Grand Committee
Environmental Permitting (Waste Controlling or Transporting) and Relevant Functions of Primary Authorities (Amendment) (England) Regulations 2026
(2 weeks, 5 days ago)
Grand CommitteeRead Full debate Read Hansard Text Read Debate Ministerial Extracts
Baroness Hayman of Ullock
That the Grand Committee do consider the Environmental Permitting (Waste Controlling or Transporting) and Relevant Functions of Primary Authorities (Amendment) (England) Regulations 2026.
Relevant document: 3rd Report from the Secondary Legislation Scrutiny Committee (special attention drawn to the instrument)
The Parliamentary Under-Secretary of State, Department for Environment, Food and Rural Affairs (Baroness Hayman of Ullock) (Lab)
My Lords, these regulations were laid before the House on 20 May 2026. I would like to acknowledge the work of the Secondary Legislation Scrutiny Committee in its review of this statutory instrument. The committee’s scrutiny is a vital part of our legislative process, ensuring that the policy intentions behind secondary legislation are clear and well-founded.
Waste crime blights our communities—across our streets, fields and woodlands, criminals dump waste illegally. This an eyesore and causes damage to our environment. A light-touch registration system for those who transport and deal in waste has been exploited over the years by waste cowboys who dump waste and leave a huge clean-up bill. This system is not fit for purpose. Today we seek to reform it, introducing stricter checks and requirements, closing the loopholes that allow illegal operators into our waste system.
We will bring those in England who control and transport waste within the scope of the 2016 environmental permitting regulations, while repealing the current carriers, brokers and dealers’ registration system. These regulations will introduce permits for those who control and transport waste, bringing the system in line with site-based waste activities. Permitting will mean that those who apply will need to undergo a stricter range of background checks, including criminal record checks, as well as demonstrating that they are technically competent to do the job.
The new system of permitting will be managed the Environment Agency, which will be responsible for managing applications and ensuring compliance. The Environment Agency will be able to suspend and ultimately revoke permits where conditions are breached. It will be able to prosecute, leading to fines or up to five years’ imprisonment. The fees introduced for permits will mean that the Environment Agency will be effectively resourced for compliance work.
These regulations will make it easier for the public to trust the people they hand their waste to. Alongside permits being able to be checked online, we are requiring that waste controllers and transporters include their permit number on advertising. Whether this is a Facebook ad or a branded van, the public will be able to spot and check on the operators they work with.
This reform is one of a number outlined in the Government’s Waste Crime Action Plan, published in March, which together strengthen the regulatory framework and the Environment Agency’s ability to prevent, detect and act against waste crime. We have taken further legislative action by replacing outdated paper-based methods for monitoring waste movements with digital waste tracking. We will also be tightening the waste permit exemptions system by removing three exemptions and tightening the conditions of seven others that have long been abused by waste criminals.
Alongside the reforms, it is important that we provide those responsible for tackling waste crime with the tools needed to effectively stamp it out. We have committed an additional £45 million for the Environment Agency to spend on waste crime enforcement over the next three financial years to support this. This funding will mean that there are more boots on the ground to expand its enforcement activity and ensure waste criminals face the consequences.
I want to acknowledge the strength of support from the industry and its patience over the years as it has been developed. These regulations represent a significant change for the waste system and will help level the playing field for operators, as well as protecting our communities and the environment from waste criminals.
Alongside the reforms to the carriers, brokers and dealers’ system, the regulations also bring the Environment Act 2021 into the scope of primary authority by adding it to Schedule 3 to the Regulatory Enforcement and Sanction Act. Primary authority is a means for businesses to receive assured and tailored advice on meeting regulations such as environmental health, trading standards and fire safety through a single point of contact. This amendment is particularly necessary to enable primary authorities to play a role in effectively supporting retailers in undertaking their obligations as required in the deposit return scheme. I beg to move.
Baroness Coffey (Con)
My Lords, I briefly want to congratulate the Government and to say, well done. I think this was first put forward eight years ago, and it is finally happening. I appreciate it is not happening until next year, but we need to recognise the long amount of time it took to get here. I hope the results will be very rapid.
Earl Russell (LD)
I thank the Minister for introducing these regulations, which we on these Benches welcome warmly. As the Minister is all too aware, I have raised the issue of waste crime in the House several times. I am genuinely pleased that these regulations are arriving as a crucial part of the of the long-term solutions we need to get control of our waste system and lock the criminals out.
As the Minister said, this SI does not arrive in isolation; it follows the Waste Crime Action Plan and the instrument beginning the rollout of real-time digital waste tracking. Together with the exemptions reform promised later this year and next April’s instrument completing end-to-end digital tracking ahead of the deposit return scheme, we are finally beginning to see the basic architecture this sector has needed for years, so that we can know who is moving waste and where it is going, and make sure our systems are fit for purpose. This is the first time I have been able to say that I am really hopeful and see a future and a way forward. I really do welcome this.
On the Environment Agency’s own estimates, around 18% of the waste in England passes through criminal hands at some point in its journey. This structural feature of the current system has been allowed to flourish for a number of years. As a result, we have a big historic legacy of waste sites that need to be cleared.
I note that the Environment Agency’s watchlist for high-priority sites has grown to 139 as of 10 July. I welcome this transparency but, again, this legacy still needs further work. I thank the Minister and officials in the Environment Agency for all their work and for the change of culture under this Government over the last 18 months or so. That is genuinely welcomed.
Turning to the instrument itself, as the Minister said, it replaces the older carriers, brokers and dealers’ registration system with a proper environmental permit split sensibly into three categories: waste controlling, waste transporting and combined activities, so that oversight can match risk rather than applying as a single blunt instrument. Gone, hopefully, are the days when it was possible to register your dog as a waste carrier. Permits will run for three years, and the Environment Agency gains real power to check before granting a permit, rather than acting only after the damage is done. It also gains powers to suspend and revoke. This is a genuine structural improvement.
I want to be fair to the Minister on timing—she has already spoken about this—but obviously, this instrument has been a long time coming. Consultations closed in 2022, but the delay is not down entirely to this Government, but to past Governments. It is great that this instrument is here.
I have several questions. On exemptions, how will the department ensure that charities and other low-risk categories are not quietly colonised by operators or organised criminal networks seeking to avoid scrutiny? Will monitoring be ongoing, not one-off assessments at the drafting stage? On interrogation, how will permitted regimes interact with the digital waste tracking that has already been rolled out? Obviously, a permit is only as good as the data behind it. On exports, illegal and misdescribed waste exports remain a major route for criminal activity. What assessment has been made of this instrument’s bearing on waste that should not be leaving our shores or that is doing so mis-permitted?
On funding and delivery, with £45 million in new money for the Environment Agency—we obviously welcome that—and several reform strands running in parallel, how will the Government monitor and review the programme as a whole, not just instrument by instrument, so that we know how the money is working and that it is delivering the results we expected? Does the Minister agree that we need overall benchmarks and reporting across this piece, as we are undertaking these various strands of structural reform?
On industry awareness, reform closes a loophole only if waste producers know that carriers need a permit and that there are checks that one is in place. What steps will ensure that businesses understand this, that they are encouraged to apply for the right permits and that they know what they need to do? I slightly worry that the resources for this information part of working with industry may not be sufficient for that structural change across the whole industry.
This instrument is to be renewed in three years’ time, so can the Minister confirm that at that point, proper checks will be in place to review what happened over the first three years, on an individual carrier and broker basis? A permit granted once and never revisited would simply not resolve the problem and could allow illegal activity to continue.
On transition, criminals and the organised criminal networks adapt quickly—sometimes much more quickly than Governments can. We have this 12-month window during which the old registration remains valid. In this transition period, what work is being done to make sure that that is not an additional opportunity for the organised networks to exploit the change of system?
None of this works without an Environment Agency properly funded and staffed to issue permits, monitor compliance and take enforcement action against those who ignore them. So what continuous review are the Government undertaking to make sure that the Environment Agency has the staffing, the computer systems and the ability to conduct all the tasks that it needs to do?
We absolutely welcome this instrument and are really pleased to see it. It is about time that we turned the tables on these organised criminals. The noble Baroness, Lady Sheehan, has a Private Member’s Bill coming up, and I encourage the Minister to work with her on trying to offer whatever support the Government can for it.
Lord Blencathra (Con)
My Lords, I thank the Minister for bringing these regulations before the Committee. I can be commendably brief—or briefer than I normally am—because we give a very warm welcome to these excellent regulations. We on these Benches have repeatedly raised waste crime and called for tougher measures against the perpetrators. During consideration of the Crime and Policing Bill, the Government did not support our amendments to give police the powers to seize the vehicles of perpetrators of these crimes. I am sure that, if the Minister were to draw this to the attention of the excellent, caring and meticulous Lords Minister for Crime and Policing, he might wish to reflect on this again.
Nevertheless, we welcome this step to better monitor the transportation of waste, taking into account which activities are low risk and which are high. These regulations are at least intended to ensure compliance and better identify criminal activity. I understand that the consultation demonstrated that a majority of respondents supported replacing the carriers, brokers and dealers’ registration system with this permitting regime under the Environmental Permitting (England and Wales) Regulations 2016. That said, can the Minister outline how the Government will ensure that businesses are made aware of the changes, as well as their ability to afford the costs involved, because there will be permit fees, registration fees, time costs, technical competence costs, tax, et cetera?
These regulations give more power to the Environment Agency, as well as responsibilities to issue permits. The increased enforcement costs are estimated to be £22.1 million, but the Explanatory Memorandum also states:
“The Environment Agency may benefit from efficiency savings”.
So can the Minister provide an exact figure for how these savings will be made?
More broadly, I come back to the one major quibble we on the Opposition Benches have had—making the National Crime Agency the lead in the joint unit on tackling waste crime. We are dealing with massive, organised crime here. I perfectly well accept and believe that if a farmer’s slurry tank leaks, the Environment Agency is the perfect body to investigate it, as with a leak from a factory.
Baroness Hayman of Ullock (Lab)
My Lords, I thank noble Lords who have taken part in the discussion and all noble Lords for their strong support for the measures being brought forward. As noble Lords have said, this has been a long time coming, so it is really good to see that we have finally got this in front of us today. One thing that has come across really clearly, not just today but in a number of questions and parliamentary debates, is the huge problem of criminal waste activity that now blights so much of our countryside. There were a number of questions asked. I will do my best to cover them off, and if there is anything else I have missed, I will make sure I get back to noble Lords in writing.
First, on evaluation and monitoring, we recognise that tackling waste crime requires sustained effort and a willingness to adapt as circumstances evolve. Delivery of the waste crime action plan will be accompanied by a process of continuous review and improvement. We will also regularly assess the effectiveness of the measures that are introduced. We will consider any new evidence as it emerges and, importantly, identify opportunities to go further where existing interventions are not achieving the desired outcomes. This is designed to ensure that our approach to tackling waste crime remains agile, responsive and focused on achieving lasting change.
The Environment Agency is also developing improved indicators for 2026-27, including measures on larger-scale offending, response times and deterrence. The current Environment Agency scorecard metric covers only a narrow proportion of illegal waste activity. Waste crime is hard to measure as it is deliberately hidden: only around 27% of incidents are actually reported. Defra is working closely with EA to deliver new indicators, improving visibility of the problem and getting a better grip on it.
Defra is leading the delivery of the waste crime action plan, working closely with the Environment Agency as the national lead for waste crime. That is being done alongside HMRC, the Home Office, police forces and local authorities, because if we are going to successfully tackle this, we need co-ordinated cross-government action. As I mentioned in my speech, we have committed an extra £45 million over three years, and an extra £5.6 million uplift in 2025-26, designed to increase front-line enforcement, intelligence and operational capacity, so we have more officers, specialised units and multi-agency activity.
We are also bringing in structural reforms, including CBD reform, digital waste tracking and exemption reforms. They are being implemented to design crime out of the system so that prevention and compliance are integral, rather than relying on reactive enforcement alone. We are also driving through other concrete operations measures: earlier interventions, permit action, restriction notices, prosecutions, use of advanced technology including drones and satellite imagery, and strengthened intelligence via the Joint Unit for Waste Crime, which I will come on to shortly. On monitoring effectiveness, we will deliver improved metrics but also review the multi-agency waste crime response and adapt its delivery so that the action plan remains live and responsive.
The noble Earl asked about digital waste tracking. It will work by requiring information to be submitted to a central system of all movements of hazardous and non-hazardous waste, with a few pragmatic exemptions, from the point the waste is produced to the point it arrives at the waste receiving facility. It will replace paper processes with consistent, near real-time data, improving traceability and highlighting any unusual movements linked to misdescription, diversion or illegal export. That is one of the ways in which we will tackle the illegal export issue that the noble Earl asked about. The first phase started in April, and it will be mandatory from October. The second phase will cover the whole waste movement chain. It is planned that that will be available for all relevant operators to use voluntarily from spring next year, with a mandatory rollout from the following October.
The noble Earl raised the exemptions. We need to reform the waste exemption regime because we need to stop criminals having the opportunities they currently have to hide illegal activity behind permit exemptions. That is why we are removing the three most abused exemptions and tightening up conditions on the others. Exemptions allow low-risk waste activities to operate without a permit, but we know that some have been widely abused by criminals. We will also bring in limits on quantities, tougher operating conditions and stronger record-keeping. We need to remove the weak points and protect the permitting regime. We are currently working on what the necessary legislative amendments would look like for that. Again, when doing that, we will take into account some of the issues that the noble Earl raised, as we do not want to cause problems for people who are legitimately doing their work.
The noble Earl also asked about businesses and people working in the system. Clearly, when designing regulations such as this, we have to work with those who will use them, to ensure that they work in the most effective way and we do not end up realising that they are not practical when we start monitoring. It is all about how things will practically make a difference.
On the Explanatory Memorandum, the noble Lord, Lord Blencathra, asked about the Environment Agency and efficiency savings. The new controllers and transporters system will mean that operators are required to submit more detailed information as part of their permit applications. This information will be used by the Environment Agency to more efficiently identify high-risk operators and conduct monitoring and compliance work.
The noble Lord referred to the £1 billion cost of cross-county organised crime. The way that we will try to work with the National Crime Agency, which is the point the noble Lord was speaking to, is that the Joint Unit for Waste Crime will provide the crucial collective operational capability. To ensure that the wider system for tackling waste crime remains effective in the face of an evolving threat, Defra is working closely with the National Police Chiefs’ Council and the Home Office to undertake a review of the end-to-end multi-agency response to waste crime. That will cover areas such as information sharing, local-to-national co-ordination and prosecution capabilities. The review will also identify opportunities to strengthen how agencies work together and ensure that the overall system remains effective, resilient and equipped to meet future challenges. The existing capabilities, including the JUWC, will continue to play a key role within this strengthened framework.
Lord Blencathra (Con)
I take that to mean that, although the National Crime Agency will not be put into the lead, it will have an enhanced role. Is that what the Minister said?
Baroness Hayman of Ullock (Lab)
Defra and the Environment Agency will be the lead, but we will work absolutely hand in glove with those other agencies to make sure that they effectively tackle the problem we have. As I say, we will monitor anyway so, if we find that it needs changing in any way to strengthen that, we will be able to do that once we have continued to review and monitor. We are bringing all these changes in because we want to make a difference and we want to stop what has been happening.
I have mentioned to the noble Baroness, Lady Sheehan, that I would be very happy to meet her to discuss her Private Member’s Bill, and I hope we can do that in the not-too-distant future.
I appreciate the noble Baroness, Lady Coffey, coming in to offer her support for this SI. As she said, this has taken a long time, and I am sure she did quite a bit of work on it, so it is important to see that work started by one Government has been completed by another. With that, I commend the regulations to the Committee.
Industrial Training Levy (Engineering Construction Industry Training Board) Order 2026
(2 weeks, 5 days ago)
Grand CommitteeRead Full debate Read Hansard Text Read Debate Ministerial Extracts
Baroness Smith of Malvern
That the Grand Committee do consider the Industrial Training Levy (Engineering Construction Industry Training Board) Order 2026.
The Minister of State, Department for Education and Department for Work and Pensions (Baroness Smith of Malvern) (Lab)
My Lords, I am grateful for the opportunity to debate this instrument today. In my view, the provisions in the instrument are compatible with the European Convention on Human Rights. The statutory purpose of the Engineering Construction Industry Training Board—ECITB—is to make better provision for training across the engineering construction industry in England, Scotland and Wales.
The engineering construction industry is critical to the delivery of the Government’s wider ambitions for economic growth, clean energy and energy security. It provides the skilled workforce needed to build, maintain and operate major energy, manufacturing and industrial infrastructure across Great Britain. The ECITB’s and the Construction Industry Training Board’s continued value was confirmed by a 2023 independent review. It found that a statutory levy remains the most effective model for industry-wide investment in training and is needed to address persistent and structural workforce challenges within the ITBs’ industries.
This statutory instrument gives effect to the ECITB’s levy proposals for 2026, 2027 and 2028. The levy remains the ECITB’s primary source of funding, and this order is required for the board to raise mandatory assessments on in-scope employers. The ECITB continues to receive strong support from employers. Over 85% of levy-paying employers supported the levy proposals, representing almost 98% of total levy value, exceeding the “more than 50%” statutory threshold for support required from industry.
