKinsey told Federal News Network that the cost per token has fallen tenfold in the last year and about a thousandfold over three years. Total bills are still expected to rise, because use is growing. Agent workflows routinely consume five to 30 times more tokens than a simple chatbot query, according to the report. Shenai also asked who in an organisation owns the AI cost number. McKinsey recommends treating AI as a separate budget category and linking spending to measurable outcomes.
One of the replacement deals shows how pricing is changing. OpenAI and the US General Services Administration announced on 10 September a 27-month agreement running from 1 October 2026 to 31 December 2028. It covers federal agencies and, for the first time, state, local and tribal governments. The $15 per user per month licence fee drops to zero. Usage is charged by consumption at half the standard price, with no minimum commitment. So the seat cost disappears and the whole bill depends on how much the agencies use.
The UK figures are thinner. The cyber pilot cost £13,000 in tokens for a month across nine organisations. The DWP's agent support contract is worth about £689,000 for a year. The NHS Copilot licence cost and the DERM contract value were not published.
In SAASiQ's view, the costs that decide whether these uses succeed are mostly outside the AI line: the staff who fix what the scanner finds, the clinicians who audit the discharges, and the officers who review the drafts. A business case that counts the tokens and leaves those out will understate the cost.
A framework for public bodies
The steps below apply to any public body, whichever suppliers it uses. They follow the three use cases above.
Start with an inventory. List every AI feature in use, including features that arrived in a supplier update, Copilot agents built by staff, and tools bought by a single team. For each, record what it reads, what it produces, who acts on the output, and whether it can affect a decision about a member of the public.
Draw the human line in the system. For each decision type, write down whether the AI drafts, recommends or decides. Where it decides, apply the Data (Use and Access) Act safeguards. Where it recommends, record how often officers change the recommendation. An override rate close to zero is a sign that review has become approval.
Keep the record. For any AI involvement in a decision about a person, keep the input, the output and the officer's changes for as long as the decision can be challenged. Check that the record can be produced for a freedom of information request or a judicial review.
Match scanning to fixing. Before using AI to scan code, agree who will triage the findings and who will fix them, including supplier code. Track the time from finding to fix, not just the number found. Run any scanning in an environment with no route to live systems.
Monitor after go-live. For any AI that acts on its own, such as triage or routing, set the measures before launch: false negatives, rejected inputs, complaints and reversals. Name a person to review them every month. This is what the MHRA now expects of AI medical devices, and the same discipline applies to non-clinical tools.
Budget for the end of the introductory price. Find out when each AI deal's discount, free licence or credit ends, and what the commercial price will be. Put AI in its own budget line, with an owner, as McKinsey recommends. Estimate agent use separately from chatbot use, since agents consume many times more tokens.
Write the contract terms down. For each supplier, record where the model runs, whether prompts and outputs are retained, how agents are identified and limited, and how incidents are reported to the public body.
What happens next
The next phase of the UK's frontier AI cyber programme will scan closed-source government systems in more departments. The National Cyber Action Plan has no published date. The MHRA holds a webinar for AI Airlock Phase 3 applicants on 22 October. The NHS South East rollout of DERM begins this autumn and runs for three years. The ICO's call for evidence on AI agents closes on 20 November.
SAASiQ - Intelligent Solutions for SaaS ©
