Contribution
I thank my hon. Friend for that. There is so much that highlights that this is the wrong approach from our Government, and that we need to look not only at our suppliers, but at the importance of backing British technology. We believe that a digital sovereign strategy would change things. We need to back British innovation, reduce our dependencies and make our critical systems more secure. We need to look at each level of the tech stack and have a strategy that is right for the UK. I put that proposal to this House in June through new clause 13, which received cross-party support, but the Government and the Conservatives voted it down.
Sovereignty is not about doing this alone; it is about working globally while backing British. It is about becoming and staying world leaders in technology. It is about securing high-quality digital infrastructure that embeds us in global supply chains and makes the most of our incredible talent and skills. That would give us international leverage, not isolation. The Government say that sovereignty is covered by Departments across Whitehall, and last week’s Budget put another £60 million in the sovereign AI fund, but a venture fund and a patchwork of departmental reports are not a strategy.
The new powers on high-risk vendors in clause 44 allow the Government to react once a risky supplier is already in our system, but a strategy needs to be proactive. It needs to build British capability so that we never get to that point. Even industry is calling for a strategy, so I urge the Government to bring forward their own amendments on digital sovereignty.
Secondly, amendment 107, which passed in the Lords—a Cross-Bench amendment that Liberal Democrat peers supported—requires a review within a year of Royal Assent, and every year after that, of whether the regime is working, which sectors it covers, the supply chains, the regulators and the AI Security Institute. Given the fast pace of change in cyber-security, we urge the Government to support the amendment and to look at expanding the scope to local government, which holds our electoral rolls and our social records, and to retail, because a country that cannot feed itself is not resilient. We welcome the Government’s commitment in the other place to reviewing whether all critical national infrastructure sectors should be covered by this legislation and the Network and Information Systems Regulations 2018.
This week’s NCSC review warns that AI-powered malware is highly likely to be used in ransomware attacks on our critical infrastructure by 2028, yet there is still no clarity on who oversees AI in our cyber-defences: a single regulator, the AI Security Institute, or another body that is exactly right for the task. Our constituents and businesses need that clarity, because where there is trust in the regulatory environment, there is investment. People need to trust the technology; that is both pro-business and pro-society.
The Government need a plan for who does what, and they need it sooner rather than later. As Europe calls for a leaders’ summit on AI, I call again on the Government to convene a global AI summit, and to look towards an international AI safety agency, headquartered in the UK and modelled on the International Atomic Energy Agency, with a global treaty on pausing the development of super-intelligent AI.
Finally, none of this works unless those who are expected to deliver it can work. Small and medium-sized enterprises make up 99.8% of UK businesses and are often the most vulnerable link in the cyber-supply chains. This week’s discount on Cyber Essentials certification is welcome—the Liberal Democrats called for that—but it is time-limited; it ends in March, and the certificate must be renewed every year. Even the NCSC calls it only a starting point. SMEs need real support from a cyber-security support service when they are hit, to give them clear guidance.
On Second Reading, I compared this Bill to a house with stronger fences and a better alarm, but with its back door left wide open. The past few days alone have shown us why closing that door matters. I urge the Government to consider our amendments, for the communities and councils who rely on critical infrastructure, for the businesses integrated into every supply chain, and for every family who expect the services that they rely on to be there when they need them. We support the carry-over motion.