Before we consider the levy proposals in further detail, I want to point out that a 12-week government consultation has just closed on a proposal to bring together both ITBs—the ECITB and the Construction Industry Training Board—into a single unified body to support the combined skills needs of the engineering construction and construction sectors. The Government are now carefully considering the views raised before making any decisions on reforms that may be needed to ensure the system delivers the support employers need. We cannot prejudge the outcome, but it is vital to the continuity of the ECITB’s support for employers that the levy order we are debating today continues. If the Government choose to proceed with this proposed reform, the earliest that a single body would be in place is spring 2028. Should the direction of reform require a new ITB levy order, this would come to the House through the proper parliamentary process.
Baroness Coffey (Con)
My Lords, I do not seek to oppose this order today, but I have a number of questions. I again start by praising the Government, and I strongly support the move to the DWP and the CITB, as well as, more broadly, the changes that the Government have made to the apprenticeship approach. I fully support the merger of the two bodies, which is under consultation, and I hope that that consultation review will be concluded quickly.
One thing that the Minister mentioned was that 85% of the levy payers, who contribute 98% of the levy, are supportive. I was interested in paragraph 33 of the impact assessment, which said that the independent
“customer satisfaction survey in 2024 … found that 65% of employers agreed or strongly agreed that without the levy and grant system the training would not take place”.
As it says elsewhere in the impact assessment, we have a situation where, in order to generate more income, the ECITB has started increasing its training of overseas learners. I do not really understand where this is going.
I am sure the Minister has been diligent more broadly in thinking about what is happening with the amount of people going on to training who do not complete the training or do not continue into work. That is very worrying, given the amounts of money being invested and what is happening with the follow-up. The Government are using powers, as this is an executive non-departmental public body, so is there an element here of thinking about how this could get a bit more refocused, working independently but also in partnership with the department, given that 47% of young people are dropping out? The figures of people who just do the course and, within so many years, drop out of this industry entirely are even higher.
I know that there is work on how to help employers onboard people into apprenticeships, traineeships and the like, but I suggest that some more focus could perhaps help with that. I suggest thinking about how the objectives and key performance indicators for this board could perhaps be published more regularly. On that, 9 July 2025 is when we last saw the annual report and accounts for 2024, so when does the Minister expect the report and accounts to be laid for 2025? As I say, there is a lot of value in this body and its sister body.
I do not expect the Minister to have an answer to this today, but this body is also a charity, and I am unclear about why that is still needed. Is that limiting what can happen in trying to make this more effective? As I say, a good number—65%—of businesses interviewed said that all this training stuff probably would not happen without this board. But, again, on some of the link-up with the other organisations involved in this, including the Government and particularly the Department for Work and Pensions, I think this is a better home for it than where it was, the DfE.
I would be interested in getting some further understanding on the need for this to be a charity. According to the Charity Commission accounts, it is not eligible for gift aid. There is a lot of complexity in why someone is a trustee, when actually they are all appointed by the Secretary of State. The Minister may not have the answer today, but I would be grateful for a follow-up more broadly.
Lord Palmer of Childs Hill (LD)
My Lords, I thank the Minister for producing this order and giving us such welcome information. It is a key job of any Government to grow the economy, and productivity is central to that. This levy is a proven way to fund skills in the construction sector, because the market alone has not invested enough in training. The 2023 review confirmed that this problem still exists, so the case for keeping the levy is strong. Turning to the detail, the order keeps the current rates in place: 0.35% on directors’ pay and 1.25% on payments to subcontractors. These rates have not changed since the pandemic-era reductions ended.
I welcome the extra help for small firms. The exemption threshold is rising from £135,000 to £150,000, which means that 69% of employers will now pay nothing at all. There is also a 50% reduction for firms with wage bills of between £150,000 and £500,000, helping around 10,000 small businesses, I believe. This strikes a reasonable balance: it protects small firms while larger employers continue to pay their fair share, with no cap on their contributions. The Minister has given lots of statistics. There are so many statistics going around, some of which are contradictory.
As Liberal Democrats, we believe in partnership between employers and educators, and that is exactly how this proposal was developed. As we have been told, the CITB ran a formal consultation last year, called “Consensus”, and over 67% of levy payers backed the plans. Those firms represent almost 72% of the total levy value. This is a genuine mandate from the industry itself, not something imposed from above, and it is the right way to build support for a levy like this.
The sums involved are substantial. I believe the levy is expected to raise around £243 million a year between 2026 and 2028. Last year, the CITB raised £228.1 million and used it to fund £129.8 million in grants and £53.4 million in other schemes. This supported around 30,000 apprentices and, I believe, nearly 20,000 people in gaining a qualification. This is a serious investment in skills, and it costs the taxpayer nothing, since the CITB receives no grant from the Government.
The noble Baroness, Lady Coffey, mentioned charities. I should say that charities are exempt from the levy, but I would welcome hearing anything that the Minister can say in answer to the questions raised about them.
I have one question for the Minister: how will the Government check that this money is working? We need to see real gains in skills and productivity, especially given the scale of the construction skills gap across England, Scotland and Wales. I would welcome the Minister’s thoughts on that. As a nation—or, as the Minister said, nations—we need to up our game in providing training and reduce our reliance on imports to address skills shortages.
On the whole, we on these Benches support this order. It keeps a levy system that the industry itself backs, protects small businesses through a fairer approach and funds real training for a skilled workforce.
Baroness Spielman (Con)
My Lords, I thank the Minister for introducing this order. We support the continuation of the Engineering Construction Industry Training Board levy for the 2026, 2027 and 2028 levy periods. This provides continuity for the industry without imposing additional costs. As others have said, the levy system clearly commands the support of the vast majority of those who pay for it. It works precisely because it is driven by industry need. Companies understand their workforce requirements far better than Whitehall ever can. The role of government should be to create the conditions in which businesses can invest, recruit and train, rather than to control industries with centrally designed employment schemes.
But it is important to look at the levy in the context of both current and likely future pressures. The scale of the challenge is considerable. The Minister cited estimates of a need for another 40,000 workers by 2030. Demand is rising in nuclear construction and decommissioning, offshore wind, hydrogen, carbon capture and storage, industrial decarbonisation, and the maintenance of existing energy infrastructure. The industry is competing for workers with other infrastructure sectors that need the same skilled trades and technical professionals. The central challenge is how to make sure that the country has the capacity and skills to deliver projects that are already planned.
Employers are facing considerable difficulties in recruiting and training. The workforce is ageing and few new entrants are coming through to replace retiring workers in key occupations. We need more and better technical education. Undervaluing technical and vocational education is a perennial British problem that stretches back for well over a century, and good technical education is not cheap. Successive Governments have wrestled with this for decades, and I can say with confidence that the problem will not be solved by a few soundbites about parity of esteem or by an education policy that is driven by social justice ambitions and that treats educational excellence, national prosperity and growth as afterthoughts. The Government should be taking a hard look at their equivalence and performance tables policy which, over 20 years, has done so much to push young people at school away from technical subjects at GCSE and into non-technical classroom BTECs.
Baroness Smith of Malvern (Lab)
I thank the Committee for its contributions to the debate, and I welcome the noble Baroness, Lady Spielman, as this is the first time we have faced each other in her new role. I congratulate her on that.
The debate has underlined not only the importance of the ECITB’s work but the scale of the challenge facing one of our most economically vital industries, with a core workforce of 90,000 people and responsibility for £33 billion of output. As noble Lords have recognised, the industry plays a vital role in supporting our energy security, manufacturing capability and critical infrastructure.
As has come through clearly today, the engineering construction industry cannot meet the skills demands of the coming decade without a stable collective system of investment in training, alongside government support. I will return to this in a moment. The evidence is consistent that market forces alone will not deliver the pipeline of skilled workers that the industry urgently needs to meet the demand for new major infrastructure projects.
The ECITB’s levy is the mechanism that enables the collective benefits of a focused skills strategy for the engineering construction industry. It ensures that employers can access support for training and share the benefits of a skilled, competent and resilient workforce. It also opens opportunity, helping apprentices and other new entrants to complete high-quality training and helping existing workers to reskill or upskill to progress their careers.
I will respond to some of the specific points raised. The noble Baroness, Lady Coffey, rightly emphasised the need for success in the spending of the levy and the successful completion of training courses and apprenticeships. The ECITB has confirmed that it currently tracks apprentices and graduates while they are on programmes and receiving grant support. The data that the ECITB collects indicates a positive impact of its grant support on, for example, apprenticeship completion rates. Based on the ECITB’s latest available data for England, Scotland and Wales, of the apprentices who started an apprenticeship in 2020 and were supported by ECITB, 78% have successfully completed their apprenticeship as of December 2025. While we have seen improvements in the completion rates of apprenticeships over recent years, I think that is above the average rate.
The noble Baroness also raised the question of when the annual reports and accounts will be published for 2025. They will be laid in the autumn.
On the point about charitable status, it is not determined by the Government; it is determined by whether an organisation’s purposes are exclusively charitable and legally deemed to provide a clear public benefit. It was therefore a decision for the training bodies themselves—CITB, equally, is a charity—to take on that charitable status.
The noble Lord, Lord Palmer, raised the success of the levy consultation. It would be fair to say to the noble Lord that there are a lot of statistics around. Some of the statistics the noble Lord quoted related to the Construction Industry Training Board rather than the Engineering Construction Industry Training Board; perhaps it would be easier were the Government to decide to go ahead with the merger of the two. Nevertheless, they are different sizes and they do different jobs. The point he made is right: for the ECITB there is, if anything, an even greater level of approval as a result of the levy consultation than the figures he quoted.
Several noble Lords rightly cut to the chase of what the ECITB is responsible for. In other words: what does it actually do, and how, in the broader context, are the Government supporting the need for skills in the engineering and construction industry? On the former, the ECITB continues to invest in skills hubs, training standards and competence assurance across key sectors, including energy, nuclear and renewables. It has supported more than 6,900 new entrants since 2022 and invested £32.6 million in 2025 in training grants and new entrant programmes. During 2024, the ECITB funding supported over 2,000 new entrant starts, including over 1,000 apprentices and 500 graduates. Almost 64,000 learners were trained or assessed using ECITB-approved products, including more than 31,000 learners achieving industry-recognised safety passports and 2,763 learners supported through competence-related programmes. Of course, while the ECITB and the levy we are discussing are important for addressing some of the market failure in delivering skills in the engineering construction industry, it is just part of the broader work the Government are doing to support the engineering construction industry and wider skills. This relates to the points made by the noble Baroness, Lady Spielman.
The Government are delivering significant investment to strengthen engineering construction skills, as part of wider reforms, helping employers to respond to current and future workforce needs. This includes an additional £1 billion of investment to help deliver around 50,000 more apprenticeship opportunities for young people over the coming years—that is particularly important given the 40% fall in young people’s apprenticeships over the last years of the last Government—alongside increased flexibility through the new growth and skills levy and specific sector skills packages in engineering and construction that are worth over £800 million.
Additionally, we are providing targeted incentives for employers, including payments of up to £2,000 for taking on foundation apprentices. We have developed a new foundation apprenticeship in engineering, helping more young people to enter skilled careers, as well as other incentives, particularly for taking young people who may have been out of work on to these apprenticeships. We have continued and in fact increased investment in skills bootcamps and increased devolved approaches through mayoral strategic authorities, enabling local areas to respond to local employer demand and skills shortages.
The noble Baroness specifically raised technical and vocational education. I reassure her that this Government’s action, even in the two years that we have been in government, goes far beyond the soundbites that she characterised. A major reform of post-16 education is in progress, and stronger vocational routes are being developed through the new V-levels, an expansion of the possibility for young people to gain an in-depth technical education through T-levels, improved level 2 qualifications to get young people on to those vocational routes, and the investment I have already outlined in turning around the fall in the numbers of young people who have been able to start apprenticeships, ensuring that those opportunities are available for young people in the future.
Together with the ECITB support, these measures will strengthen the pipeline of skills available to the engineering construction workforce and support the delivery of major infrastructure projects across Great Britain. I hope that, in responding, I have reassured noble Lords about the role of this levy order, its importance in supporting the needs of small and larger businesses, ensuring maximum impact and value for money from employers’ levy contributions, and the important role the ECITB plays in ensuring that this key industry for growth, the development of infrastructure, energy security and manufacturing capability is supported both by the ECITB and the wider policies of this Government.
Baroness Spielman (Con)
Can the noble Baroness address my question about the impact of government policies enacted over the last two years on the engineering construction sector, particularly increased national insurance and employment rights?
Baroness Smith of Malvern (Lab)
I spelled out some of the impacts of the Government’s policy on the numbers of apprenticeships, the shift to vocational and technical education, the support this Government are providing to turn around the decline we have seen, and the £800 million of sector skills support we are providing for the industry. Is the noble Baroness genuinely arguing that this Government should now reverse the national insurance increases, which is where the investment in the National Health Service, which is also of considerable importance to employers, will come from? If she got her way and we reversed that, I think engineering employers, along with others, would not want their employees to be sitting on the waiting lists we inherited from the last Government.
Misuse of Drugs Act 1971 (Temporary Class Drug) Order 2026
(2 weeks, 5 days ago)
Grand CommitteeRead Full debate Read Hansard Text Read Debate Ministerial Extracts
Lord Hanson of Flint
That the Grand Committee do consider the Misuse of Drugs Act 1971 (Temporary Class Drug) Order 2026.
Relevant document: 6th Report from the Secondary Legislation Scrutiny Committee
The Minister of State, Home Office (Lord Hanson of Flint) (Lab)
This instrument, laid before Parliament on 10 June, takes urgent action to control a new and very dangerous class of synthetic opioid. In the space of little over a year, orphines have been involved in at least 22 deaths in the United Kingdom, and 14 of those deaths were sadly between December and March. The UK is not alone in this respect: between 2024 and April this year, the United Nations Office on Drugs and Crime received 206 reports from numerous countries of drug samples that contained orphine compounds.
I am particularly grateful to the Advisory Council on the Misuse of Drugs for prioritising an assessment of these deeply harmful substances. Its report was published on 30 April, and the dangers we face here are encapsulated in the following line from that report:
“the risk to the population from these recently emerging compounds is sufficiently great that urgent steps are required to protect public health”.
The Government have heard that message loud and clear, and we are acting at pace. We enacted a temporary class drug order, TCDO, to control these drugs, less than six weeks after the council produced its report. The TCDO covers seven orphines: three that have tragically been involved in those deaths here in the UK, and four that the EU Drugs Agency has notified as being present in EU drug markets.
This is the first TCDO in 10 years, so I will take a moment to remind noble Lords about what these orders do. A temporary class drug order makes it a specific offence to produce, supply or offer to supply these seven orphines; to export or import them; or to possess them when there is also an intention to supply. Doing any of these things can result in up to 14 years in prison, the same as for a class B drug.
The TCDO also provides that the substances should be treated as if they were in Schedule 1 to the Misuse of Drugs Regulations 2001. Scheduling here covers the circumstances in which a controlled substance can be used legitimately, and the procedures that must be followed in doing so. Schedule 1 covers substances with no known medical uses, which is the case with these seven drugs. Anyone who needs to make legitimate use of them, for example in research, would need to apply to the Home Office to obtain a licence.
This instrument uses the made affirmative procedure. This reflects a balance between the requirement to put in place urgent measures to safeguard public health and the need for proper parliamentary scrutiny of measures, which expand the scope of criminal law. Under the provisions of the Misuse of Drugs Act, the TCDO must be approved by both Houses of Parliament within 40 days of it being made. I know noble Lords will be pleased to note that the other place, the House of Commons, approved it last night, and I hope this House will do so by Friday’s deadline.
My colleague Sarah Jones MP, the Minister for Policing and Crime, also accepted the further recommendation from the advisory council that the TCDO be followed by a permanent control, which would make orphines class A drugs. This would cover not only these seven substances but also two “generic definitions” of orphines. The purpose of those is to make it harder for criminals to circumvent the controls by making slight tweaks to the chemical composition of what they sell. Noble Lords will doubtless agree with colleagues on the Secondary Legislation Scrutiny Committee that the class A control should come into force swiftly. So, although I am not able to give a precise timetable today, I can confirm that we will act as soon as possible.
Self-evidently, the devastation that harmful drugs inflict on our society is intolerable, and it demands a response commensurate with the scale of the threat. The order before the Committee today stands as further evidence of the Government’s commitment to mounting such a response. I beg to move.
Lord Cameron of Lochiel (Con)
My Lords, I thank the Minister for bringing the order before the Committee. It is a simple and uncontroversial order, and I am pleased to support it. As the Minister established, the purpose of this legislation is to make a temporary class drug order under Section 2A of the 1971 Act in respect of seven substances that fall under the category of orphines, which are a class of synthetic opioids that have been recommended for control by the Advisory Council on the Misuse of Drugs. Given the reports that the UN Office on Drugs and Crime have received regarding the presence of orphine compounds in drug samples and their links to deaths, the Government are absolutely right to seek to control these substances.
