Cyber Security and Resilience (Network and Information Systems) Bill
15 Jun 2026 · Commons Chamber · 180 speeches · Official record
Commons debate API. Not a paper. A named member links to their Institrace record when we hold that seat.
Does the hon. Member agree that, given that Transport for London now has 500 Chinese buses ordered and on the streets of London, there is a glaring opportunity for huge embarrassment to this nation if those kill switches were ever used on the buses in our capital city? Full speech
I am happy to the write to the Chair of the Select Committee about comparisons with the EU, but the broad thrust is that we have undertaken a specific analysis of whether the burdens of the Bill should apply in a systematic, proportionate and coherent way to sectors. The analysis suggests that food supply is not in scope for the reasons I mentioned-primarily diversity of supply-but I would be delighted to engage with him on the question of why Europe took a different decision. We have based our ... Full speech
Speaker
within the meaning of the NIS Regulations. Full speech
I start by echoing the thoughts of many Members from across the House, particularly my hon. Friends the Members for Leeds Central and Headingley (Alex Sobel) and for Cowdenbeath and Kirkcaldy (Melanie Ward). I did not know Jo Cox, but I admired her deeply. As we talk about our country’s resilience, her central message-that there is no deeper route to resilience than through the unity of our country and community-is top of our minds for all of us in this House. It is a pleasure to bring this impo... Full speech
Speaker
(dc) assessing the implementation of measures taken under regulation 12 or 14B to manage risks and to prevent and minimise the impact of incidents, including as a result of any inspection conducted under regulation 16; Full speech
I am not quite certain that I understand the Minister’s reasons for why he cannot accept my amendment, tweak it or work with it in the other place. The reality is that with this Bill, we are opening the door in a way that we would not have otherwise done to the use of information that may predicate a failure for some British citizen sitting in a country where the rule of law does not protect them in the courts. The Government are taking a risk of making it worse, not better. While the Minister a... Full speech
I thank all my hon. Friends and all hon. Members who have contributed to what has been a really good and well-meaning debate. People will be relieved to know that I intend to keep my contribution fairly brief. I say to the right hon. Member for Chingford and Woodford Green (Sir Iain Duncan Smith) that I do not pretend to be an expert when it comes to cyber-security and resilience, although other Members across the House would say that that has never stopped me talking before. It was a pleasure t... Full speech
I refer Members to my registered interest as parliamentary chair of the Campaign for Secure Technology, which I thank for its work in preparing my two amendments as well as my speech. I echo the comments of my hon. Friends the Members for Leeds Central and Headingley (Alex Sobel) and for Newcastle upon Tyne Central and West (Dame Chi Onwurah) about the scale of the threat that we face from cyber-attack. We must ensure that we are having that national conversation about the nature of the threats ... Full speech
It is always a great honour to follow the hon. Member for Newcastle upon Tyne Central and West (Dame Chi Onwurah), who talks common sense most of the time she gets up, which may be one of the reasons why she is still on the Back Benches. If we listened more to those who know something about things, rather than talking as though we know things, and saying things that are invariably wrong, we in Parliament would obviously be better off. The greatest threat we face is that bad actors out there are ... Full speech
I do not want any part of the UK to be subject to the awful AI Act that has been passed by the European Union. Northern Ireland, and particularly Belfast, is a technological powerhouse of which we should be very proud. We need to ensure that it continues to go from strength to strength as part of our fantastic Union. We on the Conservative Benches will not back new clause 13, because we understand how markets and global supply chains work. We believe in Britain. Full speech
Speaker
Sharing and use of information under the NIS Regulations etc Full speech
Speaker
(4) In this section, ‘foreign power’ means- Full speech
I thank the hon. Member for his intervention. I absolutely agree. Across the United Kingdom, including in Northern Ireland, there are incredible British tech firms. Many of them have said to me that their services are being procured by other Governments in Europe and around the world, yet they find their own British Government not using them or getting the value out of that British technology here by developing skills and jobs. The Liberal Democrats welcome the Government’s hardware strategy, an... Full speech
I beg to move, That the clause be read a Second time. Full speech
I refer the hon. Member to her new clause 13, particularly subsection 3(c), which makes it very clear that companies would need to deviate from “foreign technologies”, which would be quite a burden. We need to back Britain in key sectors, from quantum and photonics to chip design and innovation. In so many areas, we lead the world. We should not try to restrict the influence and access of global markets. We must engage not in protectionism, but in leverage, to back Britain and position ourselves... Full speech
Speaker
This new clause would require the Secretary of State to establish a cyber security support service for relevant SMEs. Full speech
Speaker
“(1) For the purposes of informing action taken under Part 4 of this Act, the Secretary of State must by regulations, and within six months of the passing of this Act, establish and subsequently maintain a register of foreign powers that the Secretary of State believes present a risk to the United Kingdom’s critical network and information systems. Full speech
Speaker
(3) Regulations under this section are subject to the affirmative resolution procedure. Full speech
Speaker
Consideration of Bill, as amended in the Public Bill Committee Full speech
Speaker
We are pleased that the Science, Innovation and Technology Committee has called on the Government to exercise the break clause in that contract. We call on the Government to use the break clause and provide a clear timeline for Palantir’s removal from the NHS. Even Karp and Zamiska-from Palantir-said: Full speech
