Cyber Security and Resilience (Network and Information Systems) Bill (Carry-over Extension)
Wednesday, 4 November 2026
Contributions
The Minister for Creative Industries, Media and Online Safety (Ian Murray)Labour
I beg to move, That the period on the expiry of which proceedings on the Cyber Security and Resilience (Network and Information Systems) Bill shall lapse in pursuance of paragraph (13) of Standing Order No. 80A shall be extended, so that the period expires at the end of 29 April 2027 rather than at the end of 11 November 2026. The UK is subject to daily and unrelenting cyber-attacks, as cyber-criminals and state-linked actors blackmail businesses, steal data and threaten our very way of life. As our lives become increasingly digital, the threat comes not only from hostile actors, but from weaknesses in the resilience of our systems. We must defend against both and focus our attention where it matters most. Although all businesses should secure themselves against cyber-attack using the National Cyber Security Centre’s free toolkits, it is right that we do not over-regulate every business. That is why the Bill is targeted at our most essential and critical services, relating to drinking water, health, transport, energy and the digital services that keep our economy running. If these services were disrupted, we would have nowhere else to turn. The Bill safeguards those services and, in turn, protects the individuals and businesses that rely on them. That is the priority of this Government. We will not hesitate to take action when hostile actors seek to do us harm. The Bill delivers a step change in national security and equips the Government with the powers to act decisively on threat intelligence. This Government have gone further still; we have tabled amendments to introduce a new vendor risk management framework, which will assist businesses in reviewing their supply chains and working with the Government to mitigate those risks, and it will, if necessary, enable Government to step in and instruct organisations to take action. This week, the Bill re-entered the House after completing Third Reading in the other place on Monday 2 November. I pay tribute to the Minister, the noble Baroness Lloyd, as well as Members of this House and the other place for engaging so constructively throughout the Bill’s passage. In many instances, the contributions have refined the Bill and made it more robust. I know that hon. Members will continue this constructive dialogue in their consideration of Lords amendments, and will pass a Bill that is fit to deal with the cyber-threats that we face now and in future.
Madam Deputy Speaker (Ms Nusrat Ghani)Conservative
I call the Liberal Democrat spokesperson.
Victoria Collins (Harpenden and Berkhamsted) (LD)Liberal Democrat
The Liberal Democrats absolutely support this motion, but it is my democratic duty to highlight some things that I would love the Government to consider as we make this extension. Let us look locally, nationally and internationally. In July, Hertfordshire county council raised its cyber-security risk to the maximum score on its register, 25 out of 25. That is exactly the kind of risk that this Bill should manage, yet the Bill excludes local authorities, even though they hold social care records on some of the most vulnerable people. Less than a fortnight ago, 32 Government services went offline while Departments patched critical flaws in widely used web software. That shows just how vulnerable the heart of our nation’s digital infrastructure and security is. On Sunday night, hackers attacked dozens of supermarket refrigerators and freezers in seven European countries, raising their temperatures to 50°C and spoiling millions of euros-worth of produce. That is the food we all rely on every single day, and the National Cyber Security Centre has warned: “The UK’s cyber resilience is not yet where it should be.” Our framework must not fall behind those of our closest neighbours. We should deepen co-operation with European Union agencies and member states. In a digital world, isolation only increases risk. Those examples lay bare the crucial importance of the Bill and the devastating cost to businesses, consumers and our national security if we fail to get it right. The Bill cannot simply react to yesterday’s threats; we must ensure that our critical national infrastructure is prepared for the future, which means addressing over-reliance on high-risk foreign technology, and tackling the rapidly escalating threat of cyber-attacks powered by artificial intelligence, and on the internet of things, which is embedded in so much of what we use. Digital sovereignty underpins everything else. We can no longer ignore the risks of over-reliance on American and Chinese technology, or rely on hostile, unpredictable states for our critical infrastructure. More than half of central Government organisations now run most of their systems on the cloud, and that all sits with just two companies, both American. The Government are the UK’s largest buyer of technology, but they almost never buy British. Since 2023, Palantir has won more than £420 million in public contracts across the national health service, the Met, the financial regulator, a city council and the Ministry of Defence. The latter’s £240 million contract was awarded without competition. Palantir is also an approved supplier on six public sector buying frameworks with a combined value of more than £9.7 billion—a route into Whitehall, the NHS, the police and our local councils.