However, I seek a couple of clarifications. As its title suggests, this order makes a temporary class drug order for the listed substances. I note that Section 2A of the 1971 Act states that TCDOs expire within one year of the order being made, which means that the Government will need to come forward within one year with a new Order in Council under Section 2 of the Act that lists these substances as controlled drugs. If the Government do not do that, these substances will cease to be controlled, so will the Minister confirm that the Government will bring forward a new order within that timeframe?
As a linked query, it is interesting that the Government have sought to make a TCDO now rather than simply to bring in an Order in Council. Why make a temporary order and then a permanent order later? There is an argument for the Government to have added these substances straight away to Schedule 2 to the 1971 Act. If we accept that they cause enough harm to justify a temporary order, surely they should be controlled permanently in the first place. I would be grateful if the Minister could explain the rationale for their approach.
Other than that, as I said at the start, I am more than happy to support the Government in their endeavours on this order.
Lord Hanson of Flint (Lab)
I am grateful to the noble Lord, Lord Cameron of Lochiel, for his broad support for the order. As he said, it is quite sensible that we do this, but he asked two legitimate questions. In answer to his first question, we are mindful that the TCDO lasts for just one year and we will lay a permanent control before Parliament as soon as possible, as the Secondary Legislation Scrutiny Committee has urged us to do. I cannot give the noble Lord a timescale for that but, self-evidently, with the expiry of the order, we want to get that done and make sure that it is covered as a whole.
As the noble Lord said, we could have brought in an urgent, permanent class A control, which the advisory council has suggested is preferable. However, controlling new substances as class A, B or C drugs takes some time, and rightly so. Such controls expand the scope of the criminal law and amend primary legislation, and it is right that Parliament has the opportunity to scrutinise them. That is precisely why the legislation also allows for these temporary class drug orders. They do everything that class A, B or C controls do, except that the maximum sentences are not as long as for class A drugs.
I say with due respect to my colleagues in the Privy Council, of which I am a member, that the need for the relevant order to be made at the Privy Council adds some weeks to the process, and there is no real need for that at the moment. In the previous Session of Parliament, the Government supported a Bill sponsored by the honourable Member for Gloucester which would have removed this requirement. For the moment, we think that we can put the controls in place, mindful of the expiry, and revisit that in due course. We will look at the longer-term procedure more slowly, but the purpose of this order is to make sure that we put some definitive controls in place on the seven new opioids that have, sadly, caused deaths in the past year. I hope that that answers the noble Lord’s questions.
House of Lords
Business Hiring
(2 weeks, 5 days ago)
Lords ChamberRead Full debate Read Hansard Text Watch Debate
Lord Hunt of Wirral
To ask His Majesty’s Government what assessment they have made of current business hiring intentions and their implications for the wider economy.
Baroness in Waiting/Government Whip (Baroness Ramsey of Wall Heath) (Lab)
The UK labour market and economy remain resilient despite geopolitical uncertainties. The UK had the fastest-growing economy in the G7 in the first quarter of this year. For the labour market, ONS data shows that there are 399,000 more people in work than a year ago, and its business insights survey shows that over 80% of businesses intend to either maintain or increase their staff levels in July this year.
Lord Hunt of Wirral (Con)
My Lords, on behalf of the House, I welcome the Minister for her first Question. But is she aware that, last week in the other place, speaker after speaker condemned the Employment Rights Act, the impact of the increase in national insurance contributions and regulations generally, which have created the largest number of young people not in education, employment or training for well over 10 years? Is she further aware that the other place then proceeded to pass a Motion, without one vote against, to say that the Government should change course to support summer jobs, flexible working and seasonal work? Does the Minister accept that judgment of the elected House? What specific changes of policy is the new Prime Minister, Mr Burnham, going to bring in?
Baroness Ramsey of Wall Heath (Lab)
That is a nice and easy first question. It is an honour, and slightly terrifying, to answer my first Oral Question from a previous Secretary of State for Employment. It is, however, a very interesting Question.
Summer jobs—particularly in hospitality, retail and tourism—are often a young person’s first step into the labour market. My own first summer job was as a guide at the Black Country Museum. As a Government, we are not complacent about the challenges that we face. The Government are investing £2.5 billion through the youth guarantee and the growth and skills levy to support almost 1 million young people and create up to 500,000 opportunities to earn and learn. This includes expanded work experience opportunities, skills boot camps, foundation apprenticeships, sector-based work academy programmes and incentives for employers to hire young apprentices. Alongside this, the Government are supporting hospitality businesses through business rates reforms, sector-specific funding and measures to boost summer demand.
Lord Fox (LD)
My Lords, the Minister’s statistics match mine. There has been a bit of an uptick in employment, but not in one area: graduates. Graduates are facing a terrible time. Entry-level hiring has dropped to a 13-year low, and it dropped by 45% in January this year. There are graduates with excellent degrees from very good institutions who are receiving literally hundreds of rejections. So widespread has this become that it is deeply demoralising for an important section of society who cannot even get an interview, never mind a job. Does the Minister accept that this is a market failure? If she accepts that, what are she and her colleagues going to do to fix it?
Baroness Ramsey of Wall Heath (Lab)
I thank the noble Lord for his question but remind him that, thanks to our industrial strategy, employment is rising. Employment rights are improving too. We are determined to reduce unemployment further, especially among the young, which is why we are investing so much in the youth guarantee and are poised to go further when the Milburn review reports back later this year. I am aware of the situation where AI recruiting is impacting on graduate appointments and recruitment, and I am also aware that the Government have issued guidance to employers to ensure that this is a reducing problem, not an increasing one.
Baroness O’Grady of Upper Holloway (Lab)
My Lords, is my noble friend aware of the latest Manpower survey of employers that reports a surge in hiring intentions for the third quarter of this year, placing the UK in the top division of the global league? Does she agree that any efforts to suggest that stronger workers’ rights hit hiring intentions do a disservice to the many decent employers who already offer enhanced sick pay and other stronger protections?
Baroness Ramsey of Wall Heath (Lab)
Yes. As my noble friend quite rightly points out, it is very encouraging to see Manpower reporting an 18 percentage point increase in businesses planning to recruit since last year, and also reporting that we have the fourth most positive hiring outlook globally. That is undeniably good news, though I am sure the whole House will agree with me when I express my keen hope that the England men’s football team goes beyond fourth to become the very best team globally by the end of the week—with apologies to Welsh, Northern Irish and in particular Scottish colleagues across the House.
On the second part of her question, I completely agree with my noble friend that our country has many good employers who see absolutely no conflict between protecting their employees from the consequences of ill health, for example, and running successful companies that compete profitably.
Lord Londesborough (CB)
My Lords, the Government’s White Paper Get Britain Working aims for an 80% employment rate, but 20 months on we remain stuck at 75%. With the recent steep drop in new recruits, can the Minister, who I welcome to her position, point to where these 2 million net new jobs will be coming from?
Baroness Ramsey of Wall Heath (Lab)
I thank the noble Lord for his question. The UK’s employment rate is in the top half of the OECD economies and is above the G7 average. Unemployment also remains low by international standards: in the bottom half of the OECD and lower than Canada, France and the euro area average. The UK has the third-highest employment rate in the G7. Employment is up, inactivity is down and wages continue to grow. We are particularly pleased to see that 399,000 more people have moved into work in the past year.
The Lord Bishop of Manchester
My Lords, the area of Greater Manchester, which is largely coterminous with my diocese, has been showing better growth and better employment figures than most other parts of the country. I wonder whether the Minister might reflect that what the wider country needs is a good dose of Manchesterism.
Baroness Ramsey of Wall Heath (Lab)
That is a very topical question from the right reverend Prelate. Greater Manchester has shown the value of putting decisions closer to the people and places they affect. Ambitious growth plans are at the heart of its strategy, linking jobs, skills and public services. Collaborative local leadership has supported pathways into work, enabled by infrastructure connecting people to opportunities. Jobs have also flowed from procurement and investment. One of the benefits of devolution is enabling innovation. We look forward to sharing the learning from the success of Manchester across the country.
Lord Deben (Con)
My Lords, my family owns the local pub, and therefore I can speak from trying to employ people. We have very high employment standards in our business, and we have had to reduce staff because of what the Government have done on employment taxes of all kinds. That is true of the whole hospitality industry. It is all right for people to groan, but those who are actually running pubs know that we are closing one after another because the Government have not helped us; they have made life much more difficult.
Baroness Ramsey of Wall Heath (Lab)
We are not complacent. I hear what the noble Lord says. We have introduced permanently lower business rates for retail and hospitality properties. The average pub gains £1,650 this year, and that is in addition to increased hospitality support of over £10 million funding over the next three years. For young people in pubs and hospitality, we are introducing hospitality foundation apprenticeships.
Lord John of Southwark (Lab)
My Lords, I also congratulate my noble friend on her well-deserved appointment. Many of us will share the concerns about the number of young people—16 to 24 year-olds —not in education, employment or training at this time. She has already mentioned the Milburn review, but can she tell the House what she hopes the Milburn review will do to help that young cohort of our people so that their futures are not blighted?
Baroness Ramsey of Wall Heath (Lab)
Alan Milburn’s review has reported on an interim basis, and we are expecting the full report in September. This Government will not leave an entire generation of young people behind. We are investing an additional £2.5 billion into the youth guarantee and the growth and skills levy to support nearly 1 million 16 to 24 year-olds into work, education or training. Over the next three years, this investment will deliver up to 300,000 opportunities for workplace experience and training and will unlock up to 200,000 jobs through the £3,000 youth jobs grant to employers and the £2,000 apprenticeship hiring payment for SMEs.
Autism: Parenting Support Programmes
(2 weeks, 5 days ago)
Lords ChamberRead Full debate Read Hansard Text Watch Debate
Baroness Leaman
To ask His Majesty’s Government what assessment they have made of the availability of parenting support programmes for families following a child’s diagnosis of an autism spectrum condition; and what plans they have to improve access to support.
Baroness in Waiting/Government Whip (Baroness Blake of Leeds) (Lab)
My Lords, we fully recognise the difficulties that families face in accessing the right support following a child’s autism diagnosis. In local areas, post-diagnostic support may be accessed via health, social care, education, and voluntary and community services, depending on what the individual needs. Alongside local support offers, a national peer education programme, Autism Central, is available for families and support networks of autistic people. The Government are reforming the SEND system to improve access to earlier support.
Baroness Leaman (LD)
My Lords, I thank the Minister, although her Answer confirms that no assessment has been made of the adequacy of parenting support programmes and that data is not held centrally. Earlier this year, Open University research found that only one in four parents of neurodivergent children feel confident in the advice they receive. Will the Minister commit to collecting national data on waiting times and capacity so that progress can actually be measured?
Baroness Blake of Leeds (Lab)
The noble Baroness raises a very interesting point. One of the most important directions of travel is that we robustly increase capacity at a local level, to bring together all the key people so that we get an accurate picture of what is happening. That can then be collated up to national level, but it is local decision-making, and the involvement of families themselves, who can bring so much information to the table, that is key.
Lord Patel of Bradford (Non-Afl)
My Lords, can I go back one step? Many families wait months, if not years, before receiving a diagnosis. Approximately how many children and young people are currently waiting for an autism assessment, and what support is available to them and their families during that period, rather than waiting until a diagnosis has actually been made?
Baroness Blake of Leeds (Lab)
The figures that we are working from say that 270,701 people were waiting for an autism assessment in March 2026. We know that the average waiting time for assessments varies across the country: for 0 to 17 year-olds it is about 67 weeks, and for patients aged 18-plus it is about 20 weeks. The noble Lord is absolutely right to stress the importance of not having to wait for the actual diagnosis before things are put in place. That is why we are putting such focus on SEND reforms in schools and in early years provision, to make sure that we get early assessments and can put in place the support that we know is available as early as we possibly can.
Baroness Pitkeathley (Lab)
My Lords, while acknowledging the great importance of services to these families, will my noble friend the Minister also acknowledge the importance of peer support in these circumstances and commend the work of the many charities enabling families in the same circumstances to talk to each other, to share information and to get support?
Baroness Blake of Leeds (Lab)
It will not come as any surprise to noble Lords that I support my noble friend completely on this. In those early days when the suspicion starts to arise, there is absolutely no substitute for having someone you can go and talk to in confidence, without escalating a situation, and to share experiences with. As she rightly highlights, the charity sector can signpost people to the support available and show them how to get on track in the system, moving towards diagnosis and further support.
Lord Sterling of Plaistow (Con)
My Lords, even if we had all the money in the world, I suggest that our real problem is that it will take years to build up the number of people who understand this and have the relevant experience. How would the Minister respond to that view?
Baroness Blake of Leeds (Lab)
The noble Lord raises an interesting point. At the moment, we are talking more openly and exchanging more information about what is actually happening because more people are sharing experiences, putting in place support networks and raising awareness. There are still too many people—whether in our education sector or in businesses and employment—who do not understand the needs of autistic people in particular, although we are talking about learning disabilities across the piece. We are on a very steep learning curve, but the most important thing is that we get provision in place to help people at the time of greatest need.
Lord Addington (LD)
My Lords, the Government sound very confident about this, but on the 29th of last month, in Committee Room 10, I was in a room full of parents of people on the autism spectrum who have gone through the process. Generally, they were terrified of the idea of integration into schools with untrained staff—schools in which their children have already spent their time in corridors or quiet rooms, with one TA looking in occasionally. Will the Government give an assurance that supported special schools will be part of this and that integration will not be done as a religion but merely when it is appropriate?
Baroness Blake of Leeds (Lab)
I have heard the noble Lord speak about this many times, and I reassure him that there will not be a one-size-fits-all approach to this. It is vital to recognise that there are young people who have particular needs that will be addressed through specialist schools, for example. However, there is so much evidence that, if we get this right—by putting in the investment, putting in the training that we are funding and working with young people—the benefits of integration and inclusive learning, where they are being done successfully, are enormous. The noble Lord is right that it is important that we get this right. I understand the nervousness, particularly from parents who have spent a lot of time getting their cases heard, so it is up to us to make sure that we go out and give the reassurance that their needs will not be left behind.
Baroness Nargund (Lab)
My Lords, research has consistently shown that mothers make up the majority of primary caregivers for children with autism spectrum disorder, often at the cost of their own health, well-being and employment. What specific support is available for these mothers in order to protect their health, well-being and paid employment?
Baroness Blake of Leeds (Lab)
It is a well-recognised fact that women bear the brunt of caring responsibilities, at whatever age they are presented. Raising awareness of this, making sure that it is understood and acknowledging how unfair the lack of support has been is pivotal in making sure that we arrange the support mechanisms that are required to move us forward.
Lord Bellingham (Con)
My Lords, further to the question from the noble Baroness, Lady Pitkeathley, about charities, I declare an interest because I am involved with a number of autistic charities in my old constituency in King’s Lynn and across Norfolk. Is the Minister aware that one of the biggest challenges is when these children who are on the autistic spectrum come out of college and try to find their way into further training or jobs? Can she comment specifically on what the Government are doing to help that transition?
Baroness Blake of Leeds (Lab)
The noble Lord touches on a particular obsession of mine. It is not just about the transition into adulthood, which is absolutely pivotal, but starts earlier than that and is about the transition through the different stages of education. We need to make sure that we completely get away from the awful situation where young people fall through the gaps and there is no information exchange. That is why cross-government working is so critical here. We need the education sector to talk to the health sector and DWP, to make sure that we have a holistic view of young people so that they can move on to the appropriate location and get the right support.
Lord Kamall (Con)
My Lords, in responding to the Question from the noble Baroness, Lady Leaman, the Minister confirmed that the Government have not assessed the adequacy of parenting support for families following a diagnosis and do not hold national data on either provision or waiting times. Does the Minister’s department intend to carry out that assessment nationally or to ask ICBs to collect that data locally? If not, without that information, how can the department be confident that families are receiving the appropriate level of support that they need?
Baroness Blake of Leeds (Lab)
I do not want to stand here and say that we have got things right. The system is broken and needs so much attention throughout. To pick up the noble Lord’s point about ICBs, the medium-term planning framework gives clear expectations for local ICBs and trusts. We need them to work to improve access, experience and outcomes, focusing on quality and productivity. So many areas have data and gather information, but they do not do anything with it. That is what we absolutely need to address, to make sure that we have an accurate picture and can make the appropriate assessments.
Violence Against Retail Workers
(2 weeks, 5 days ago)
Lords ChamberRead Full debate Read Hansard Text Watch Debate Read Debate Ministerial Extracts
Lord Walker of Broxton
To ask His Majesty’s Government what steps they are taking to tackle rising violence against retail workers.
The Minister of State, Home Office (Lord Hanson of Flint) (Lab)
Violence and abuse towards retail workers is unacceptable. Through the Crime and Policing Act 2026, the Government have created a new stand-alone offence of assaulting a retail worker, which we are working to commence as soon as possible. We are also restoring neighbourhood policing to tackle retail crime and improve safety for retail workers, with more than 3,100 additional neighbourhood officers and PCSOs since March 2025. I declare my interest as a long-standing member of the Union of Shop, Distributive and Allied Workers.