Speaker
“The limits of soft power, of soaring rhetoric alone, have been exposed. The ability of free and democratic societies to prevail requires something more than moral appeal. It requires hard power, and hard power in this century will be built on software.” Full speech
Speaker
Let us now look at Anthropic. Last week, it launched its new AI model, Claude Fable 5. Almost as soon as it was launched, the US Government intervened and shut it down for foreign nationals both inside and outside the country. Let me put that more clearly: Anthropic closed access to its tools under the direction of the US Government. This is a wake-up call. Our reliance on the technology that fuels our economy and underpins our services shows that we desperately need a sovereign digital strategy... Full speech
Speaker
Crucially, this is about backing British tech as well as working internationally. Collaborative sovereignty would make us stronger partners globally. That is why we have tabled new clause 13-I urge the House to vote for it-which would require the Government to establish a digital sovereignty strategy that sets out clearly how Ministers will assess, manage and mitigate risks to the security and resilience of our critical systems and place British tech procurement at its centre. Full speech
Speaker
Common internet of things modules, or IOTs, are widely embedded across telecommunications and other critical national infrastructure, as well as in consumer products. In telecoms, CIMs-cellular IOT modules-underpin interoperability, monitoring, configuration and automation in complex multi-vendor networks, including those supporting cellular IOT at scale. Full speech
Speaker
Although CIMs do not directly control networks, dependence on foreign-manufactured CIM-enabled software and tooling poses risks to resilience, security and sovereignty. Chinese attempts to corner the global market in CIMs could have significant national security implications. When they are embedded in cars, they transmit the location, the route and even passenger video. I hope that I need not elaborate on the implications of their being switched off or turned to hostile uses. Full speech
Speaker
Mr Cornelius’s trial proceedings were marked by violations of his right to a fair trial. He was not provided with an interpreter and could not understand the proceedings, while the appointed lawyer did not speak English, rendering effective communication impossible. In 2011, Mr Cornelius was convicted and sentenced to 10 years’ imprisonment and ordered to pay $1 billion in penalties. He served the full sentence, without the routine reduction for good behaviour despite being a model prisoner, fur... Full speech
Speaker
I want to touch on Jagtar Singh Johal, who is detained in India. He is a British Sikh activist who has been held without trial in India for eight years. The United Nations says he is being held Full speech
Speaker
This is the problem again; it is another example of somebody in a country that we seek to have alliances with who is not facing a fair and reasonable process under the law. That is the point that amendment 3 makes. Full speech
Speaker
I want to praise one particular character-one person who I think should at least suggest that the Government vote for the amendment. While still Leader of the Opposition, the right hon. and learned Member for Holborn and St Pancras (Keir Starmer) wrote both to Boris Johnson and to my right hon. Friend the Member for Richmond and Northallerton (Rishi Sunak), calling on them to officially request Jagtar’s immediate release. In that letter, he made it clear that Jagtar’s detention was arbitrary and... Full speech
Speaker
I bow before the ex-head of the Crown Prosecution Service in the United Kingdom. Full speech
Speaker
The point being made through those specific cases is made for a wider set of cases through amendment 3. I wish the Government would accept the amendment rather than our having to put it to a vote, but I think it is necessary for us to do so in order to make this point. Too often we co-operate, rather lazily at times, with Administrations in foreign countries that we know will never give a fair trial to a British citizen sitting in their courts-in fact, they do not have a fair trial for many of t... Full speech
Speaker
“on discriminatory grounds, owing to his status as a human rights defender and based on his political activism, religious faith and opinions”. Full speech
Speaker
“gravely mistreated, with no legal basis”. Full speech
Speaker
Given the importance of data centres, and the speed of development of AI systems, should the Secretary of State not hold last-resort powers to hit the kill switch-the big red button-to direct a shutdown of data centres or AI systems deployed at significant scale, in the event of an AI security or operational emergency? Such powers would be strictly reserved for catastrophic risk scenarios, which are defined in line with the national risk register’s high impact threshold. It is a significant deci... Full speech
Speaker
New clause 12, entitled “‘Last-resort’ powers in respect of data centres and AI models”, would ensure that the Government could intervene in the case of an emergency caused by Full speech
Speaker
that can cause large-scale harm. It is well recognised that today the UK finds itself in a new threat landscape, which poses unprecedented security challenges. As per the strategic defence review, we face threats that are Full speech
Speaker
Cyber-attacks are now a daily reality and, as colleagues have said, the real-world costs are substantial. Full speech
Speaker
The 2024 NHS Synnovis ransomware attack disrupted over 11,000 out-patient appointments, with a direct cost of at least £32.7 million. We have moved on at speed with data centres and AI models since 2024, and the risks become exponential as innovation in the sector charges on. More recently, AI models such as Claude Mythos showcased unprecedented autonomous cyber-hacking and cyber-offensive capabilities, to the point that it was not released publicly. Full speech
Speaker
If implemented, the new clause would require data centre operators to maintain technical infrastructure, secure communications, and hold “regular emergency exercises” to ensure that powers can be used quickly and effectively. It would also mandate regular parliamentary reports on the causes and potential causes of AI security emergencies, including adversarial and non-state actor use and autonomous cyber-attack capabilities-we are seeing growing evidence of those, which could lead to tragic cons... Full speech
