The UK government has added seven new risks to its National Risk Register, including cyber attacks on data, water and police infrastructure, warning that AI and climate change now demand sustained attention.
The update was published alongside the government's first Annual Statement on National Resilience to Parliament, delivered by chief secretary to the Prime Minister Darren Jones. It follows record heatwaves this year, with the Met Office confirming England's warmest June on record and an estimated 2,750 heat-related deaths across May and June.
The register, the public-facing version of the National Security Risk Assessment, now includes the risk of interference in the UK's democratic process, following measures announced last week tightening checks on company donations and capping overseas donations. A new "digital resilience failure" risk has been added, drawing on lessons from the 2024 CrowdStrike IT outage, while the threat of disruption to Russian gas supplies has been removed, reflecting reduced UK reliance on Russian gas.
Jones told Parliament: "Throughout our history, the UK has overcome challenges from plagues and pandemics to war and our fair share of wet weather. It is right that we consistently evaluate the risks we could face and plan for what may come. This year we saw temperatures across the UK breaking records in May, only to be exceeded again in June, and AI offers new ways for criminals to carry out cyber-attacks against us, as well as offering huge opportunities for our economy and security."
The update lands alongside a wider cyber policy push. In January, the government published the Government Cyber Action Plan, backed by more than £210 million, alongside the Cyber Security and Resilience Bill, extending regulatory obligations to critical suppliers.
The National Cyber Security Centre reported 204 significant cyber incidents to September 2025, more than double 2024's 89, citing attacks on Marks & Spencer, the Co-op and Jaguar Land Rover as examples of how quickly such incidents escalate into business interruption losses.
That backdrop has direct implications for insurers. Munich Re values the UK cyber insurance market at US$1.75 billion in 2025, forecasting growth to US$2 billion in 2026. The PRA is preparing a 2026 consultation on a captive insurance regime for bespoke cyber cover, while wider operational resilience rules take effect from March 2027, the deadline for insurers' third-party risk registers.
The register's property additions land against a similar backdrop. ABI evidence to the House of Lords shows UK insurers paid a record £6.1 billion in property claims in 2025, with subsidence claims alone totalling £153 million in H1. Flood Re, the industry-funded flood scheme, is also under strain: its levy rose from £135 million to £160 million, and its board has warned flood mapping is pushing more high-value properties into its riskiest categories.
The government's resilience campaign, launching later this year, builds on GOV.UK Prepare guidance, bringing the UK in line with European peers. Mayors will take on a formalised emergency response role under a consultation launched today on the Civil Contingencies Act 2004, which underpins insurers' continuity obligations.
Jones confirmed the Home Defence Programme will deliver the largest home defence exercise in decades in 2027, Operation ALBISTON SHADOW, testing preparedness for hybrid attacks. The government said it remains on track to deliver its 2023 Biological Security Strategy by 2028, including a Pandemic Preparedness Strategy backed by around £1 billion.
Minister for the Armed Forces Louise Sandher-Jones MP said: "We increase the chances of conflict by not being ready – fail to prepare, prepare to fail. Today's announcement is a clear demonstration of how we are working across Government, with the military, government departments, agencies, and the whole of society, to strengthen Britain's homeland defence and resilience. Russia is not only a threat to NATO's eastern flank. It is a direct threat to the UK homeland."
For insurers and brokers, the register formalises a risk picture already shaping underwriting: cyber insurers face accumulation risk ahead of the 2027 deadline, property insurers face a strained Flood Re, and the PRA's captive and ILS agenda opens new routes for transferring both exposures to capital markets.