Lord Walker of Broxton (Lab)
My Lords, needles, knives and hammers are weapons regularly used by violent criminals—let us stop calling them shoplifters—against retail staff on our high streets. These incidents are now routine. For the next month, I will publish weekly summaries of violent attacks against my colleagues so that noble Lords can see the reality on the ground. While some improvements in police responsiveness are welcome, it remains a major issue. Will the Minister acknowledge that two-tier policing is real and issue clearer guidance to forces to ensure that violence against shop workers is properly prioritised?
Lord Hanson of Flint (Lab)
Violence against shop workers is properly prioritised. In fact, recorded shop theft fell by 1% in the year to December, the number of charges for shop theft rose by 21% over the previous year and a British Retail Consortium report has shown that violence and abuse fell from 2,000 incidents a day to 1,600. As somebody who has sat in a shop front and worked in a shop, I know that such abuse is not acceptable. I know the threats that people face. We have invested £5 million into Operation Opal, which is a specialist policing unit, so we do take this issue seriously. When we bring the measures forward, they will be a further deterrent to those who choose to attack shop workers and undertake shop theft. I welcome my noble friend’s support.
Baroness McIntosh of Pickering (Con)
My Lords, convenience stores recorded 5.8 million incidents in 2025 alone. The total cost of that was £354 million, with an average cost of over £7,000 per store. Not only is there the human cost on shop workers but the economic cost to convenience stores and larger stores. The Government must do more. What does the Minister intend to do?
Lord Hanson of Flint (Lab)
We have done two things that the previous Government did not do. We have introduced an offence of assault on a shop worker and lifted the £200 threshold under which the police did not have to report and act on shop theft. I remind the noble Baroness that, as a shadow Minister in the other place in 2014, I opposed the £200 limit and have since had the pleasure of lifting it as a Minister. We take this matter seriously. Shop theft is a cost to us all. It is a cost to the workers who face those threats, to the businesses—particularly small ones—and to all of us as purchasers of goods. We must drive it down. That is what the figures show that we are trying to do; it is not an easy task to drive it down still further, but we have to take further action.
Baroness Doocey (LD)
My Lords, violence against retail workers does not stop at the shop door. Staff who refuse unlawful sales or challenge theft can face online threats and harassment. This includes sharing their images and personal details. What steps are the Government taking to address this rapidly growing problem and ensure that online threats and doxing of retail staff are treated every bit as seriously as violence within a shop?
Lord Hanson of Flint (Lab)
The noble Baroness is absolutely right. It is not acceptable and should be looked at. The legislation covers those potential online threats in other areas, but the bottom line, going back to my noble friend’s Question, is that we are asking shop workers to uphold sales of cigarettes, alcohol, solvents and a whole range of other things and to help prevent people walking into a store feeling that they can steal something with no recourse whatever. We are trying to say through policing, the legislation that we have passed and support for the type of areas that the noble Baroness has mentioned that shop theft—I will not call it “shoplifting”—is unacceptable. We need to drive it down.
Baroness Hazarika (Lab)
My Lords, I thank my noble friend for the work that he has done on this and for taking the time to come to Brixton recently to meet shop workers in my community, many of whom told him some harrowing stories of the violence that they have faced. He heard that a small number of relatively persistent shop offenders are responsible for quite a lot of the theft. What work has been done to target those persistent offenders and what role can technology play, particularly facial recognition technology?
Lord Hanson of Flint (Lab)
My noble friend is right. I was pleased to visit Brixton with her some months back to look at this issue and to see the impact of shop theft on a range of shop owners. We have given additional resources to specific police forces, including the Met, to deal with town centre disturbances and shop theft. That operation is ongoing. The Policing Minister in the Home Office chairs a regular meeting with the lead chief constables on this matter. We have also put great emphasis on looking at the range of other issues, including facial recognition for persistent offenders. There has been a consultation on that recently, which we intend to respond to shortly. Overall, if there are persistent offenders, we have a range of mechanisms, including those passed through the Crime and Policing Act, such as respect orders banning people from particular areas of a community. I hope that the full force of all those will further reduce this plague.
Baroness Fox of Buckley (Non-Afl)
My Lords, last week I met a group of retail workers from across the country, not represented by the big trade associations but from local convenience stores and corner shops. Is the noble Lord aware that their specific concerns at present focus on the violence coming from pop-up vape shops? These are a blight on our high streets and are fronts for black market sales, especially of cigarettes, which the workers believe are one of the unintended consequences of the Tobacco and Vapes Act. Following the BBC and Channel 4 exposés of this murky world, often populated by thugs and illegal migrants threatening legitimate retailers, will the Minister meet these small businesses to discuss these very specific threats?
Lord Hanson of Flint (Lab)
I am always happy to meet any businesses with colleagues. We have put £10 million of funding, announced in the Budget, into the very issue that she mentioned. We have increased dedicated support for the National Crime Agency to tackle high street money laundering. We have had a multi-agency crackdown on money laundering through the high street. We have had an HMRC targeted surge against tax evasion and illicit finance in the high street, and we will undertake further closures of premises that are not performing as they should, because they are undermining legitimate businesses. A lot has been done, but I accept that there is a lot more that can be done.
Lord Cameron of Lochiel (Con)
My Lords, if the Government are truly committed to tackling retail crime, such as shop theft and violence against retail workers, they need to improve enforcement and policing. Have the Government given any consideration to hotspot policing, whereby more officers are deployed to areas with particularly high rates of crime and greater use is made of stop and search?
Lord Hanson of Flint (Lab)
Yes, we have. We have highlighted particular areas through the policing assessment of shop theft, and we have identified a number of areas where we have been able to put in resource to do that. We have also, dare I say, increased the number of police officers on the beat. We have a commitment to increase that by a significant number. We have managed 3,100 in the 18 months or so that we have been in office, and we intend to increase that. With our police reforms, we intend to give additional support to look at what the priorities are at a local level, with smaller police forces more focused on neighbourhood policing. I look forward to the noble Lord’s support on those measures.
Lord Pannick (CB)
The Minister has mentioned new offences, more resources and more charges. Does he accept that the effect of these welcome measures will be undermined unless offenders are brought to court speedily? Does he accept that, at the moment, the delays in bringing these matters to court are far too great and the deterrent effect is severely undermined?
Lord Hanson of Flint (Lab)
We take a whole of government approach to this. One of the reasons why we are looking at the range of issues on retail crime implementation is to make sure that we can manage new pressures in the system. The noble Lord is right: it is important from the Home Office’s perspective that we catch them or prevent them, but for the Ministry of Justice and other departments it is important that we have speedy justice and, if need be, imprison them. That is a whole of government approach. The key point I would leave the House with is that this is a really important issue.
Baroness Sater (Con)
My Lords, at a meeting of the APPG on Sport and Physical Activity in the Criminal Justice System, which I co-chair, Nike highlighted the growing scale of retail theft and violence against shop workers. Given the evidence that sport and physical activity can support early intervention, diversion and rehabilitation, I would be grateful if the Minister would be willing to work with organisations in the sector to explore how these approaches could form part of the Government’s wider strategy to tackle retail crime.
Lord Hanson of Flint (Lab)
It is extremely important that we prevent crime. That is why it is important that we go back to the ultimate basics on this. If people at school age involve themselves in retail crime, there need to be efforts and support to give them an alternative lifestyle. Retail crime does grow, and people who engage in what they would term low-level activity will find themselves at some time doing higher-level, more damaging activity. I go back to the basic principle that shop theft damages the shops, it damages all of us as consumers, it damages the individuals who undertake it and we have to try to drive it down. To do that, we have put in place measures on prevention of retail attacks and measures of change to shift the balance so the police can focus on shop theft. On the point the noble Baroness made about early intervention, if people are involved and come to the attention of the authorities, there should be mechanisms to help support them to turn away from that life.
National Crime Agency: Reform Party Funding
(2 weeks, 5 days ago)
Lords ChamberRead Full debate Read Hansard Text Watch Debate Read Debate Ministerial Extracts
Lord Bassam of Brighton
To ask His Majesty’s Government how many Suspicious Activity Report enquiries are currently being conducted by the National Crime Agency concerning the funding of the Reform Party.
The Minister of State, Home Office (Lord Hanson of Flint) (Lab)
The Government do not comment on the submission of suspicious activity reports. The National Crime Agency is operationally independent and has been clear in its statements that it does not confirm or deny the receipt of a suspicious activity report nor comment on how such reports are used. Suspicious activity reports are confidential and breaching that confidentiality risks committing a tipping-off offence under the Proceeds of Crime Act 2002.
Lord Bassam of Brighton (Lab)
Notwithstanding the Minister’s honest Answer, perhaps he can advise the House on how many suspicious activity reports the Government would expect to be lodged against political parties annually as a result of political donations. Does the Minister agree with me that it is extraordinary for a party, Reform UK, which pitches itself as being anti-establishment and always claims the moral high ground in politics, to be reliant on funding from questionable—not to say dodgy—donors?
Lord Hanson of Flint (Lab)
I always try to be helpful, but, for the reasons I have mentioned, I cannot give information to the House or to my noble friend on the number of reports that are taken. I can say that it is in the interest of all of us in this House to make sure that our politics is clean and not funded by illegal sources, and that we take action to make sure that all political parties are held to account for the funding they receive to exercise their political activity and to get themselves elected—or not, as it may be. I am very happy to talk through the details of the Rycroft review; the Government have received the review and have accepted all the recommendations made. That includes a range of measures, which I think my noble friend will welcome, that will put great pressure on a number of political outlets, which will find that their involvement in some of the areas that the Rycroft review is trying to tighten will make it much more challenging for them to receive donations from various sources.
Lord Jackson of Peterborough (Con)
My Lords, on the subject of alleged dodgy donations, can the Minister update the House on whether the Cabinet Office or the Electoral Commission is able to commence or conclude inquiries into the £740,000 of secret, undeclared donations generated by Labour Together and funnelled to Labour Party members, including MPs Nick Thomas-Symonds, Darren Jones and others? Is he aware that calls for an independent inquiry were backed by Labour MPs in the other place via an EDM in May? Failure to properly deal with this scandal definitively simply undermines faith and trust in party funding and politics.
Lord Hanson of Flint (Lab)
What I will say to the noble Lord is that I think it is important we have clean financing of political parties. I refer him to the Rycroft review—let me say some of the things we have agreed and accepted that we will have: a cap on donations from overseas electors; a tightening of corporate donation rules; a moratorium on crypto donations, which will be of interest to my noble friend Lord Bassam; strengthened non-party campaigner and candidate controls; strengthened “know your donor” checks; and standardised political financing reporting. Any political party that wishes to adopt clean funding should sign up to those principles, and, when we bring measures before the House, I trust that the noble Lord will support them. I will look at what he said with regard to Labour Together, but I also say to him that we should try to take the party politics out of this and have an even and level playing field, so that all political parties know who has been funded, why and how, and ensure that those fundings are clean, transparent and open.
The Earl of Kinnoull (CB)
My Lords, is it not the case that one thing that has allowed Reform and Nigel Farage to get off a little here is the sheer complexity of electoral law and the whole area around this? We are about to start consideration of the 27th Representation of the People Bill, and the 26 others are not consolidated; is there not a good case for the Government to decide that we need to consolidate electoral law? In the simplicity that might follow that, there would be greater control over dodgy dealings in party funding.
Lord Hanson of Flint (Lab)
The Bill that the noble Earl mentions will probably now go before the House of Commons in September: it was due this week, but we have put the Hillsborough law in place this week, which I welcome, and that has been moved back. It is important that we have clear electoral law. He tempts me to talk about issues that are not my direct departmental responsibility, but I will reflect on what he has said, listen carefully to representations and pass them on to the appropriate Minister.
Lord Pack (LD)
My Lords, the National Crime Agency gave evidence to Parliament earlier this year in which it said:
“There are quite a lot of our covert powers … that we can only use if the sentence is three years or over”.
However, many political finance offences do not have a tariff of three years or over. Therefore, the NCA is not currently able to use its full range of investigatory powers to ensure that it is playing its role in keeping our politics clean. That is a topic that the Rycroft review raised, but so far the Government have not tabled any amendments to the Representation of the People Bill to rectify this loophole in our investigatory framework. Will the Minister commit to looking at this issue again with colleagues over the summer and make sure that amendments are tabled in the autumn so that we can close this loophole?
Lord Hanson of Flint (Lab)
As I said to the noble Earl, Lord Kinnoull, Report and Third Reading of the Representation of the People Bill will take place as soon as parliamentary time allows. I am not the Minister directly responsible for that Bill, but I will pass on the noble Lord’s comments. I hope that I share with the noble Lord the aspiration of ensuring that we put as tight a ring as possible around those donations, so that there is transparency, clarity and openness, and so that, if any amendments are made, the National Crime Agency has the independent policing ability to follow through.
Lord Carter of Haslemere (CB)
My Lords, as I understand it, the Electoral Commission will be given the power to share information with third parties, which is very welcome and long overdue. But will it also be given the power to require information from third parties, which is normal for any regulator that one can think of, with tough sanctions for non-compliance?
Lord Hanson of Flint (Lab)
One of the Rycroft recommendations is that we standardise political finance reporting, and the Government have accepted that. Accepting that means that we have given the Electoral Commission powers to prescribe standardised reporting formats. We are continuing to work with the Electoral Commission on a number of other areas. I will reflect on what the noble Lord has said.
Lord Cameron of Lochiel (Con)
My Lords, the Labour Together episode has already been mentioned. Not only did that organisation fail to declare donations but it paid to have journalists investigated. Does the Minister agree that it would be inappropriate for anyone involved in these scandals to be given a senior role in government?
Lord Hanson of Flint (Lab)
Ultimately, who gets senior roles in government is a matter for the Prime Minister. The Prime Minister will make a judgment on that and, with due respect, I do not think he will be taking advice from the Conservative Front Bench on whom he appoints.
Lord Watts (Lab)
My Lords, no matter what action is taken by the Government, dodgy people will try to find a way around it. Will the legislation be drafted in such a way that it is flexible enough to take into account things that might happen in the future?
Lord Hanson of Flint (Lab)
The acceptance of the Rycroft recommendations means that the Government have accepted a whole range of measures on tightening up political donations from overseas, crypto currency, reporting and transparency. We have yet to put those measures into effect, but we have accepted the recommendations and will bring forward legislation to give effect to them at the earliest opportunity. That will help everybody in this House, from His Majesty’s Opposition to the Government to other political parties represented here, to have that transparency. I look forward to taking that forward in due course.
Lord Hayward (Con)
My Lords, further to the question from the noble Earl on the Representation of the People Bill, pages 104 to 193 of that Bill are there only because the legislation has not been consolidated. The people who have spent their time preparing all those pages could have spent their time preparing consolidation. When the Bill comes to our House, we will waste time debating things that would have been much better considered as a consolidated piece of legislation. I have had a very good discussion on this subject with the noble Lord, Lord Lemos, because it appears to be an enormous waste of time.
Lord Hanson of Flint (Lab)
The department I am responsible for is about making sure that, through the National Crime Agency and policing, we catch those people who are committing offences under legislation. The framing of future legislation, which the noble Lord just mentioned, is a matter for another government department. But, with the involvement of the Home Office, the Rycroft review recommendations have been accepted, we have introduced a moratorium on political donations through crypto assets, and we are progressing wider reforms through the Representation of the People Bill. The point about consolidation, which he and the noble and Earl mentioned, is one that I am sure my noble friend Lord Lemos will reflect on.
Cheltenham Borough Council (Markets) Bill
Supply and Appropriation (Main Estimates) Bill
Tuesday 14th July 2026
(2 weeks, 5 days ago)
Lords ChamberRead Full debate Supply and Appropriation (Main Estimates) Act 2026 View all Supply and Appropriation (Main Estimates) Act 2026 Debates Read Hansard Text Read Debate Ministerial Extracts
Death of Ann Widdecombe
(2 weeks, 5 days ago)
Lords ChamberRead Full debate Read Hansard Text Read Debate Ministerial Extracts
Lord True (Con)
My Lords, no 78 year-old woman deserves to be bludgeoned to death in her own home. The whole House will wish that the search for anyone who may have incited or abetted her cowardly killer will be far-reaching and remorseless and their punishment unbending. To those who sneered about Ann Widdecombe after the news of her death or, worse, welcomed her death, I say that to try to unsay such things when you learn of the manner of her death does not make it okay. Your shameful words are indelible, and their stain lies not on her but for ever on you. There is too much easy hatred in politics today. We must confront all its perpetrators and root them out.
There was no hatred in Ann Widdecombe. Strong principles? Yes, you sure knew where you stood. Convictions expressed with clarity? Certainly. A zeal to serve her community? Absolutely. Readiness to debate fiercely and then make up with a drink and a laugh afterwards? Very much so. People who knew her in the House of Commons say there was never a harder-working constituency MP. She worked for the causes in which she believed day in, day out, right to the very end. Her killer found her after one engagement, and he took her as she was preparing for her next one.