Speaker
The new clause would bake in robust checks and balances to constrain Government overreach. It would require parliamentary reporting within seven days of any direction, followed by a debate in each House at the earliest opportunity. It would require a High Court review, so that any operator served with a direction has an immediate right to apply for relief, with the Court empowered to confirm, vary, cancel or award compensation. There would be post-incident accountability, with incident reporting... Full speech
Speaker
The cost of inaction vastly outweighs the compliance burden, as a single major AI-driven cyber-incident could dwarf the total cost of implementing those powers across all affected operators. Last-resort kill-switch powers for AI systems and data centres underpin the overall concept of cyber-resilience-the final backstop. The UK must remain proactive rather than reactive, and we need to be ready in these unprecedented times. As AI companies race towards superintelligence, it becomes ever more imp... Full speech
Speaker
I also wish to mention amendment 3, tabled by the right hon. Member for Chingford and Woodford Green (Sir Iain Duncan Smith). If a country cannot guarantee a fair trial, how can we think that, for any reason and at any time, we could disclose data that could result in an unfair conviction? That undermines our whole idea, and today of all days I cannot imagine why we would not enact something to protect the rights of our citizens when abroad. Full speech
Speaker
“AI systems used or deployed by a data centre” Full speech
Speaker
“more serious and less predictable than at any time since the cold war.” Full speech
Speaker
The threats that cyber-attacks pose increase every year and the nature of the cyber-threats we face is continually developing. Last year, the UK faced 204 nationally significant cyber-incidents, attacks which threaten large organisations, local and central government or our other essential services. That represents an increase of more than double compared with 2024. The attacks are speeding up, and so must regulation. I am glad that the Bill brings data centres into the scope of network and info... Full speech
Speaker
Current NIS regulations are limited to sectors deemed critical in 2016, a year after OpenAI was founded and five years before the foundation of Anthropic. It is high time that our cyber-security regulations caught up with the pace of threats, including those from Russia, who are already seriously targeting our country, as we have learned more about just this week. But this is where I believe we need to go further, particularly in limiting the threat posed by AI to our cyber-security and our crit... Full speech
Speaker
I will focus my speech on UK data centres and the scope to maintain cyber-defences around them in the Bill. AI has the power to bring enormous benefits to our society and economy, from healthcare to productivity. AI growth will rely on having the right infrastructure to support it. Of course, this means the installation of data centres across our country. These data centres should be located in appropriate places, making use of former industrial sites and brownfield land wherever possible, in lo... Full speech
Speaker
My constituents in Auchtertool are right to state that the fields beside their village are not an appropriate setting for a large data centre, as is currently proposed. In Scotland, there have been no changes to planning law to take account of the advent of data centres and the resources that they require. I hope that the Scottish Government will recognise this and rapidly change planning law so that villages like Auchtertool are not put in this situation. Full speech
Speaker
Residents in Auchtertool are also right in their concern that Fife council does not, at this stage, appear to be taking full account of the environmental impact of a huge data centre like this, and that is why I have challenged this with the council. Scottish law must be brought up to date, as has already been done in other parts of the UK. We have an abundance of former industrial sites in Scotland and in Fife, which would be much more appropriate locations for such infrastructure. Full speech
Speaker
AI will do incredible things while transforming society, and there is no point in anyone denying that or trying to turn back the clock. Indeed it is incumbent upon us to ensure that the UK is a world leader in AI and the good that it can do, and I know the Minister will agree with that. However, the pace at which the technology is developing and the pace at which safety regulation is developing are vastly different. Full speech
Speaker
Powerful models, like Anthropic’s Mythos, are redefining the cyber-security landscape with potentially catastrophic effects for our critical national infrastructure. Mythos has exposed previously undiscovered flaws in every major operating system and every major web browser, putting at risk our social and economic security. In the past week alone, the Trump Administration, not exactly known for its heavy handedness in regulating the tech sector, imposed an export control directive on Anthropic’s... Full speech
Speaker
Similarly, as the race quickens to AI superintelligence, where the capabilities of AI models surpass the capabilities of any human, it is crucial that we have control over our data systems as well as over AI more widely. For all our history, humans have been the most intelligent beings on this planet, yet superintelligence means that AI systems could begin acting outside our control and in ways that are currently beyond our understanding. That will have extremely dangerous consequences for human... Full speech
Speaker
We must be able to switch off those systems if we need to, but currently we cannot. That is clearly unacceptable and must change. That is why I am speaking in support of new clause 12, in the name of my hon. Friend the Member for Leeds Central and Headingley (Alex Sobel). The new clause would provide the Secretary of State with a kill switch on data centres in case of a “catastrophic risk” posed by a UK data centre-the national risk register’s most serious level of risk. Full speech
Speaker
The Government must have control over data centres in the UK. The innovation in AI is spectacular, but all too often its developers live in a world of their own, without Government regulation. That is the case particularly in the United States, where they have been given carte blanche to press ahead with AI development despite any security risks. Full speech
