M
Member
Speaking in the House of Lords on 3 September 2026
Debate
Cyber Security and Resilience (Network and Information Systems) BillContribution
74: After Clause 21, insert the following new Clause—
“Liability of senior executivesAfter regulation 18 of the NIS Regulations insert—“Liability of senior executives(1) This regulation applies where a designated competent authority or the Information Commission has reasonable grounds to believe that—(a) a person that is a body corporate, a partnership (including a Scottish partnership) or an unincorporated body has failed to comply with a duty referred to in regulation 17(1), (2), (2ZA) or (2ZB), and(b) the failure was committed with the consent or connivance of, or is reasonably attributable to any neglect on the part of, a senior executive or group of senior executives, deliberately or carelessly. (2) The competent authority or the Information Commission may serve a notice of intention to impose a penalty on the senior executive(s) if it considers that a penalty is warranted having regard to the facts and circumstances of the case.(3) Before serving a senior executive(s) notice, the authority or the Information Commission must inform the senior executive(s), in such form and manner as it considers appropriate having regard to the facts and circumstances of the case, of—(a) the alleged failure and the office’s alleged consent, connivance or neglect, and(b) how and by when representations may be made in relation to the alleged failure and any related matters.(4) A senior executive(s) notice must be in writing and must specify the following—(a) the reasons for serving the notice;(b) the alleged failure or failures and the senior executive(s) alleged consent, connivance, neglect or carelessness which are the subject of the notice;(c) any remedial actions required;(d) the amount of the penalty and the number of penalties which the authority or the Information Commission is minded to impose.(5) The authority or the Information Commission may, after considering any representations made in accordance with paragraph (3)(b), serve a penalty notice on the officer with a final penalty decision if satisfied that a penalty is warranted having regard to the facts and circumstances of the case.(6) A penalty imposed under this regulation must be of an amount which the authority or the Information Commission determines is appropriate and proportionate in the circumstances, having regard to the matters mentioned in regulation 18(6) for each infringement individually.(7) If the authority or the Information Commission is satisfied that no further action is required, having considered any representations submitted in accordance with paragraph (3)(b), it must inform the senior executive(s) in writing as soon as reasonably practicable.(8) In this regulation “senior executive(s)”—(a) in relation to a body corporate, means a CEO, director, manager, secretary or other similar senior executive of the body, or a person purporting to act in any such capacity;(b) in relation to a partnership, means a partner or a person having control or management of the partnership business, or a person purporting to act in any such capacity;(c) in relation to an unincorporated body other than a partnership, means a member of its governing body, or a person purporting to act in any such capacity.””Member’s explanatory statement
This amendment seeks to create provision in the Bill for executives or senior managers to be held responsible for failure to comply or report on the measures placed upon regulated bodies within the Bill.
About Hansard
Hansard is the official verbatim record of proceedings in the UK Parliament. Every word spoken in the Commons and Lords is recorded and published — this page is a single contribution from that record.