The response from her own community in recent days has shown how dearly she was loved by her neighbours and those with whom she so faithfully worshipped her divine creator at Buckfast Abbey. She was one of those rare politicians that non-politicians, real people, related to and liked. Yes, she was a character. She loved her country. My goodness me, how much she loved this land. Eccentric, maybe, but how English is that? My party leader, Kemi Badenoch, spoke simply and eloquently, as a woman of a woman, of the shock that we in the Conservative Party feel at the loss of a dear colleague of decades. Like Kemi, I reach out to the members of Reform, to whom Ann lately hitched her redoubtable wagon. Her loss is a loss, in my judgment, to the whole of public life, and it is another darkening of the happiness and the cheerful innocence of things.
I thank the Minister for the kind words that we have heard from the Government and from so many in the party opposite. Sometimes, we know that we are all brothers and sisters under the skin, on the same journey, for the same purpose of public duty. Ann’s death is another reminder of the real threats to many in public life. We remember David Amess, Jo Cox, Ian Gow, Anthony Berry, Robert Bradford, Airey Neave —all slain by terrorists while serving MPs.
I know that there is a limit to what the Minister will be able to say about the ongoing investigation, but the announcement that counterterrorism police are now leading the investigation has only deepened concern felt here in Westminster and across the country. The Home Secretary said that the suspect was not known to Prevent. Can the Minister give the House any update on latest information that he can share?
Understandably, there was much in the Statement about the advice available to MPs and new provision that may be made at the other end of this palace. Can the Minister say anything about what provision may be made for Members of your Lordships’ House, who are not free from daily threats of violence? We must never, ever close the gates of democracy, but we must safeguard all those, Members or not, who come to Parliament to serve their fellow countrymen and women.
Surprise has been widely expressed about the haste with which the Devon and Cornwall Police downplayed any idea that there was a political motive to this killing. Is the Minister satisfied with protocols for releasing information to the public in high-profile cases in this social media age? Will he commit to reviewing the handling of this case so that the right lessons are learned?
That is for the future. For now, all our thoughts and prayers should be with Ann’s family and friends. I know that the whole House will join with me in expressing our deepest sympathies to them all.
Baroness Doocey (LD)
My Lords, from these Benches, we join others in extending condolences for the death of Ann Widdecombe. The reaction to this tragedy has rightly included tributes from every party and from all sections of society. That is a reminder that, under fierce disagreement, there is a shared commitment to our democratic institutions and a shared vulnerability when violence enters political life.
Like every Member of this House, we were shocked and saddened by her death, the circumstances of which are subject to an active police investigation. The police have been clear right from the outset that they are treating this as a suspected murder. However, they have not yet established a motive. The situation seems to change constantly, and I suspect that it will continue to do so, as they uncover more and more evidence.
They have also asked us to respect their request not to speculate and to allow them to do their work. If only we could have the same lack of speculation on the internet and on social media. Would that not be great? Unfortunately, however, it is never going to happen.
Ann Widdecombe commanded widespread respect for her commitment to democratic debate and public services, first as a councillor, then as an MP for two decades, then as a Government Minister and, finally, as a Member of the European Parliament. This tragedy is a reminder that those who serve in public life should be able to do so safely.
We depend on people from all parties and none to put themselves forward and speak their minds without fear or favour, but my personal experience suggests that younger people, in particular, will not even consider the possibility of making politics their life. When you ask them, even though they are highly articulate and very happy to tell you what the Government should and should not do, they say, “We are not going to put ourselves forward to be shot down”. I honestly think that we all ought to work together to change this system. They should not be feeling like that. They should want to serve and realise how great it is to do so.
From these Benches, we send our sympathy to Ann’s family, her friends, her former colleagues, her constituents and her community, who will all be grieving her loss. Our responsibility now is to continue our arguments, definitely with seriousness but also with civility, and to give the police the space they need to establish the facts of her very sad death.
The Minister of State, Home Office (Lord Hanson of Flint) (Lab)
My Lords, I am grateful for the contributions from both the noble Lord, Lord True, and the noble Baroness, Lady Doocey. Everybody in this House knows that politics is about beliefs, about standing for things, and about making your views known. No one can deny that Ann Widdecombe did that in a way that was energetic, forthright, occasionally humorous and, unlike many Members of this House, occasionally on “Strictly Come Dancing”, which is important.
I spent 18 years in the Commons with Ann Widdecombe, and I cannot think of many areas where we ever agreed, but we disagreed with civility, with humanity and with mutual respect for views that we held. The loss of her in these circumstances is devastating for her family and for all who knew her, particularly for Members of this House who knew her as well. She brought conviction to our politics. She was forthright in her opinions. She argued courageously for things she believed in. She did not deserve to be murdered in this way.
As the noble Lord and the noble Baroness have mentioned, I cannot comment on the current police investigation; it is not appropriate for me to do that. What I can say in answer to the noble Lord, Lord True, is that the police are making a further statement on the developments in the murder investigation possibly as I speak—they were due to hold a press conference between 3 pm and 3.15 pm and they may well be doing that now; I am trying to check whether anything further has been said. It is important that we give the police time to examine that.
The issue that the noble Lord and the noble Baroness mentioned about Devon & Cornwall Police and the counterterrorism police is a step that has been taken in co-operation with both forces to look at further leads. It does not necessarily mean that terrorism was involved, but it is important that we give the police the opportunity to investigate. The counterterrorism police have now taken the lead on the investigation. As Laurence Taylor, the head of national Counterterrorism Policing, has said:
“We … have new information and evidence that means Counter Terrorism Policing is leading the investigation … We are pursuing multiple lines of enquiry to establish the motivation for this attack”.
Ann Widdecombe had an inimitable style in politics. She was valued by her own side and across both Houses of Parliament. She served Maidstone for 23 years as a champion for her constituents. She served the country in government as Minister for Employment and then Minister for Prisons. She served with pride and with a commitment that means that today we mourn her loss tremendously.
Both noble Lords who have spoken mentioned security for elected politicians. I can remember every case of the murder of a politician that the noble Lord, Lord True, mentioned. I have seen colleagues of mine, Jo Cox and Sir David Amess, murdered. I have watched from afar as Airey Neave, Ian Gow and Reverend Robert Bradford were murdered. It is not a way to do politics. We do our politics by discussion. It is important that we ensure that Members of Parliament and Members of this House have the support to be able to do that job free of fear. I do not think there is a single Member of Parliament who has not faced threats at some time or other, and many Members of this House do so as well.
Ultimately, it is the parliamentary authorities who are responsible for the security of this House, but we in the Home Office will work with them and we will continue to review how we can work with Operation Bridger, which is the police support, through local forces and through national support to ensure that we get that protection. It will be done on the basis of threat and of particular support for Members of Parliament who require it.
Ultimately, we will find out who murdered Ann Widdecombe and they will face a severe prison sentence in due course. But we should remember the contribution that Ann made and the affection in which she was held, and remember, dare I say, the differences we had. We should engage in our parliamentary democracy and our public life to reflect those values in the way in which we know they should be reflected—mutual respect, honest disagreement and sometimes open discussion. Ultimately, we should recognise that Parliament is there for a purpose—to reflect the will of the people—and our job is to make sure we do that, as Ann would have wanted, in a civilised, humorous but principled manner.
Lord Alton of Liverpool (CB)
My Lords, the noble Lord, Lord Hanson of Flint, just referred to the assassination of Airey Neave here in the precincts of Parliament in 1979. It was the day after I was elected in a parliamentary by-election, so some of the horrors we have witnessed in the years that have passed have left an indelible mark on me, not least because Sir David Amess was a very close friend, as indeed was Ann Widdecombe, so much so that Ann was a godparent to one of my children and a close family friend.
On one occasion, after a particularly tough battle on a Home Office Bill in another place, where she at the time was a Home Office Minister, Ann told me that I was “her favourite bleeding-heart liberal”. But as the House may imagine, we often had our differences, and as recently as last month in a curry house which was a favourite watering-hole of Ann’s—where I have seen the noble Lord from time to time and indeed the noble Lord, Lord Clarke—we argued again about so many things, respectfully recognising our differences.
Ann was intelligent, principled and kind. Yes, her beliefs were founded on those twin pillars of faith and patriotism in a very toxic environment, fuelled often, as the noble Lord, Lord True, and the noble Baroness, Lady Doocey, have said, by hatred. We have to do far more to respect difference and diversity and uphold minorities in our community. We must work far harder to create a climate in which difference of opinion can be expressed with tolerance and respect. Now, we must do all we can to honour Ann’s memory. I hope there will be a book of condolence which we can all sign. In addition, we have to honour her memory by creating an environment where people can express their differences in tolerance and respect.
Lord Hanson of Flint (Lab)
I am grateful to the noble Lord and, may I say, he is one of my favourite bleeding-heart liberals as well. But, that said, his point is vital. Essentially, this is about expressing our political differences in a way that understands our basic humanity. Whatever the circumstances, and we cannot speculate as to how and why Ann was murdered, she held her arguments in a way that understood that humanity underneath.
I hope that we can look at how we can develop that still further. I know that other government departments will continue to look at how we can support the development of mutual understanding and parliamentary democracy in a way that respects differences and respects the individuals concerned. To reflect further on what the noble Lord, Lord True said, we want to look with the House authorities at Operation Bridger as it works currently for MPs. It is also worth us examining the lessons to be learned for individuals in this House and that is something the Home Office is quite happy to do in due course.
Lord Harper (Con)
My Lords, I associate myself with the remarks of the noble Lord, Lord True, and thank the Minister for what he said about our friend Ann Widdecombe. There has been much conversation in the media about whether the Government or the police take seriously the protection of those in public life. I know from my own experience, both in the Home Office and as a Minister, that they absolutely do. Members of Parliament receive enormous numbers of threats, some credible and some not. Can the Minister say one or two things about what the Home Office and the police do, and take seriously, to assess what is credible and what is not, and to put in place both the appropriate steps to advise those in public life and the necessary measures to protect them? Threats to people in public life are not just an attack on them but an attack on democracy and therefore the public. It is important that that protection is put in place.
Lord Hanson of Flint (Lab)
I am grateful to the noble Lord for his comments. He will know that Operation Bridger was established and, since 2024, the Home Office has funded a full-time network of national official advisers across all territorial police forces in the UK to bolster the Operation Bridger network. Each officer appointed by each force, funded by the Home Office, is a dedicated point of contact for MPs and, indeed, for candidates. In specific instances, such as by-elections, the police make assessments of the security threats, as they would have done in Makerfield recently and as they will do in the Clacton by-election that is occurring in August. There is a greater level of support for MPs now within constituencies than ever before. All MPs are advised to report incidents to the police and to reference Operation Bridger. The police will then do what I expect the noble Lord would do: triage those, look at what are serious, credible threats and take action accordingly, independently of government and of the House. As I mentioned, we will examine how the House of Lords can be involved in that as well.
Baroness Royall of Blaisdon (Lab)
My Lords, like my noble friend, I pay my respects to Ann Widdecombe and her family. She was an extraordinary woman. Like my noble friend, I did not agree with her, but I respected her. I associate myself with the comments that have been made about respecting politics, and the way in which a lack of respect in politics diminishes our democracy. Debate has become so polarised; it is frightening in many ways. Does my noble friend think that now is the time to do more to tackle online algorithms? Social media and the algorithms that perpetuate violence and threats against politicians have gone too far. We absolutely must do something so that we can truly restore respect in politics and have a healthy democracy.
Lord Hanson of Flint (Lab)
I am grateful to my noble friend; I do not disagree with any word she said. Increasingly, threats and views are delivered in an online way. That online way has increased the toxicity of the debate we have in the public forum. We need to ensure that we examine that. Legislation is currently available to look at the online space and how it is managed.
I come back to the main point, which I want to re-emphasise for all noble Lords: there has been a vicious murder. We do not know the motivation for that murder yet, and speculation and the discussion today have strayed into potential political aspects. We do not yet know the causes of that murder. We will have proper investigation and I hope that charges will at some point be made against somebody for that murder and that they will be held to account in the courts. We can then examine whether there are lessons to be learned, whatever happened with the murder of our colleague Ann Widdecombe.
Lord Evans of Weardale (CB)
My Lords, I offer my condolences to the family and friends of Ann Widdecombe. I have felt for many years that the Government underinvest in the protection of those in public life who face potential terrorist threats. I realise that there has been considerable progress in recent years, both on resourcing and co-ordination of support to those at potential risk, but would the Minister agree that although it is very important that there should be an assessment of the threats that individuals face, in reality that is merely informed guesswork in most cases? There is no specific intelligence. Therefore, if we opt not to take action, we expose ourselves to very considerable risk. We see the implications of that for our public life more widely. Therefore, the default should be to act, rather than to dismiss threats on the basis of their assessment.
Lord Hanson of Flint (Lab)
The noble Lord speaks with great authority about the type of threat that many elected politicians and Members of this House may face, and I bow to his experience and knowledge. We keep this under review at all times; in fact, following the murder of Sir David Amess, my right honourable friend the Home Secretary commissioned Robert Buckland, a former Conservative Justice Secretary, to examine the security arrangements for Members of Parliament and others. We expect him to report as soon as possible. It is extremely important that we keep ourselves safe, for the very reasons the noble Lord mentioned: a Member of Parliament represents 70,000, 80,000 or 90,000 people in their constituency. They are sent here by the population to do a job; they should not face threats in doing that job. They should face political discussion and debate, but should not be intimidated or face intimidation in undertaking that role.
Baroness Hoey (Non-Afl)
My Lords, Ann and I were on totally different sides in the hunting debate, which went on for many hours in the other place. All through that we remained friends, because Ann understood that differences could be respected. She was in a minority in her party on the hunting Bill and I was in a minority in my party on it. More recently, I was delighted when she came over to Northern Ireland to speak in a unionist meeting in an Orange hall, as a Reform spokesperson, against the protocol. That raised all sorts of questions: how could Ann Widdecombe, a devout Roman Catholic, speak in an Orange hall? She got a rousing reception when she came in. She said, “I’m Ann Widdecombe. I’m a unionist. I’m a Roman Catholic. I’m in an Orange hall and proud to be here”. The place absolutely erupted.
Ann was someone who understood and could cope with any kind of audience. She was also—and it is important that we say this today—a proud member of Reform UK and a close friend to Nigel Farage. Does the Minister not think it was really unacceptable that when Nigel organised a memorial, down near where she lived and with members of the family present, members of the Minister’s party, at senior level, were really nasty? They said that Nigel Farage was using her death as some kind of political football. That was disgraceful. I hope that he, as a Minister, will renege from those remarks and say that that was totally wrong. Ann would have been proud of what Nigel Farage did.
Lord Hanson of Flint (Lab)
It is important that we allow people to grieve and express their view on the death of Ann in whichever way they feel appropriate. I am not going to criticise anybody for laying flowers or a wreath at the site of Ann’s home. That is a matter for individuals to do personally. Again, what the noble Baroness has exemplified in her comments is that Ann Widdecombe was a politician who was not afraid, who was committed to a matter of principle, and who could do it in a way that deflected criticism and tried to win round support to her view. We all have our differences and members of Reform are entitled to their political views. I do not agree with them, but they are entitled to their views. What they are not entitled to is intimidation and threats, just as any other Member is not. I come back ultimately to this: let us not make a judgment on how Ann was murdered yet. Let us just grieve for her and resolve to learn the lessons in due course.
Baroness Browning (Con)
My Lords, I am grateful to put on the record of the House that I met Ann in the early 1980s and we became close friends. We worked together to become Members of Parliament. We debated with anybody and on anything, and she taught me a lot. She was ahead of me, having already fought one election. We did so well that, even before we were elected, we were invited once to go to No. 10 to have coffee with Margaret Thatcher. As we came out of the door of No. 10, Ann said to me, “Come on!” I said, “What do you mean?”, and she said, “We’ve got to get a press release out”. We went back to her office and she taught me such a lot about campaigning. She got into Parliament before me, but we were Ministers together in the Major Government and in my noble friend’s Lord Hague’s shadow Cabinet.
I always remember standing in my kitchen in Devon one day. I lived quite close to Haytor at one time, so I have sadly pictured it all horribly in the last few days. I was making a fruit salad when Ann stood in my kitchen and instructed me every step of the way on how to make it. In the end, I was so annoyed that I said, “Ann, I used to be a cookery teacher”, and she said, “I think I’ll lay the table”. I shall miss her sadly. I just pray that whoever has done this foul deed is caught quickly.
Lord Hanson of Flint (Lab)
I am grateful to the noble Baroness for her personal tribute to and recollections of Ann Widdecombe. I cannot say I ever had a fruit salad with her and I cannot say I ever went for tea in No. 10 with Mrs Thatcher, but I understand the mood in which she has placed those comments and I thank her for them. I also echo wholeheartedly her wish that, at some point and at some time, somebody will be charged with this murder, will be brought to account and will face the consequences of their foul deed.