Speaker
This week, I was proud to see our Labour Government announce a ban on under-16s accessing social media, which many of us have campaigned for since we were elected to this place. Many of my constituents across Cowdenbeath and Kirkcaldy, especially teachers and parents, have told me that they want that to happen, but the complexity in implementing the ban shows how hard it is to use rearguard action to regulate a technology that should have had more attention over a decade ago. While social media ... Full speech
Speaker
Register of foreign powers for the purposes of Part 4 Full speech
Speaker
Question put, That the clause be read a Second time. Full speech
Speaker
Amendments made: 7, page 38, line 33, leave out first “and” and insert “or”. Full speech
Speaker
Amendment 8, page 38, line 35, leave out “and” and insert “or”. Full speech
Speaker
Amendment 9, page 39, leave out lines 15 to 17. Full speech
Speaker
Amendment 10, page 39, line 42, leave out from “paragraph (1)” to end of line 2 on page 40. Full speech
Speaker
Amendment 11, page 40, line 12, leave out “(1)(c)” and insert “(1)(b)”. Full speech
Speaker
Amendment 12, page 40, line 24, leave out from “regulation 6(1)” to “, or” in line 26. Full speech
Speaker
Amendment 13, page 40, line 31, leave out from “regulation 6(1)” to end of line 33. Full speech
Speaker
Amendment 14, page 41, line 4, at end insert- Full speech
Speaker
Amendment proposed : 3, page 41, line 15, at end insert- Full speech
Speaker
Question put, That the amendment be made. Full speech
Speaker
Amendment made: 15, page 41, line 23, at end insert- Full speech
Speaker
Amendments made: 16, page 44, line 15, at end insert- Full speech
Speaker
Amendment 17, page 44, line 28, at end insert- Full speech
Speaker
Amendments made: 18, page 82, line 16, leave out “or notice” and insert “, notice, notification or decision”. Full speech
Speaker
Amendment 19, page 82, line 20, at end insert- Full speech
Speaker
Amendment 20, page 82, line 22, leave out “or notice” and insert “, notice, notification or decision”. Full speech
Speaker
Amendment 21, page 82, line 23, leave out “or notice” and insert “, notice, notification or decision”. Full speech
Speaker
Amendment 22, page 82, line 25, leave out “or notice” and insert “, notice, notification or decision”. Full speech
Speaker
Amendment 23, page 82, line 28, leave out “or notice” and insert “, notice, notification or decision”. Full speech
Speaker
Amendment 24, page 83, line 5, leave out “or notice” and insert “, notice, notification or decision”. Full speech
Speaker
Amendment 25, page 83, line 14, leave out “or notice” and insert “, notice, notification or decision”. Full speech
Speaker
Amendment 26, page 83, line 17, leave out “or notice” and insert “, notice, notification or decision”.- (Kanishka Narayan.) Full speech
Speaker
Amendment made: 27, page 90, line 3, after “sub-paragraph (e)” insert Full speech
Speaker
(3) A support service established under this section must provide- Full speech
I thank the hon. Member for his question. That is why we need a strategy-we need to be clear about the Government’s priorities. On procurement, we have heard from the National Audit Office that cost is often a priority, but at what cost? When the Government are looking for suppliers, what do we value? There must be a strategy for that, and we need to have that conversation so that the direction is clear, whether on hardware or software. Working internationally is vital, but it is also important ... Full speech
Speaker
This amendment is consequential on amendment 14. Full speech
Speaker
(a) the receiving jurisdiction is one in which the right to a fair trial cannot be guaranteed, or Full speech
It is rare for me to have a point of divergence with the Chair of the Select Committee, given her experience and expertise. However, on that question I am absolutely not saying that Government support is limited only to the certain number of sectors covered by the Bill. There are a range of other ways in which the Government act to support sectors outside of the scope of the Bill. That is the right thing to do. The scope of this Bill-the only Bill horizontally applicable to large parts of the ec... Full speech
I am going to make some progress but will try to come back to the Chair of the Select Committee shortly. The Government’s cyber action plan is the overarching strategy to raise public sector standards across Government, including local government. The Ministry of Housing, Communities and Local Government has taken action to strengthen local authorities’ cyber-resilience, backed by £29 million of cyber grant funding, technical support and the adoption of the cyber assessment framework for local g... Full speech
It is about our security, our cyber-security and our resilience. Within a three-mile radius of Belfast, we have some of the best cyber-security resilience in the whole of the United Kingdom. It is about those 2,750 employees and the £258 million of direct gross value added. Does the hon. Lady recognise that powerhouses like Belfast must be fully integrated into our national cyber strategy? Will she put on the record that that is what we should be aiming for? Full speech
Speaker
a direction, notice, notification or decision under this Part may be given to that representative instead of the regulated person, by any of the methods mentioned in subsection (1). Full speech
Speaker
(dd) identifying a failure of a person to comply with any duty imposed by these Regulations;” Full speech
Speaker
(a) appointed a representative to act on their behalf, and Full speech
Speaker
(3) The Secretary of State must, within 12 months of the passing of the Cyber Security and Resilience (Network and Information Systems) Act 2026, publish and lay before Parliament an annual report detailing the determinations made under paragraph (1) above in the previous 12 months.”- (Sir Iain Duncan Smith.) Full speech
Speaker
This amendment (and amendments 20, 21, 22, 23, 24, 25 and 26) is a drafting change to clarify that this clause applies to notifications and decisions under Part 4 as well as to directions and notices. Full speech
Speaker
(b) guidance on recovery and remediation.” -(Victoria Collins.) Full speech
Speaker
“(1) The Secretary of State must, by regulations, make provision for the establishment and operation of a cyber security support service for relevant small and medium-sized enterprises (SMEs) for the purposes of improving the security and resilience of their network and information systems. Full speech