Martin Wrigley (Newton Abbot) (LD)Liberal Democrat
Does my hon. Friend agree that it is a travesty that Palantir is not on the strategic suppliers list maintained by the Cabinet Office?
I thank my hon. Friend for that. There is so much that highlights that this is the wrong approach from our Government, and that we need to look not only at our suppliers, but at the importance of backing British technology. We believe that a digital sovereign strategy would change things. We need to back British innovation, reduce our dependencies and make our critical systems more secure. We need to look at each level of the tech stack and have a strategy that is right for the UK. I put that proposal to this House in June through new clause 13, which received cross-party support, but the Government and the Conservatives voted it down. Sovereignty is not about doing this alone; it is about working globally while backing British. It is about becoming and staying world leaders in technology. It is about securing high-quality digital infrastructure that embeds us in global supply chains and makes the most of our incredible talent and skills. That would give us international leverage, not isolation. The Government say that sovereignty is covered by Departments across Whitehall, and last week’s Budget put another £60 million in the sovereign AI fund, but a venture fund and a patchwork of departmental reports are not a strategy. The new powers on high-risk vendors in clause 44 allow the Government to react once a risky supplier is already in our system, but a strategy needs to be proactive. It needs to build British capability so that we never get to that point. Even industry is calling for a strategy, so I urge the Government to bring forward their own amendments on digital sovereignty. Secondly, amendment 107, which passed in the Lords—a Cross-Bench amendment that Liberal Democrat peers supported—requires a review within a year of Royal Assent, and every year after that, of whether the regime is working, which sectors it covers, the supply chains, the regulators and the AI Security Institute. Given the fast pace of change in cyber-security, we urge the Government to support the amendment and to look at expanding the scope to local government, which holds our electoral rolls and our social records, and to retail, because a country that cannot feed itself is not resilient. We welcome the Government’s commitment in the other place to reviewing whether all critical national infrastructure sectors should be covered by this legislation and the Network and Information Systems Regulations 2018. This week’s NCSC review warns that AI-powered malware is highly likely to be used in ransomware attacks on our critical infrastructure by 2028, yet there is still no clarity on who oversees AI in our cyber-defences: a single regulator, the AI Security Institute, or another body that is exactly right for the task. Our constituents and businesses need that clarity, because where there is trust in the regulatory environment, there is investment. People need to trust the technology; that is both pro-business and pro-society. The Government need a plan for who does what, and they need it sooner rather than later. As Europe calls for a leaders’ summit on AI, I call again on the Government to convene a global AI summit, and to look towards an international AI safety agency, headquartered in the UK and modelled on the International Atomic Energy Agency, with a global treaty on pausing the development of super-intelligent AI. Finally, none of this works unless those who are expected to deliver it can work. Small and medium-sized enterprises make up 99.8% of UK businesses and are often the most vulnerable link in the cyber-supply chains. This week’s discount on Cyber Essentials certification is welcome—the Liberal Democrats called for that—but it is time-limited; it ends in March, and the certificate must be renewed every year. Even the NCSC calls it only a starting point. SMEs need real support from a cyber-security support service when they are hit, to give them clear guidance. On Second Reading, I compared this Bill to a house with stronger fences and a better alarm, but with its back door left wide open. The past few days alone have shown us why closing that door matters. I urge the Government to consider our amendments, for the communities and councils who rely on critical infrastructure, for the businesses integrated into every supply chain, and for every family who expect the services that they rely on to be there when they need them. We support the carry-over motion.