Lord Barber of Chittlehampton (Lab)
My Lords, I am humbled by the quality of this debate and conversation about somebody I did not know. My association comes from being a resident of Devon, living on the other side of Dartmoor and having spent significant time at Buckfast Abbey, and the shock of hearing of her death was very great. I send condolences to her family and friends, many of them in this Chamber.
Looking at it from the outside, I thought Devon & Cornwall Police handled things rather well in the first few days and I think it is collaborating well with counterterrorism police now. As the investigation continues, I believe that what we all need as we get new insights and facts is to wholeheartedly support all the police involved in this investigation, the counterterrorism police and Devon & Cornwall Police, because they are collaborating very well.
Lord Hanson of Flint (Lab)
I am grateful to my noble friend and I agree with and wholeheartedly support his wish for the police to be allowed to get on with the investigation. I was just checking my phone because the police are in fact making a statement as we speak. I cannot update the House on the level of co-operation between Devon & Cornwall Police and Counter Terrorism Policing, but both have the same objective, which is to bring to account an individual, at some point and whoever that individual may be, for this crime. I wish them well in their success and I hope they have speedy outcomes to those investigations.
Baroness Stuart of Edgbaston (CB)
My Lords, I send my condolences to Ann Widdecombe’s family. I served as a Member of Parliament with her on the other side and, rather surprisingly, when I stepped down as an MP in 2017, a very kind letter arrived from Ann thanking me for my public service. There was always a side to her that we did not anticipate.
One of the things in the light of this is again quite extraordinary. Apart from the armed services, which other profession could say, as many of us in here have said, that three, four or five of our colleagues have been killed in the performance of their duty? One very concrete thing I ask of the Minister is to take a very close look at our home addresses, whether of Members of Parliament or of Members of this House. This is probably the most vulnerable data, and we need to ensure it is not publicly accessible.
Lord Hanson of Flint (Lab)
If the noble Baroness will allow, I will not give an opinion on that immediately. It is important that, through the Robert Buckland review, we look at the security issues for all elected parliamentarians and Members of this House. I say that simply because we can jump to speedy conclusions on a whole range of matters, but ultimately we commissioned a review from Robert Buckland in the light of the murder of Sir David Amess and I am waiting for that review to come back with a general review of security. We will work with the authorities in the House of Commons, and indeed with the House authorities here, to see whether improvements can be made. The bottom line in all this is that every person who holds public office has the right to hold that office free from fear and free to enjoy their property free from demonstrations. The noble Baroness will also know, as I have reminded myself in my comments now, that in the police and crime Act we passed legislation that prevents demonstrations outside the properties of Members of Parliament.
Baroness Fox of Buckley (Non-Afl)
My Lords, like many other people, it seems to me, I was an unlikely comrade of Ann Widdecombe across the political divide when we were Brexit Party MEPs. I think she started off with some hostility to me but, one way or another, we ended up hugging, laughing and arguing civilly more than we had both anticipated. We were great friends, so it is very hard to accept what has happened.
One concern from what I have heard today—it was also a feature in the Statement in the other place and in the media—is about calls to clamp down on online speech, as though that was the cause of the violence. I urge noble Lords—a little bit of homework, if they do not mind—to listen to Ann’s Oxford Union speech on free speech. It is full of moral clarity and great courage. It is preposterous for me to say this, but I am going to say it: she would not want this brutal murder to be used politically to bring in more censorship, or even for people—such as those academics and activists who have wallowed in her murder and said that she more or less deserved it—to be sacked or cancelled. She would want us to have a debate about it and to argue over it, and truth, not censorship, to prevail. Please let us not go down that road.
Lord Hanson of Flint (Lab)
I do not know what Ann Widdecombe would have wanted in relation to that, and I am not going to opine on it. I want to have a free and open debate on those matters, free from intimidation outside this House, and for people to be able to hold their views, whatever they might be, explain them, outline them, defend them and hopefully do so—as all parties in this House do—from the perspective of trying to make this great country a better place to live in for all our citizens. I am not going to give a view on what Ann would or would not have wanted. We should remember her life, not the circumstances of her death, and ensure that, whatever we do, we find whoever perpetrated this act and learn any lessons to be learned. Ultimately, we must accept that a murder has taken place and that somebody needs to be held to account for it. Today, as the whole House has done, we celebrate the life that has been ended by that act.
The Lord Speaker (Lord Forsyth of Drumlean)
My Lords, perhaps I could be permitted a few words of my own. Ann Widdecombe was a friend of mine for more than 50 years, believe it or not. She had that quality that guarantees all other virtues: immense courage. She also had great empathy for people, even those she disagreed with. In the absence of anyone on the Bishops’ Bench, perhaps I could be permitted to say that she had a deep and abiding faith, and she believed that she would be with her maker now. If anyone deserves to be with their maker, it is Ann, because of her dedication and deep-held beliefs. We may not have believed in everything she said, but all of us who are sending our condolences to her family should take pride in and have gratitude for her record of public service, which honoured us all and which adorned our Parliament and our democracy.
State of Climate and Nature
(2 weeks, 5 days ago)
Lords ChamberRead Full debate Read Hansard Text Read Debate Ministerial Extracts
Lord Moynihan (Con)
My Lords, I declare my interests as the chair of Amey, the chair of Acteon and the chair of Buckthorn Partners, which are all involved, in different ways, with energy transition both in the UK and around the world. I am grateful to the Minister for answering questions on the Statement made in another place yesterday. There the Defra Minister read the Statement, and the exchanges focused on her responsibility. Today it is the turn of the Minister for DESNZ in this House, so I will concentrate my questions on the aspects of the Statement that focus on the Starmer Government’s record on meeting the objectives set out in the Statement—or, more precisely, the consequences of the tenure of the Secretary of State, Ed Miliband, who is rumoured to be heading to the Treasury at the end of the week.
We all recognise the importance of protecting our climate and restoring nature. The key question is whether the Government have been capable of making progress on both. The Statement notes the introduction of carbon budget 7 and praises it, despite it being regretted in your Lordships’ House. The Government claim to be
“working in partnership with local communities, businesses, conservationists and farmers”.
The Climate Change Committee suggested a 35% reduction in meat and dairy consumption by 2050, a 50% reduction in the number of cattle and sheep, a doubling of tree planting rates by 2030 and a doubling of peatland restoration by 2040. Does the Minister agree with those representing the farmers that they will be forced to uproot their entire business models within a single generation?
Similarly, the Statement informs us that the Government will
“protect and conserve 30% of our land and seas for nature by 2030”.
Yet last week, the Government approved One Earth solar farm, a week after approving Peartree Hill and Dean Moor solar farms. One Earth will cover 3,900 acres and will have a capacity of 740 megawatts. Half the farm will be on best and most versatile—BMV—land. Can the Minister explain how that enhances our natural environment? Does he agree with the Secretary of State, who recently overruled his own planning inspectors to approve this, Britain’s second-largest solar farm, despite their recommendations to refuse the application over concerns about environmental damage and the loss of productive farmland, which this Statement is meant to protect? It is estimated that the site’s 660 hectares could produce around 5,300 tonnes of wheat a year. Does the Minister not agree that the Government are getting the balance wrong? Britain needs affordable, reliable, clean power, but covering productive farmland with vast solar developments while ignoring practical alternatives is not the answer. Ministers should be pursuing an energy strategy that strengthens our energy security without undermining our farmers.
However, I understand that there is some good news coming from the Statement. Will the Minister confirm that Andy Burnham is going to accept the long-running campaign from this side of the House to approve the Jackdaw gas field and will be going to Aberdeen during the recess with this welcome news? Let us hope that this is the beginning of the damascene conversion of Ed Miliband, especially if he is to move to the Treasury, although somehow I doubt it. Given the decision to approve Jackdaw this summer, does the Minister now agree that North Sea gas is four times cleaner in production than imported LNG and that UK energy security is strengthened by reducing reliance on imported gas? Does he agree that this would be a first step to protecting and indeed increasing oil and gas jobs, would grow tax revenues, would secure energy transition and, vitally in the context of this Statement, would reduce the carbon emissions our reliance on gas generates?
When the Secretary of State states that the North Sea is a mature oil and gas province, we agree with him. The primary source rocks were deposited about 150 million years ago, and with the right tax allowance, regulatory and decommissioning regimes, as in Norway, we could be producing a similar 4 million barrels of oil by the time the first new-build nuclear comes into generation in the late 2030s—and that is optimistic, given the Government’s unacceptable delay in enacting the Fingleton recommendations. Will the Minister confirm that the Burnham Government will understand that what we are talking about is global warming and that the UK is not detached from the globe? As such, does he agree that we should count all emissions in all the supply chains that deliver solar panels and offshore wind to the UK if we are to be honest with the public and not just virtue signalling to a world that is not listening but looking with incredulity at the Government’s deindustrialisation, with the cost of electricity to our industrial base being the highest in the OECD and four times higher than in the States?
The Under-Secretary of State for Defra noted during the Q&A exchanges following the Statement that a school in her constituency, Richard Lee Primary School, is installing new solar panels. Is the Minister aware that this school sources its solar panels from JA Solar? The company has a “very high” exposure—the highest rating—to the Xinjiang province in China, and the accusations of Uyghur slave labour in that province are well known to your Lordships’ House. Does he agree that our solar panels are neither homegrown nor clean? The component parts come from China and rely heavily on vast coal-fired factories daily belching out CO2 into the atmosphere. Does he agree that the total carbon footprint of a finished Chinese panel averages around 490 kilograms of CO2 equivalent per module, involving extreme furnace temperatures, adding to global warming at an alarming rate, and putting high levels of CO2 into the atmosphere for polysilicon, ingot and wafer production? Then we have imported Chinese offshore wind farms, where Chinese white asbestos ends up in wind turbines, and imported brake pads and hoist components are sourced from third-party suppliers in China, where the material is not prohibited, and are now installed in service lifts that transport our technicians up turbine towers in the North Sea.
Does the Minister agree with me that all these essential steps in the supply chain must be taken into account when considering CO2 emissions globally? Offshore wind turbines rely on powerful permanent magnets with neodymium, praseodymium and dysprosium—the supply of the latter being almost exclusively controlled by China. Add the copper and cobalt from the Democratic Republic of the Congo, where child labour and high CO2 emissions mining take place, and pupils, children and teachers at the Richard Lee Primary School might not be so impressed.
Does the Minister not agree that if we were to transport all these vital elements of this massively misnamed “clean” homegrown supply chain, we could have an acreage close to size of the Isle of Wight with CO2-belching factories and illegal working practices? How would parents, teachers and children at the Richard Lee Primary School regard that? The state of the climate and nature is under threat but, sadly, the Government’s energy response in this Statement is lamentable.
Earl Russell (LD)
My Lords, we welcome this Statement. The science is absolutely certain that human-induced climate change is beyond doubt. What has changed is how fast the impacts are arriving on our very own doorsteps. This summer’s heatwaves in May and June caused as many as 2,700 excess deaths; transport systems were strained; over a thousand schools closed; and the London Ambulance Service endured its busiest ever day.
We are on our third heatwave of 2026, and 2026 is the first year the UK has reached 35 degrees in May, June and July consecutively. Excessive heat is putting a strain on every individual citizen, on our economy, on our schools and on our health systems. Europe is now confirmed as the fastest-warming continent on Earth, warming at more than twice the global average.
This Government have been genuinely good on the energy transition, approving renewable projects to power the equivalent of more than 19 million homes. But nature has been the poor relation. Not a single new site of special scientific interest has been designated in England since 2023, and our tree-planting rate remains less than half the annual target. Labour’s messaging on nature has been muddled, its green mission too often undermined from within. Climate and nature are not separate; they are codependent. A Government strong on one and weak on the other will ultimately fail at both.
Our climate is changing more quickly than our policies. The Climate Change Committee’s fourth independent assessment of UK climate risk was stark: on adaption, not a single delivery pathway was rated good. Inaction cannot continue. Three of our five worst harvests on record have occurred since 2020; our food security is threatened. The Green Alliance has today written to Ministers to warn:
“The UK was built for a climate that no longer exists”,
and emergency action is needed. We must do far more, more quickly, on adaption. It is the vulnerable, the elderly, the sick, the poor and the workers who will suffer the most.
These matters are hard when we co-operate, and they become almost impossible when we do not. So, I say with real regret that the Conservative Party’s ever-continuing retreat from reality, rejecting the 2050 net-zero target and now reportedly barring prospective candidates who continue to support it, is a betrayal of its own history and the consensus that this country requires.
To those who say the UK emits only 1% of global emissions so why bother: every major economy could say the same. To those who say net zero is impossible, I ask: what is possible instead? British leadership works only if Britain leads.
The wildfire risks this summer are at extreme levels, endangering lives and devastating habitats, yet the Government’s wildfire strategy is still not ready and we remain completely reliant on commercial aircraft to fight fires. We have had one mega wildfire already last year, and we are not prepared for the next. That must change before next year’s El Niño impacts are felt.
On tipping points, will the Minister say what more the Government will do to strengthen monitoring of the AMOC system? The Government’s nature security assessment warns that every critical ecosystem is on a pathway to collapse. If that is true, as I believe it is, the public and this House deserve to see the full assessment, not merely a summary. I ask the Minister to commit to its publication in full. The 30by30 on Land: Delivery Plan, published yesterday, is welcome but insufficient. It leans too heavily on farmers and land managers volunteering, with no statutory backstop and no guarantee that voluntary schemes will deliver at the scale required.
Labour must stop doing things to people and start doing things with them. Give communities real opportunities to protect nature, launch a national campaign and provide an emergency briefing, because misinformation is filling the gap left by government silence. Fear alone will not sustain the public throughout this crisis. We must offer hope and invest in the young people who will live the longest with the consequences of what we decide.
Finally, our climate and nature laws are out of date. Can the Minister say whether the Government will finally match strong words on climate with equally strong action for nature?
The Minister of State, Department for Energy Security and Net Zero (Lord Whitehead) (Lab)
I thank noble Lords for their valuable contributions in responding to this Statement made yesterday in the other place. As noble Lords know, the Statement was about climate and nature, and particularly the extent to which—as the noble Baroness, Lady Jones of Moulsecoomb, repeatedly reminds us—you cannot disentangle one from the other. Climate change drives nature loss and nature loss drives climate change. If you tackle one but not the other, you will not succeed in tackling the first thing. Making sure that our environment is liveable—that it is a thriving environment for the purposes of both nature extension and recovery—is completely wound up with the actions we take against climate change in general. The Statement set out what actions the Government are taking on that clear link.
Indeed, in the most recent spending round, the Government put aside unprecedented sums for nature development, recovery and restitution. For example, altogether they put forward over £7 billion at the spending review, including £5.9 billion for environmental farming schemes. ELMS began to take place under the previous Government and have been very successful in developing sustainable and low-carbon farming practices and in making sure that farming is about not just production but enhancing and sustaining that production for the future through changes in farming practices. In addition, £816 million has been put aside for tree-planting, with the planting of three large national forests under way, and £85 million pounds for peatland restoration. Those are practical things that tackle some of the key issues around nature degradation in this country. I suggest that the Government are matching their words with a substantial amount of investment in making sure that nature can live and survive in the right way in the future.
I anticipated that the noble Lord, Lord Moynihan, might concentrate rather more on particular energy and climate change issues. Those areas are very much tied to the balance between nature and climate change. What you absolutely need for a thriving background for nature is clean air, clean energy and clean environmental circumstances under which that energy is produced, as well as an environment that allows nature to thrive. I suggest that solar power, for example, absolutely offers those things, so I do not recognise the noble Lord’s characterisation of the apparently inherent dirtiness of solar panels. The carbon payback of a solar panel is estimated to be just 1.05 years. I agree with the noble Lord that, where a solar panel is made under circumstances in which the production arrangements are a little, shall we say, browner than they are in Europe, the payback will be marginally greater, but it is still only 1.18 years. So I do not recognise the characterisation of solar put forward by the noble Lord. It is an integral part of bringing energy and nature together in how we produce clean energy and clean air at the same time.
The noble Lord, Lord Moynihan, asked whether, in advance of the new Government being in place, I will predict a number of things they are about to do—which of course I will not do. However, I remind the noble Lord that the Jackdaw field is not a field that has not been explored but a field on which Ministers are presently deciding whether to proceed. I should not pre-empt that decision process, but he can be assured that the decision process is under way.
My final point on the noble Lord’s points about this area is that the production of clean energy and low carbon is not about deindustrialisation. As he will know, the Government have recently invested something like £61 billion and crowded in more than £100 billion of clean, green, low-carbon investment in the process. It is actually value added as much as it is investment. It is reindustrialising the country, albeit on a different level of carbon output, in a way that we can see before us in the British-based requirements for a lot of offshore wind, nuclear and various other such things. That means that a lot of this activity is taking place as industrial processes in the UK and is creating green, low-carbon jobs to replace those brown, high-carbon jobs as a result.