I will make some further progress. I thank my hon. Friend the Member for Leeds Central and Headingley for his amendment relating to AI emergencies. I recognise his concerns, as well as those of my hon. Friend the Member for Cowdenbeath and Kirkcaldy. Technology is evolving rapidly, and Government must be equipped to respond. That is why the Bill grants the Secretary of State the power to direct regulated entities if the compromise of their network and information system, or the threat of it, giv... Full speech
In my view, this Bill does not explicitly reference misinformation or disinformation threats. I have just met with the Council for Countering Online Disinformation, and in that meeting I learned that X’s algorithm amplified misinformation and disinformation online about the riots that took place in Epsom. Does the hon. Member agree that it is really important that we add strong safeguards against misinformation and disinformation into the Bill? Full speech
Speaker
(b) notified a regulatory authority of the appointment, Full speech
I thank the Minister for generously giving way again. I have no desire to test the House by pushing my amendments to a vote, and I will be happy if I can receive his assurance. I take his points on not having technology-specific regulation where possible, but can I have an assurance that the Minister will work with me, my Committee and other hon. Members to look at the need to safeguard where there are technology-specific risks? Full speech
I call the Chair of the Select Committee on Science, Innovation and Technology. Full speech
There is obviously a level of complexity here in relation to the data centre, AI development and the network in the UK and more broadly. Will the Minister therefore commit to a meeting with me and my hon. Friend the Member for Cowdenbeath and Kirkcaldy (Melanie Ward) to discuss this matter further? Full speech
I will give way to my hon. Friend the Member for Leeds Central and Headingley in the first instance and then to my hon. Friend the Member for Dunfermline and Dollar. Full speech
I recognise the importance of sovereignty, but there are real challenges. How can we deal with the prevalence of, for example, Taiwanese chips in our tech market? Full speech
Speaker
(db) establishing whether any incident has occurred that the designated competent authority believes could have had, has had, is having or is likely to have, an adverse effect on the security or resilience of network and information systems relied on by a person regulated by the authority, and the nature and impact of any such incident; Full speech
Does the hon. Member agree that if we are to excel, we must excel on a UK-wide basis? Does he agree that it would be a very retrograde step to have part of this United Kingdom subject to another jurisdiction’s AI regulations, rather than those of the UK? Does he agree that it is imperative that the AI regulations that govern our digital sector are those of this Parliament and not those of the European Parliament? Full speech
Speaker
(dc) assessing the implementation of measures taken under regulation 10 to manage risks and to prevent and minimise the impact of incidents, including as a result of any inspection conducted under regulation 16; Full speech
That proves why we need more awareness of the threat that we face. It is not necessarily a case of banning certain components or technologies, but we must be more aware and ensure that the Government have the powers they need to respond where possible. Full speech
As ever, I would be delighted to work with the Chair of the Select Committee on a range of technology questions, including this one. I am delighted with the support that this House has shown for the intention and principles of the Bill, and I am grateful for Members’ consistent, principled scrutiny. Full speech
Speaker
(i) hold those posts as a result of, or in the course of, their membership of the party, or Full speech
Speaker
This amendment and amendment 8 would ensure that information could be shared between NIS enforcement authorities where it was for the purposes of security of network and information systems, or for the purposes of resilience of such systems. Full speech
It is a pleasure to follow the right hon. Member for Chingford and Woodford Green (Sir Iain Duncan Smith). I concur with the points he made on Jimmy Lai and Jagtar Singh Johal and, more widely, about the internet of things. I think of Norway and Denmark, which suddenly realised that hundreds of buses they had imported from China had kill switches, meaning that their entire public transport networks could potentially have been disabled, just like that. That is the reality of these new technologie... Full speech
Speaker
(ii) in exercising the functions of those posts, are subject to the direction or control of, or significantly influenced by, the party.”- (Dr Ben Spencer.) Full speech
Speaker
This amendment would clarify that a direction, notice, notification or decision can be given to an appointed representative by any method mentioned in subsection (1) of clause 57 instead of to the regulated person in question. Full speech
As ever, my hon. Friend is correct. How many of us have had some bit of technology break because the firmware is no longer allowed to be updated, meaning that something no longer works, it is no longer supported and it breaks down immediately? To add to that, by its nature, something that is not regularly updated becomes more vulnerable to attack by hackers. They may not be state sponsored, but they may take advantage of a weaker part of a technology. That was pointed out to me on a recent visit... Full speech
My part of the world has already had a hard lesson in what a serious cyber-attack can do, and I thank the Liberal Democrat spokesperson, the hon. Member for Harpenden and Berkhamsted (Victoria Collins), for mentioning it. In 2020, Redcar and Cleveland council was hit by a cyber-attack that has been attributed to the Russian Conti syndicate, and around 135,000 residents were left without online public services. Systems were disrupted, and the cost was put at more than £10 million. That is a story... Full speech
On local government, there are clearly hundreds of local authorities, many of which are busy upgrading their systems. However, one thing that is not spoken about enough is the human capacity to actually do the work. Many local authorities, like Government themselves, find a real difficulty in recruiting the talent that they need. Does my hon. Friend agree that central Government could provide a greater role and act almost as a centre of excellence for cyber-security for local government? Full speech