Alex Ballinger (Halesowen) (Lab)Labour
It a pleasure to follow the Liberal Democrat spokesperson, who raised a number of important points, particularly about Palantir operating in the national health service. I support this carry-over motion, which will allow Parliament to complete its work on legislation that is vital to our national security, our civil preparedness and our economic resilience. Having completed its Lords stages earlier this week, the Bill is now within reach of the statute book, and the need for its protections is increasingly urgent. Just yesterday, the chief executive of the National Cyber Security Centre warned us: “The cyber threat has increased faster than our defensive capabilities”. The threats are increasingly obvious. As the hon. Member for Harpenden and Berkhamsted (Victoria Collins) mentioned, this week, nine countries have been attacked; supermarket fridges were turned up to 50°C, ruining millions of pounds-worth of food. That comes on the back of attacks against French supermarkets only three weeks ago. The National Cyber Security Centre’s review describes Russian intelligence exploiting routers to target critical infrastructure, widespread disruption caused by Iranian proxies and the ever-expanding reach of Chinese cyber-espionage. These operations form a fast-evolving hybrid threat to our economy and the infrastructure on which our essential services depends. For those of us in the west midlands, last year’s attack on Jaguar Land Rover brought these threats right to our doorstep. Production lines ground to a halt, orders were disrupted and suppliers placed under crushing financial pressure. The cost of the attacks was estimated at £1.9 billion and while the Government responded quickly, providing a £1.5 billion loan to help sustain JLR and its supply chain, the best response and the best protection we can give businesses is prevention. JLR’s ordeal underscores the need for the Bill and the changes it makes to the 2018 framework, requiring IT service providers, data centres and other critical bodies to meet rigorous cyber-security standards, strengthening incident reporting and giving the Government the power to respond to national security threats. For Halesowen and the west midlands, these changes would boost the resilience of businesses, keeping them trading and production lines moving, and data centres and livelihoods secured, so I support the motion so that we can complete this legislation promptly and put its protections into practice as soon as possible.
I welcome the comments made by the Liberal Democrat spokesperson on this incredibly serious issue and look forward to her bringing them back when we actually have the debate, beyond this carry-over motion. I hope she will support the carry-over motion so she can make her speech again. My hon. Friend the Member for Halesowen (Alex Ballinger) mentioned JLR and other high profile issues of a serious nature. That allows me to briefly give a big message to all businesses in the country that cyber-security is also their responsibility—it should be in every boardroom, at the top of every agenda, to ensure we are not having those incidents. As my hon. Friend, said prevention is better than cure. The National Cyber Security Centre has all the free tools available, so I encourage every single business—micro, small, medium and large—to use those tools to ensure they are as secure as they possibly can be. Of course, we cannot stop all cyber-attacks being successful, but we can minimise the risk as much as possible and make sure that it is everyone’s responsibility.
David Chadwick (Brecon, Radnor and Cwm Tawe) (LD)Liberal Democrat
During the evidence collection process, lots of experts from the cyber-security sector called for board accountability to be reintroduced into the Bill, as it is in similar legislation in the European Union. Will he give us his thoughts on why that has not been included?
The Liberal Democrat spokesperson mentioned the same European Union regulations. We need to do what is in the best interests of businesses in the United Kingdom. The message is pretty clear that all businesses must have cyber-security at the top of their agenda—it should be in every boardroom and we keep encouraging them to do so.
Chris Vince (Harlow) (Lab/Co-op)Labour (Co-op)
Madam Deputy Speaker, you missed out on me making a very long speech, so you are very lucky. Will the Minister briefly touch on what liability there will be for frontier model providers, such as OpenAI, who breach their duties, for example I am thinking of the Hugging Face incident in July 2026?
My hon. Friend from Harlow—I am surprised he did not mention Harlow in his contribution, so I thought I had better put it on the record or otherwise he will be struck out—makes a good point. However, we can also see that AI provides a good solution to this problem. Because of the PHP incidents in the past few weeks, we have identified that there were holes in that particular system and then those holes were patched and plugged, so while AI is a big cyber-security problem, it is also a big part of the solution. This Bill is here to give us better cyber-security and better resilience across all our economy. Question put and agreed to.
Source: UK Parliament Hansard API. Debate ID: 5432179.