The noble Earl, Lord Russell, rightly talks about what is quite evident around us outside this Chamber. This Chamber, mercifully, is reasonably cooled, but outside we are experiencing the hottest year in history, as we will undoubtedly break last year’s records if we go on as we are. We are in an absolute emergency as far as adaptation is concerned. We cannot just think about mitigation for the future. I agree that there is a long way to go in getting that adaptation right for the future, but the Government are on the case. We need to look, for example, at the record sums that have been put in place for flood protection and flood relief and the work that the Government are doing to ensure that building regulations and various other such things are climate change-proof rather than lagging behind—as much of our society is at the moment. I agree that there is a long way to go and I am sure that we will debate how that process is going in the near future. I thank him for his general support for the measures that the Government are taking on climate change and nature and look forward to his continued support in future.
Baroness McIntosh of Pickering (Con)
My Lords, I thank the Minister for the Statement and for giving us the opportunity to raise issues in this regard. I associate myself with the comments made from the Front Bench. Will the Minister reply to the question about taking productive land out of production? The wheat harvest is expected to be devastated this year because of the lack of rain and drought conditions. North Yorkshire is being covered by BES, these big battery energy storage and solar farm projects, which are highly flammable, highly combustible and highly dangerous. How can he square that with nature and environmental benefits? They are diametrically opposed.
Lord Whitehead (Lab)
I did indeed not provide a complete answer to the thought put forward by the noble Lord, Lord Moynihan, on farming. He concentrated mainly on energy and climate change, which is what I responded to particularly. As the noble Baroness will know, we have recently produced the farming road map, a comprehensive road map informed substantially by farmers in the first instance on how we can develop more sustainable farming. Contrary to what the noble Lord says, that does not involve, for example, removing a lot of livestock from farming practices. It involves more sustainable practices in general.
I am sure the noble Lord will agree that the agriculture and land use sector needs to make sure that its emissions go down substantially, as it is one of the two sectors that have flatlined on emissions in recent years. The question is how you do it, rather than simply saying that there are things you must do which are detrimental to the interests of farming. I have already mentioned what is happening with the ELMS arrangements. There are all sorts of other things associated with that, such as low-methane feedstuffs for cattle, which are getting a lot of traction and interest in farming circles. These can reduce emissions substantially without having to cull any livestock or causing people to change their eating patterns or farmers to do things other than farm in a more sustainable way. That is the key to what we are trying to do on farming. I hope the noble Lord and the noble Baroness will support it.
Baroness Jones of Moulsecoomb (GP)
My Lords, I thank the Minister for his kind words earlier about my contributions—I think they were kind words. I also welcome the Statement from the Minister in the other place, because it was a good Statement. The spending plans sound great, but it is not only about how much you spend but about how you spend it. I often have doubts that Labour really understands that the environment and nature are integral to everything that comes through here, as again and again we see legislation that barely mentions climate change. We are at a point when we have heatwaves, people are dying, “Boris buses” are unbearable and workplaces are too hot to work. Yet this Labour Government have not put climate change into the Sporting Events Bill, the civil aviation Bill or almost any other Bill. Would the Minister suggest to the Government that I can set up some seminars with climatologists so that they understand the importance of putting climate change into all legislation?
Lord Whitehead (Lab)
Among other things, the actions that the Government have taken—for example, with the Energising Britain plan—are making sure that the question of climate change is not just an issue for one or two areas of government but one that all areas of government have to contribute to. Those different departments will be judged very substantially on their contributions. As this Government have shown already, there is a real sense of joint working, for example in how the National Health Service and the Ministry of Defence are decarbonising and in how various departments are working together to make sure that that overall goal is achieved. I cannot say that I could guarantee a large attendance at seminars that the noble Baroness might put on for that purpose, but she is very welcome to do so. I would certainly come along to a seminar if she wanted to set one up. The point underlining what she says is that nature is essential to the whole process. As I have said, if we neglect one element against the other in our climate change actions, we will not succeed in either.
Baroness Ritchie of Downpatrick (Lab)
My Lords, I congratulate my noble friend the Minister on the very welcome Statement on how the Government will deal with the interlinked issues of climate change and nature, because there is no doubt that both are interlinked and one drives the other. We have already seen examples of nature loss in our wider countryside. Reference has been made to reports issued quite recently that more than 2,700 people may have died in the May and June heatwaves this year. What further steps will our Government take to adapt UK buildings to the impact of climate change, including energy efficiency measures through the use of sustainable timber and modular buildings?
Lord Whitehead (Lab)
My noble friend is absolutely right to draw attention to what is sadly likely to be a large number of deaths directly attributable to the recent heatwave we have had in this country. Those deaths can quite possibly be attributed to the lack of readiness that we have in our building fabric and our homes for the consequences of climate change and what will happen with temperatures in future. I hope she can take some comfort from the fact that the Government are actively reviewing how we make sure that building standards are fully compliant with climate change resilience for the future. If we build our buildings so that they can undertake those future climate shocks rather than be victims of them, we will have done a good deed for the future.
Lord Lilley (Con)
My Lords, the Statement in another place said that reducing emissions would lower bills. This country has reduced emissions by more than any other country, yet our bills are now higher than any other OECD country, nearly all of which rely on gas like us. Can the Minister explain this? If he is going to say that, in future, renewables will be cheaper than fossil fuels, then why do they need subsidies, and, if they need subsidies, how can he say that they are basically cheaper?
Lord Whitehead (Lab)
The noble Lord is substantially but not entirely correct about OECD prices; however, he is not entirely correct that other OECD countries are reliant on gas to the extent that we are in this country. A very substantial driver of electricity prices is the volatile price of gas, as he will know, and the reliance that we still have in this country on gas as a market-maker for electricity very substantially leads to those high prices. Therefore, on the idea of getting off that wheel we are on, of volatile gas prices leading to volatile electricity prices and to high energy prices, it is quite right that we resolve that by making sure that our energy arrangements are as low carbon—and, hence, not gas based—as they can be.
Baroness Miller of Chilthorne Domer (LD)
My Lords, I welcome the Statement, but does the Minister agree that marine areas are very important both in terms of climate change, as a carbon sink, and in terms of biodiversity? Does he therefore agree that it is an urgent issue for the Government to make the decision to end bottom trawling in marine protected areas? It destroys vast areas of kelp beds and sea grass, both of which absorb carbon, and it is very destructive.
Lord Whitehead (Lab)
Yes, the noble Baroness is quite right about bottom trawling, how destructive it is and how it completely destroys the ecology of shallow to medium deep-sea areas as a result. It is very important that, among other things, those practices are not carried out in marine protected areas. She will know that the Government have a great record of developing marine protected areas around the UK’s coast and internationally in the Crown dependencies. Those will all be areas in which practices such as bottom trawling will not be tolerated.
Baroness Hayman (CB)
My Lords, I welcome the Statement, and I very much agree with the noble Earl, Lord Russell, on much of what he said about the issues that face us. We have some enormously difficult issues to face. We have seen some of the immediate ones in in our hospitals, schools and workplaces and in the death rates we have seen. I think the noble Lord, Lord Moynihan, agreed on the threat—to use his word—in terms of both climate and nature. We have immediate problems, and we have some very difficult problems—
Baroness Hayman (CB)
I am going to ask a question in just a minute or two. We have some very difficult decisions to make on issues such as the North Sea, employment, how we get the new skills in, how we get the modular reactors in, what the pace of change is and how we make the transition.
Baroness Hayman (CB)
My question to the Minister is this: does he share my concern that, instead of pooling our joint knowledge and energy into solving those problems when faced with a global crisis, we seem to be creating a more and more polarised and unproductive debate on all these issues?
Lord Whitehead (Lab)
I certainly agree with the noble Baroness on the extent to which we will make far greater progress by acting in consensus and agreement together, working out how we do things jointly, than by having an often very sterile debate about whether particular things work particularly well or otherwise. As far as I am concerned, we remain in a climate emergency and in circumstances where, as I have said, we have to consider urgent adaptation at the same time as urgent mitigation. Those are very difficult things to do, and I for one am proud that the Government have not resiled from that difficult debate, particularly on issues such as mineral fuels, but have instead tried to move forward on a broad basis of support. I reflect on the fact that, when I was in the House of Commons, we had a high degree of consensus on climate change; now, we do not, and that is a sorry state of affairs. We need to get back to that as soon as possible in order that we make the progress that we all know is absolutely necessary in the end.
Lord Barber of Chittlehampton (Lab)
My Lords, I had the privilege of chairing the Devon land use pilot a few years ago. We learned that people think in silos but the solutions are in combinations. On Exmoor, you have water challenges and energy challenges, and challenges relating to tourism, mental health, exercise, housing, transport, wind energy and biodiversity. We have introduced white-tailed sea eagles and pine martens on Exmoor, and you can see the change happening. The real risk in this debate is that it is not sophisticated enough and falls into a set of false dichotomies, which will frustrate us—
Lord Barber of Chittlehampton (Lab)
My question to the Minister is: in taking through the agenda set out in the Statement, will the Government think in the sophisticated way I have described about broad areas of land as our population grows and the challenges of every acre of land become greater and greater? I have not even mentioned food and farming, which set up the pilot that I chaired. These are important and difficult issues, and we will not get there by simply debating false dichotomies.
Lord Whitehead (Lab)
My noble friend sets the question for us all: how can we work across all the different sectors of government to get to our goal? The goal is not that action on climate change is a last-ditch attempt to try to produce a less miserable outcome for the future by mitigating, by a small amount, what is happening with global warming; it is finding a way to bring about a much better life for everybody in the context of the farming and industrial environments in which we live and the enjoyment of our personal and private lives. Joint action on adaptation and mitigation is a method of bringing about that better society. It is the most important thing we need to do to bring about a society that is not only bearable in the future but is instead a big improvement on what we have at the moment.
Lord Redwood (Con)
Why cut back and close jobs at home, shutting down oil and gas, food production and our factories when it increases world CO2? This is self-harm on a crazy scale. Why do the Government want to lose jobs and investment?
Lord Whitehead (Lab)
I am not sure I recognise much of the noble Lord’s intervention. As I have said, it is not the case that the Government are bent on a process of deindustrialisation and losing jobs. Jobs are transferring from the high-carbon economy to the low- carbon economy, and one of the duties of government, which this Government are carrying out, is to make sure there are good jobs in both the low-carbon and high-carbon economies, and that skills are transferred from the high-carbon economy to inform the low-carbon economy. That is exactly what is happening at the moment, so I really do not recognise the assertions the noble Lord makes about the future of society. Quite the opposite is taking place.
Baroness Coffey (Con)
My Lords, 10 of the 48 designated areas have still not produced their local nature recovery strategies. When will the Government issue directions to those councils and give them a deadline to do it by? Will there be a modest amount of money to help those councils that are clearly struggling?
Lord Whitehead (Lab)
I do not know the answer to the question the noble Baroness has put to me. I am happy to write to her. I know that many councils are working hard on this. It is a question of looking at the outliers rather than at people who have taken this issue seriously at a local level and are getting on with the plans that they should be getting on with as far as future environmental concerns go.
Taxation (Energy and Vehicles) Bill
Tuesday 14th July 2026
(2 weeks, 5 days ago)
Lords ChamberRead Full debate Taxation (Energy and Vehicles) Act 2026 View all Taxation (Energy and Vehicles) Act 2026 Debates Read Hansard Text Watch Debate Read Debate Ministerial Extracts Amendment Paper: Committee of the whole House Amendments as at 1 July 2026 - (1 Jul 2026)
The Financial Secretary to the Treasury (Lord Livermore) (Lab)
My Lords, it is a pleasure to open the Second Reading debate on the Taxation (Energy and Vehicles) Bill. The measures contained in the Bill will support businesses across the UK as they deal with the immediate economic costs associated with the ongoing conflict in the Middle East. We did not start this conflict and we did not join it, but it is impacting our economy, including by putting pressure on energy markets and disrupting supply chains.
Despite these pressures, the latest economic data shows that the Government’s economic plan is working. Inflation last month held steady. Britain’s economy was the fastest growing in the G7 for the first quarter of this year. Borrowing is forecast to fall in every year of this Parliament and wages are continuing to rise.
However, as the Chancellor has said repeatedly, we must continue to be responsive to a changing world and responsible in the national interest. That is why we have taken action to support businesses and families, including by reducing VAT on summer activities from 20% to 5% and extending the 5p fuel duty cut until the end of the year, saving the average motorist £120 since last year. We have committed more than £50 million to help those struggling with the cost of heating oil. To support hauliers and farmers, we have cut red diesel by more than one-third until the end of this year. To help reduce costs for energy-intensive firms, we have expanded the British industry competitiveness scheme to more than 10,000 manufacturers. We are also providing targeted support to the chemicals and ceramics industries, protecting thousands of jobs and putting businesses on a secure footing for the long term.
The measures contained in this Bill go further to protect consumers and help firms deal with rising prices. It covers three areas: the energy generator levy, mileage rates and vehicle excise duty for heavy goods vehicles.
On the first measure, the electricity generator levy, the price of energy has risen since the war in Iran began, benefiting generators whose costs bear no relation to the price of gas. The Government’s objective is to ensure that those who benefit from these increased prices and volatility pay their fair share. That is why, in our first Budget, we extended and increased the energy profits levy. Last year, the Chancellor announced a new permanent windfall tax regime on oil and gas.
In April this year, we went further still by announcing an increase to the rate of the electricity generator levy and extending it beyond its original sunset date of 2028. The electricity generator levy recovers excess revenues made by generators that do not use gas when electricity prices are over a long-term average. To ensure that it does not disincentivise investment, any new investment since 22 November 2023 is exempt from the levy. The increase in the main rate of the levy from 45% to 55% is legislated for in this Bill. The extension will be legislated for separately. The Government will set out the fiscal impact of this increase at the Budget in the autumn, with the costing certified by the OBR in the usual way.
Raising the rate will help break the link between electricity and gas prices. Even though the UK is generating more electricity from sources such as nuclear and renewables, international gas prices still set the price of our electricity. This means that, when global gas prices spike, so do bills here in the UK.
By breaking the link between gas and electricity prices, we can help to insulate consumers from the volatility of future crises. The rise in the electricity generator levy will contribute to this by encouraging participation in the wholesale contracts for difference scheme. Currently, under a separate scheme known as contracts for difference, some electricity suppliers are guaranteed a stable, fixed price for the electricity that they produce. The new wholesale contracts for difference scheme will offer certain existing eligible generators that are not already signed up to contracts for difference the option to bid for a fixed price for the electricity that they generate.
Increasing the rate of the energy generator levy will therefore increase the appeal of a fixed rate under the new wholesale contracts for difference scheme, in turn helping to protect consumers from volatile gas-linked electricity prices. The Department for Energy Security and Net Zero will come forward later this year with a consultation on the wholesale contracts for difference scheme. The design of the post-2028 energy generator levy will be considered alongside this consultation.
The second measure contained in the Bill relates to mileage rates. As fuel prices have risen, so has the cost of filling up a car or van for those who drive for work. Despite this, mileage rates—the amount that workers are reimbursed for every mile they drive—have not changed since 2011. This has created a significant gap between the amount it costs to run and maintain a vehicle and the amount that workers are reimbursed for.
In recognition of these pressures, the Chancellor has announced the largest ever increase to mileage rates and the first uprating in 15 years. As a result, mileage rates have now increased from 45p to 55p for the first 10,000 miles. Beyond 10,000 miles, the rate will remain at 25p. This change will benefit employees using their own vehicle for work and those who are self-employed and use simplified expenses rates.
The increase came into effect on 6 April and the legislation before us gives statutory effect to this change. Overall, the increased rate will benefit around 2 million employees and 1 million self-employed individuals, saving over £120 a year for a worker doing 6,000 business miles.
Although employers are not required to reimburse at the new rates set out, if employees are reimbursed below the tax-free rate they can claim mileage allowance tax relief directly from HMRC. More widely, in March, the Chancellor announced a review of mileage rates as a whole. This review is ongoing and will inform the Budget this autumn.
The third measure in the Bill concerns vehicle excise duty on heavy goods vehicles. The road haulage sector plays a vital role transporting goods across the UK, but haulage firms are disproportionally exposed to higher fuel costs. That is why we are providing additional targeted support for the sector through the Bill, with a 12-month holiday from vehicle excise duty for the majority of heavy goods vehicles.
Eligible vehicles renewing their VED in this period will pay a reduced annual rate of £1. This will save a typical HGV £600, and those with higher liability will, in some cases, save more than £900, on top of savings from fuel duty. It will benefit around 46,000 UK-based road freight firms. Taken together with other freezes to fuel duty since the general election, the average HGV has saved over £2,000 compared with plans set out by the previous Government.
This Government have the right economic plan to deliver secure and resilient growth in a changing world, but as we have seen, including over recent days, the war in Iran continues to create uncertainty and volatility in the global economy, and therefore higher costs for businesses here in Britain. The Government have responded by providing immediate support to help with those additional costs, including through the measures contained in the Bill.
These measures will ensure that electricity generators that benefit from increased prices pay their fair share. They will support around 2 million employees and 1 million self-employed people who need to drive for work. They will deliver targeted help to the road haulage sector, ensuring that HGVs remain on the road to deliver food and other products to communities right across the country.
The Bill shows that, in the face of global pressures, the Government will continue to be responsive to a changing world and responsible in the national interest. I beg to move.