My hon. Friend is right to say in his eloquent speech that raising awareness and having a debate about this issue is important, but the problems may not necessarily be the result of hostile actors. If the providers of the modules were to stop providing software updates, the modules would be more likely to fail and then become the subject of hostile attacks. So not only could the technology be killed by a hostile actor, but an increased dependency on software updates puts us at risk. Full speech
As a former councillor in a district council bordering London, I know the particular challenges we had in recruiting really decent council officers. I should put it on record that we have had some fantastic officers in Harlow district council, but it was always more difficult to recruit them, because they were drawn particularly to London. I recognise the challenges that he highlights, and I obviously want more support to be given to those professionals to understand cyber-security risks. My fat... Full speech
The hon. Lady was very prescient then, and it has got worse since. There was lots of talk under the previous Administration about Downing Street cars being searched for IOTs. We know about the huge imports from bad actors, such as China and other countries-that is really what we should be worried about. Many of them contain kill switches, which would devastate some of our industry, such as energy. That would be a disaster. She is right to have raised the issue and to continue to raise it. Full speech
Speaker
(c) an agency or authority of a foreign government, or of part of a foreign government; Full speech
Speaker
(1B) Any direction, notice, notification or decision given to a representative by virtue of subsection (1A) is to be treated as having been given to the regulated person.” Full speech
Speaker
This is a drafting change consequential on an amendment tabled at Committee stage. Full speech
I want to draw the Minister back to a point I raised with him at an earlier stage of the Bill, when he gave me what I would call a holding reply. When this legislation goes through, will the whole United Kingdom be subject to it, or will my part of the United Kingdom-Northern Ireland-be subject to the EU’s AI laws as they affect the digital sector? Businesses in that industry in my constituency want to know whether they will be governed by this Bill or by the EU’s AI Act. In other words, will th... Full speech
Before I begin, I would also like to make some remarks in commemoration of the 10th anniversary of the murder of Jo Cox. I never met Jo Cox. I never knew Jo Cox, and I am very sad that I did not, because having seen the impact she has had on our politics, on this place and on the people who knew her, she was clearly an incredible person. I do not think anyone can disagree with what she stood for, and in particular, that we have more in common in our politics. Our politics is worse off without he... Full speech
I call the Liberal Democrat spokesperson. Full speech
Speaker
(b) a foreign government, or part of a foreign government; Full speech
I can confirm that the Government will be very happy to engage on this question further with my hon. Friend and the right hon. Member for Chingford and Woodford Green (Sir Iain Duncan Smith). I commend the Bill to the House. Full speech
Speaker
This new clause would require the Government to maintain a register of state actors posing a threat to UK cyber security for the purposes of exercising the Secretary of State’s powers under Part 4 of the Act, which enable the giving of directions in the interests of national security. Full speech
Speaker
This amendment would ensure that any disclosure under regulation 7 of the NIS Regulations (defined by clause 1) would be limited to information which is relevant and proportionate to the purpose for which the disclosure is being made. Full speech
Speaker
(dd) identifying a failure of a person to comply with any duty imposed by these Regulations;” . - (Kanishka Narayan.) Full speech
The hon. and learned Gentleman will be aware from a response I recently gave him that both the complexity of the EU’s AI Act and its interaction with the Windsor framework are under consideration at the moment. The EU has made a proposal and we are working with it on that. I will be happy to engage with him on that particular question in due course. Full speech
I beg to move, That the Bill be now read the Third time. It has been a privilege to take this vital piece of legislation through the House. I thank everyone who has played a role in getting the Bill to this stage, including the noble Baroness Lloyd of Effra, who has been instrumental in driving the policy in this Bill and leading its passage in the other place. I also thank my right hon. Friend the Secretary of State for Science, Innovation and Technology; the officials who have worked tirelessl... Full speech
With this it will be convenient to discuss the following: New clause 3- Review of high-risk bodies- “(1) The Secretary of State must, within six months of the passing of this Act, publish and lay before Parliament a review of the national security risks posed to relevant network and information systems by foreign state ownership or control of relevant bodies. (2) A review under this section must assess- (a) the number of relevant bodies which are owned, in whole or in part, by a foreign state or... Full speech
I thank the hon. Gentleman for his point of order. I have had no notice that the Government intend to bring a statement, but I am sure that those on the Government Front Bench have heard him, and should that change, we will doubtless hear before the Adjournment. Full speech
Speaker
(2) For the purposes of this section, a relevant SME is one which is- Full speech
Speaker
“(da) assessing the security or resilience of network and information systems relied on by a person regulated by the designated competent authority; Full speech
I will not, because I am testing the patience of Madam Deputy Speaker- [ Interruption. ] With your permission, Madam Deputy Speaker, I will give way. Full speech
Before I withdraw new clause 2, I want to draw Members’ attention to my entry in the Register of Members’ Financial Interests in reference to my earlier speech. I beg to ask leave to withdraw the clause. Clause , by leave , withdrawn . New Clause 13 Digital Sovereignty Strategy on risks posed by foreign interference and reliance on foreign technologies “(1) The Secretary of State must, within 12 months of the passing of this Act, publish a strategy (“a Digital Sovereignty Strategy”) which sets o... Full speech
