6. Dutyholders must manage health and safety risks arising from software-based and digitally connected systems so far as is reasonably practicable.

7. Under the Health and Safety at Work etc. Act 1974, the Management of Health and Safety at Work Regulations 1999 and the Railways and Other Guided Transport Systems (Safety) Regulations 2006 (ROGS) [Health and Safety at Work etc. Act 1974 (HSWA), Management of Health and Safety at Work Regulations 1999 (MHSW), Railways and Other Guided Transport Systems (Safety) Regulations 2006 (ROGS)], digital risks (including the use of Artificial Intelligence and cyber-related safety risks) must be identified, assessed and controlled within a suitable and sufficient SMS, throughout the life cycle of the system.

8. Section 6 of the Health and Safety at Work etc. Act 1974 also imposes duties on anyone who designs, manufactures, imports or supplies an article, for use at work, to ensure that can be used safely. An “article for use at work” is defined in s53(1) of the Health and Safety at Work Act as (a) any plant designed for use or operation (whether exclusively or not) by persons at work, and (b) any article designed for use as a component in any such plant.

9. The Network and Information Systems Regulations 2018 (NIS) imposes duties on Operators of Essential Services to take appropriate measures to prevent and minimise incidents affecting their systems, for which the Department for Transport (DfT) is the Competent Authority.  DfT has sole authority and responsibility for regulatory decisions under the NIS regime. Where cyber security failures create health and safety risk, ORR will regulate those risks under health and safety law.