Given the specificity of his question, I will suggest that I come back to my hon. Friend. The broad thrust is that through our investment control legislation and procurement legislation, there are a series of responsibilities on Departments to look at it. [ Interruption. ] Given your encouragement, Madam Deputy Speaker, I shall move on. Finally, I will respond to the right hon. Member for Chingford and Woodford Green (Sir Iain Duncan Smith), who raised a very important point. The most important ... Full speech
As I say, I agree with much of the right hon. Gentleman’s diagnosis. Let me state in more detail the reasons for objecting on the mechanism. First, the provisions for information sharing are deeply discretionary for UK regulators. Secondly, the subjects in which they can pursue that information sharing are restricted to significant matters of national security and domestic crime prevention in the UK. Official Report , 8 July 2026; Vol. 789, c. 6WC. (Correction). Thirdly, the way that the amendme... Full speech
Madam Deputy Speaker, I hope you will not mind if I take a moment to reflect on the fact that today is the 10th anniversary of the murder of our dear friend Jo Cox. I was lucky to serve alongside Jo on the board of the Labour Women’s Network and we had done similar kinds of work previously. I often sit here in the Chamber and look at Jo’s shield and wonder what she would have made of the state of our politics, our country and our world today. I think about how much better we would be if she was ... Full speech
It is a pleasure to follow such esteemed colleagues. My only declaration before I start my speech is that I hold a degree in information systems from the University of Leeds. I have been sat here for the last two hours looking at the memorial plaque for Jo Cox, 10 years after the horrific day that we lost Jo. I was a West Yorkshire candidate alongside Jo in the run-up to the 2015 election. It is to my huge detriment that I never got to serve with her here. Today is such a difficult day for so ma... Full speech
On the amendment from the right hon. Member for Chingford and Woodford Green (Sir Iain Duncan Smith), I think we have made some progress with the Minister, but it is clear that trying to isolate the issues around fair trial from other matters is complex. Repeating my earlier call, will the Minister meet me, the right hon. Member for Chingford and Woodford Green and others who signed his amendment to explore the complexities of this after the debate? Full speech
I accept the point about the plethora of businesses in the food supply sector, but my amendment simply seeks commonality with what the European Union has pushed for. Why can it not be the right thing for the UK Government to do as well? Full speech
Will the Minister give way on that point? Full speech
Let me take the Minister back to the question of bringing the retail sector into the provisions of the Bill. He seems to be saying that cyber-security and resilience require Government intervention only when there is an immediate threat to life. Will he clarify whether that is what he is saying? My understanding is that we need to keep our economy and citizens secure in all circumstances. On the question of proportionality, my new clause 20 seeks to bring in only very large businesses, so that t... Full speech
As the director of the National Cyber Security Centre has said, “Every organisation delivering the UK’s critical services…relies on uninterrupted digital operations. Disruptions to those operations isn’t simply an IT issue; it’s a…national resilience issue”. The Liberal Democrats wholeheartedly support that point, and it is why we welcome the measures introduced by this Bill, which strengthen existing cyber protections to enhance national security. However, as the Liberal Democrats have made cle... Full speech
I reiterate the importance of a digital sovereign strategy for our cyber-security. It is about our resilience, our security and our economic strength as a country and collaborative sovereignty. We very much welcome the extended scope of the Bill and we support it moving forward. Question put and agreed to. Bill accordingly read the Third time and passed . Full speech
It is a pleasure to follow the hon. Member for Harpenden and Berkhamsted (Victoria Collins). I would like to start by making two relevant declarations of interest. I worked for the Office of Communications before entering Parliament and I am currently a fellow of the Institution of Engineering and Technology. Madam Deputy Speaker, you might have heard me mention on occasion that I was an engineer before coming into Parliament. As such, in 2010, I was desperate for issues around technology to com... Full speech
I do not think that the hon. Member has understood our amendment, which is about having a strategy. It does not say that everything should be sovereign, but we need to look at our tech stack and have a strategy for what is sovereign and what requires the procurement of elements. I ask him to look at our amendment again. Full speech
I certainly agree. Misinformation and disinformation are a huge challenge to our democracy and our country. We know that many enemy nations, such as Russia and Iran, are seeking to exploit loopholes, and I believe the Government have to take further action on that, for sure. We should not wait to find out whether AI has the potential to damage our critical national infrastructure; we know that in some cases it does, and we should be prepared for it. “Catastrophic risk” includes harm to critical ... Full speech
The right hon. Member does well to remind us that the impact of hostile action using CIMs, such as by turning on a kill switch, would be devastating across multiple sectors, including potentially the consumer sector, as well as security, automotive, transport and finance. That is why it is so important to consider this. I particularly draw the Minister’s attention to the list provided by the US Federal Communications Commission-the equivalent of Ofcom-of equipment and services covered by section... Full speech
I would be more than happy to work with the Government on something that will provide specific protections against cellular internet-of-things modules. What assessment has he made of the specific threat of internet-of-things modules, and what protections are there against that in the legislation? Full speech
I thank Members across the House for their contributions to this Bill over many months and for their relentless scrutiny. I have never known a Minister to be in such a rush, with three hours of protected time left. I am grateful to officials both in the Department for Science, Innovation and Technology and in Parliament for their hard work in getting this legislation to its final stage. I particularly recognise the hard work of my hon. Friend the Member for Runnymede and Weybridge (Dr Spencer) a... Full speech
On a point of order, Madam Deputy Speaker. I seek your guidance. There are reports that a Russian warship has today fired warning shots near a UK-registered yacht in the English channel, south of the Isle of Wight. If verified, this action would be of grave concern to the House and would represent a significant escalation in the hostilities shown by Russian actors towards UK interests. Can you guide me on how the House might seek to be urgently updated by a Defence Minister on this development a... Full speech
I have often said about the device that was found in the Ministry of Housing, Communities and Local Government that unless someone is a member of staff, they cannot get to that side of the building without going through the Home Office. That obviously raises serious questions about the complex on Marsham Street more broadly. Does the shadow Minister accept that there is a pattern of foreign malign forces impacting our institutions, whether that is our Parliament or even the sovereignty of the Un... Full speech
I thank the hon. Gentleman for the knowledge and experience he brings to the background of that particular case. I entirely agree that it is incumbent on all parties across the House to strengthen our national security and to be clear-eyed about the threat of hostile state actors. I will continue to develop that point in my wind-up speech. The evidence is clear that we face an increasing threat from foreign state actors. We need to take action to recognise those risks and to prevent such attacks... Full speech
Speaker
This amendment would ensure that any disclosure under regulation 6 or 6A of the NIS Regulations (defined by clause 1), rather than just disclosures under particular paragraphs of those regulations, would be limited to information which is relevant and proportionate to the purpose for which the disclosure is being made. Full speech
Speaker
This amendment is consequential on amendment 14. Full speech
Speaker
This amendment is consequential on amendment 14. Full speech
Speaker
This amendment is a minor drafting change. Full speech
Speaker
“(including the “or” at the end)”.- (Kanishka Narayan.) Full speech
Speaker
6AB.-(1) Nothing in sub-paragraphs (1)(d) to (1)(f) of regulation 6, or regulation 6A, permits a NIS enforcement authority to share information with another NIS enforcement authority or with a person within paragraph (2) of regulation 6 if the Secretary of State determines that- Full speech
Speaker
(a) the sovereign or other head of a foreign state in their public capacity; Full speech
Speaker
“(da) assessing the security or resilience of network and information systems relied on by a person regulated by the Information Commission; Full speech
Speaker
(a) advice and technical assistance to SMEs following a cyber incident; and Full speech
Speaker
“Exemption from disclosure: right to a fair trial Full speech
Speaker
(2) Foreign powers determined by the Secretary of State as eligible for inclusion on the register under subsection (1) must include states which have been confirmed by GCHQ as posing a risk to the security or resilience of the network or information systems of one or more operators of an essential service or critical suppliers, including where the relevant risk is posed by state affiliated groups. Full speech
Speaker
(db) establishing whether any incident has occurred that the Information Commission believes could have had, has had, is having or is likely to have, an adverse effect on the security or resilience of network and information systems relied on by a person regulated by the Commission, and the nature and impact of any such incident; Full speech
Speaker
This amendment would prevent the sharing of information with overseas authorities for the purpose of prosecuting crimes not committed in the UK if the Secretary of State determines that the receiving country is one in which the right to a fair trial cannot be guaranteed. Full speech
Speaker
“(1A) A disclosure of information under paragraph (1) must be limited to information which is relevant and proportionate to the purpose for which the disclosure is being made.”- (Kanishka Narayan.) Full speech
Speaker
This amendment would clarify that the power under paragraph (2) of regulation 15 of the NIS Regulations (substituted by clause 20) includes power to request information for the stated purposes. This makes provision broadly equivalent to what is currently in regulation 15(3) of the NIS Regulations. Full speech
Speaker
(e) a political party which is a governing political party of a foreign government. A political party is a governing political party of a foreign government if persons holding political or official posts in the foreign government or part of the foreign government- Full speech
Speaker
See the explanatory statement for amendment 7. Full speech
Speaker
This amendment would clarify that the power under paragraph (1) of regulation 15 of the NIS Regulations (substituted by clause 20) includes power to request information for the stated purposes. This makes provision broadly equivalent to what is currently in regulation 15(2) of the NIS Regulations. Full speech
Speaker
(c) a relevant managed service provider, or Full speech
Speaker
(d) an authority responsible for administering the affairs of an area within a foreign country or territory, or persons exercising the functions of such an authority; or Full speech
Speaker
“(4A) A disclosure of information under any provision of regulation 6 or this regulation must be limited to information which is relevant and proportionate to the purpose for which the disclosure is being made.”- (Kanishka Narayan.) Full speech
Speaker
(2) For the purposes of making a determination under paragraph (1) above, the Secretary of State must have regard to the opinion of- Full speech
Speaker
This amendment is consequential on amendment 14. Full speech
Speaker
(b) the disclosure could result in actions being taken that would be incompatible with the right to a fair trial. Full speech