Baroness Neville-Rolfe (Con)
My Lords, this Bill is presented by the Government as a series of targeted measures designed to address a specific issue: the war in the Middle East. I thank the Minister for his full explanation. However, the truth is that what we are discussing is a series of sticking-plaster measures designed to curb some of the worst excesses of what can be described only as an economy seriously in trouble.
The current Government—and, indeed, the one that is to come under the leadership of Andy Burnham—face a deeply serious situation. Last week, the Office for Budget Responsibility warned in its Fiscal Risks and Sustainability report that, without action, public debt is set to move on to an unsustainable upward path in the near future.
A key finding is that early action to head off difficult fiscal outcomes is much less costly than late action. This is partly due to the sheer scale of our national debt. Last year the Government borrowed £129 billion, 80% of which was spent on debt interest in an increasingly jumpy bond market. The OBR estimates that an additional £28 billion a year will be needed to meet the Government’s critical pledge to spend 3.5% of GDP on defence. At the same time, spending on the state pension and on health is projected to rise sharply in the next few years —one of the reasons why I called for a cap on expenditure on pensions as a percentage of GDP in my independent review of the state pension age as long ago as 2022 and why I deplore the failure to hold a full House of Lords debate on the 10-year plan for the NHS.
The Lords Economic Affairs Committee said much the same about the unsustainability of debt years ago in its report National Debt: It’s Time for Tough Decisions. The then chair, my noble and far-sighted friend Lord Bridges of Headley, was quoted at the time as saying that
“our national debt risks developing on an unsustainable path”.
Moreover, we are now spending more on welfare, £334 billion, than we collect in income tax, £331 billion. The new Prime Minister and Chancellor of the Exchequer face the choice of either significant tax rises or deep spending restraint if we are to stop debt spiralling further out of control. Yet the OBR has also made clear that tax rises cannot simply be treated as a limitless answer. Continually increasing taxes risks creating ever greater economic distortions, with the Laffer curve biting into receipts—for example, if the top rate of income tax goes up. Wealth taxes raise less than expected, as we know from overseas experience, and they certainly damage competitiveness. Further stealth taxes on earnings risk weakening work incentives and drag more people out of the labour market.
The key to squaring the circle, as I have discussed with the Minister on many occasions, is growth, particularly per capita growth or higher productivity. EU growth has been sluggish. Yet the Government want to get closer to the EU and agree to a package of changes that will certainly cost hundreds of millions a year, given the difficulties of negotiating with the EU, with no certainty that it will improve our economy to the extent hoped. I am also concerned about the impact on our legally binding obligations under CPTPP and our agreements with the US, particularly on vehicles, which I will come to later, and on pharma—agreements that are vital to UK growth. What is the nature of the legal advice that the Government are relying on in saying that they will continue to deliver such international obligations once a revised TCA is agreed?
The Government’s assault on business—rises in national insurance, business rates, and dividend and capital taxes, and the Employment Rights Act—is already having exactly the effect on business that we forecast, with employment squeezed and a crash in economic optimism and enterprise. A report this week from accountants BDO showed that business activity dropped sharply last month after a brief rebound earlier this year ran out of steam. The truth is that there is a deeply serious situation facing Mr Burnham, and we cannot divorce our discussions today from this backdrop.
That brings me on to today’s Bill. Increasing mileage payments to 55p for the first 10,000 business miles is a measure we support. It is right that workers who use their own vehicles for work, including carers, should not be left to absorb rising motoring costs. I know that the announcement was the early fruit of an ongoing review, as the Minister explained, but can he tell us about the logic behind the difference in treatment for hard-working carers and others who drive more than 10,000 miles a year?
I turn to the HGV excise duty holiday. HGV duty had been frozen since 2014 until Labour came into office. While reducing it to £1 for a year will provide some welcome relief to the sector, it does not solve the problem, and Ministers should not overstate the impact. More than 95% of road haulage firms are small businesses operating on tight margins. The Government say the measure will save around £600 for a typical lorry and £900 for the largest vehicles, yet, to put it into context, filling a single HGV at peak prices can cost more than £1,000. This does not offset the wider pressures that the Government have imposed through higher business rates, transport taxes and fuel duty, with duty and VAT receipts of course rising whenever petrol prices spike. If the Government are serious about supporting businesses in this country, and particularly small businesses, they must consider this policy as one of a series of changes they must make to create a tax and economic environment that backs business, especially small business, rather than penalising it.
I turn now to the electricity generator levy. This was introduced under the last Government as a temporary windfall tax and a short-term response to exceptional circumstances. It was due to end in 2028. However, we now see the Government proposing to increase the rate from 45% to 55% and to extend it beyond 2028 with no end date. The case put forward by the Government is that the increased rates will support the decoupling of gas prices by incentivising generators into voluntary wholesale contracts for difference. However, while the new higher levy applies from today, those new contracts are yet to be seen. I believe the proposed strike price is not known. The likelihood of generators accepting them is therefore unknown and in question, and the value for money for taxpayers is yet to be proven.
Moreover, the HMRC impact note for this Bill contains no figures for the Exchequer impact. We should have that, ideally now or at least during the consultations that the Minister referred to. Rather than acting to lower energy costs by taking sensible steps to increase the supply of energy, such as utilising our resources in the North Sea and moving forward with Jackdaw and Rosebank, the Government seem to be using tax as a long-term lever to alter the incentives faced by generators.
We introduced a short-term, emergency measure with a clear sunset date. Sunsetting is a responsible approach to temporary taxation and short-term regulation, and I think it can be very useful. It helps to avoid the accumulation of too much regulation, and I know the Minister worries about unjustified accumulation because it can have an adverse effect on productivity. Sunsetting has the merit of allowing periodic parliamentary scrutiny and of encouraging officials to think creatively about other routes to a desired end. Instead, the Government appear to be moving to a long-term, final answer when the relevant contracts for difference parameters are unknown and untested.
Before the Minister asks, as he sometimes does, what we would do, the Official Opposition have been clear that we would cut bills for businesses and consumers through our cheaper energy plan. We would take VAT off energy bills, axe the carbon tax and legacy subsidies, and again use our resources in the North Sea as the Norwegians are doing. Tax cannot and should not be the long-term solution to the problem of affordable energy.
At this juncture I might remind the Minister of the OBR’s warning. It also agrees that tax cannot be the solution to all this. As we can see on page 81 of its report, there is a significant fiscal cost to the commitment to reduce carbon emissions to net zero by 2050 due to the loss of revenues linked to such emissions. This is particularly true of fuel duty, with three-quarters of the decline in revenue due to the transition to electric vehicles. This is a good example of the difficulties the Government face in relying so heavily on taxation to finance spending.
This Bill contains measures that in isolation are not without merit, but they must be seen for what they are: limited interventions against a backdrop of rising costs, weakening confidence and increasingly strained public finances. Temporary relief has its place but is no substitute for a serious growth strategy, a competitive tax system, disciplined public spending and an energy policy that brings costs down by increasing supply rather than by reaching for higher taxes. That is the test by which this Bill should be judged.
Lord Redwood (Con)
My Lords, I fully support my noble friend Lady Neville-Rolfe in her general statement about what needs to be done and in her specific criticisms and support for measures in this Bill. It is right that the best way out of the financial hole the Government find themselves in again is by growth. That is a cross-party idea on which we all agree.
Unfortunately, this Government have one main hope, which is that a closer relationship with the EU and taking more EU laws into our system will give them extra growth, whereas all the evidence of the past shows the opposite. Our growth rate halved when we were in the EEC compared with 20 years before we joined it, because of the damage that laws and extra taxes did to our economy after we signed up to first the customs union and then the complete single market. If we look at the leaks and possibilities around the reset, it is practically all cost and no benefit—it is Britain giving in and becoming a rule taker. The rules will be more restrictive on some of our industries that were beginning to benefit from not having to take on all the extra rules that the EU has been legislating. There will be a considerable financial bill with the extra costs of Erasmus, the administrative levies, maybe a solidarity levy and the loss of £6 billion of fish over a 12-year period. I am afraid the Government will not find growth there.
We are today focusing on this set of three limited measures. Like my noble friend, I think two of them are modestly beneficial. It seems perfectly reasonable to increase the mileage allowances given the way that costs have gone over recent years. The previous Government had not done it, and therefore it is perfectly welcome. It is also helpful to a haulage industry in great distress—because volumes are not ideal and because wage, tax and, above all, energy costs have gone up—to be given some relief, though the Government have chosen a rather modest form of relief in this VED reduction.
I have two criticisms. First, I am not sure that a year is the right period. I do not think we can guarantee that, miraculously, in a year’s time, other costs will reduce and they will not need this help any more. It would have been wiser to keep it open-ended to see what happens, particularly to energy costs. It is also concentrated on the heavier, bigger end of the commercial fleet. There are a lot of other businesses, particularly small businesses, struggling with the cost of smaller vehicles where there is no help offered. That is a pity, and it would be good if the Government looked again at the full range of businesses and the question of duration, because it may be that this judgment, while helpful, does not go far enough and is not over the right time period.
The biggest item, which I object to quite strongly, is the generator levy. It is quite true, as the Minister pointed out, that this was first introduced by the previous Government. I liked it no more then than I like it now; I made critical remarks to Ministers and tried to get them not to do it. If you are going to impose a windfall tax, it should be a genuine windfall tax geared to a level of price or profit that you have decided to designate as windfall. What has happened is that the last Government and now this one have built this windfall tax into all their Budgets as a regular feature, regardless of what the regional price of oil and gas turns out to be in the months or years ahead. It would be much more convincing as a windfall measure if it were geared to a price target and/or a profit target, came in and was fiercer when there was genuine windfall profit and dropped out as soon as there was not. The Minister will know, observing world markets, that with the continuing uncertainty created by the Ukraine war and the war in the Middle East, we are seeing pretty big volatile swings, particularly in oil prices. That will make a huge difference to the profitability of the businesses being taxed through windfall taxes. I would like the Government to think again about the whole principle of windfall taxation. If they want a windfall tax, it should be targeted and very clearly based on genuine windfall profits.
I have one further worry about the Government’s strategy over energy, which is illustrated by the tinkering measures in this legislation. They have gone in favour of very dear energy, with very high carbon taxes, emissions trading taxes and general impositions—fuel duties and all the rest of it. They say that they have net-zero reasons for this, but I think they also have revenue-raising reasons. They see it as one of the easiest ways forward without violating the central manifesto pledges. Now they realise, correctly, that they are overdoing it. With all the tax, the cost of energy is extreme. This country has a particularly virulent case of it, which is making us uncompetitive and losing us jobs and business, and therefore other tax revenues. So now the Government are in the business of finding ways of parcelling out modest subsidies or rebates on this excessive taxation in the hope that they will see them through and enable them to keep some business going.
I fear that the Government should come to the conclusion that they are not giving enough back to enough businesses and people. If Ministers look out there in the marketplace, they will see jobs being cancelled or lost, vacancies not becoming available, turnover not growing and profits turning into losses. There are factory closures coming through in all the high energy-using areas that we have talked about before, and the closure of oil and gas is having knock-on effects for refining and petrochemicals. We are seeing an industrial collapse mainly led and generated by excessively expensive energy. Offering a few bits back will not solve the problem.
I am glad the Government have now expanded the number of businesses that will get some kind of energy rebate to 10,000, but that is by no means all the businesses out there that are suffering badly from dear energy. They are not offering enough back because they are taking lumps out. They also wish to make it worse by joining the even more expensive EU carbon trading and emissions trading schemes, and introducing the CBAM to catch anybody who dares import higher energy-using products. I ask them please to think again. I want them to succeed in creating more jobs, promoting growth and getting investment and incomes up. This will do the opposite; dear energy is a killer.
Lord Sikka (Lab)
My Lords, I will confine my comments to Clause 1, which will increase the rate of the electricity generator levy from 45% to 55%. I fully support this increase and wish it had been higher.
Despite various initiatives mentioned by the Minister, Ofgem’s marginal pricing system remains fundamentally flawed. It ultimately determines consumer prices and, in the process, showers profits on companies generating electricity. The Ofgem cap is not based on average cost or a weighted average cost of all the inputs, or indeed on any notion of actual cost. One of Ofgem’s objectives is to ensure profit for each supplier at each stage—at generation, transmission, distribution and retail. This means that the Ofgem cap is set at the most expensive price or cost per unit, otherwise the marginal producer—the most expensive producer—cannot make a profit. This is the reverse of what happens in competitive markets, where the most expensive producer is driven out of business.
Ofgem’s pricing formula is a boon for companies generating electricity from oil, nuclear, renewables, solar, wind, hydro and other forms of inputs, because they are paid the price of electricity produced from gas, which is usually the most expensive input. The Bill does not reform Ofgem’s pricing formula. It does not fully decouple the price of gas-produced electricity from the rest. Instead, it takes a little more in excess profits via the levy. Even with a 55% levy, electricity generators will still be able to keep 45% of the excess profits manufactured by a flawed Ofgem formula. They have already kept billions in excess profits. What is the excuse for letting them keep still more?
The Government’s rationale is that the revenues resulting from this Bill will help to subsidise some businesses and households. But it will not help all households and all businesses and it does not provide long-term relief from profiteering by energy companies. A study by Unite reported that, since the pandemic, electricity and gas supply companies have increased their profit margins by 363%, and electricity generation companies have increased their profit margins by 198%. But successive Governments and Ofgem have made no attempt to reduce the profit margins of electricity generators. I hope the Minister will comment on this.
Can he also explain why Ofgem’s marginal pricing system has not been abandoned and why the price of gas-produced electricity has not been fully decoupled from the rest? Can he explain how much excess profit has been facilitated by Ofgem’s pricing formula and what proportion has been or will be recovered by the electricity generator levy?
It is worth noting that returns to energy investors are much higher because of flawed UK tax laws. I will provide some background before the detail. The background statistics are that 80% of UK offshore wind generation is foreign owned. The largest onshore wind farm in Wales is owned by a Swedish entity, EDF is 100% owned from France, E.ON is based in Germany and Scottish Power is owned by a Spanish multinational. The shareholders of their UK operations, mostly based abroad, receive billions in dividends without deduction of tax at source. In other words, they pay no tax whatever on those dividends. This results in huge loss of tax revenues that could help the Government to increase support for energy customers. Countries such as the US, Australia and Sweden deduct a withholding tax at source on dividends paid to foreign investors. They make a distinction between investors resident in tax- treaty countries, EU countries and non-co-operative tax havens. Can the Minister explain why the Government do not do the same and why they are content to forgo billions in tax revenues by not having a withholding tax?
I am also concerned about the lack of good energy infrastructure. Since privatisation, National Grid has paid £28 billion in dividends, plus millions more in share buybacks, but we do not actually have a good energy infrastructure. This is similar to the woes of the water industry. This week, it has been reported that Britain’s biggest community solar project has been forced to shut for the duration of its first summer by the Government’s energy system operator to avoid overloading the local grid with renewable energy. During periods of high wind, the Government pay companies up to £180,000 an hour to switch off wind turbines. At the same time, gas plants are paid extra to produce more electricity to balance the system and meet demand. For the period September 2021 to April 2025, the cost of balancing the electricity grid came to £11.8 billion and it is expected to hit £8 billion a year by 2030. Can the Minister explain why, after 36 years of privatisation, National Grid and other energy companies are not penalised for failing to provide a good and reliable electricity transmission and storage system? I look forward to hearing the Minister’s reply.
Lord Fuller (Con)
My Lords, my contribution is in two parts. Briefly, it is about time that the mileage rates went up to 55p. It reflects the obvious truth that the cost of getting about has become more expensive. These real costs must be covered, so I welcome this measure, in so far as it goes, but observe that it would have been much better had the rates been indexed for future years so as to avoid these cliff-edge effects. I also welcome the support for our hard-working lorry drivers. I know from personal experience, when I used to run trucks myself, how hard it is to make a living from road transport. In fact, we paid £1 million of tax per year on 40 vehicles before paying a single penny in corporation tax. The taxman has the first pull on the road.
I turn to the electricity generator levy. This is just another line in taxes, fees, charges and levies that have taken the aggregate burden of taxation to new highs, and which press down on our economy and squeeze the dynamism from it. Labour thinks it is going to tax the generators, but, as we all know, these levies work through, and are borne by, the consumer, so the Bill is adding another layer to the cost of living.
Last week, the lights nearly went out. For the third time this summer, NESO broke the glass to plead for generators to supply more electricity—any electricity, at any price. NESO has never had to ask for a margin in the summer before. On Friday last week, the Times reported that Britain was “close to blackouts”, and that the scale of the crisis “was hidden”. Let us shine a light on that. The Times reported that staff at NESO allege that, for “multiple periods” on 23 June,
“the grid fell outside safe operating limits … At the time the grid was using all possible supplies of power to meet demand, meaning that if any of these had failed it would have triggered an automatic system shutdown causing power cuts across the country”.
There have been other cases since.
The Government’s impact assessment of the Bill says it is
“not expected to have any significant macroeconomic impacts”.
All the boxes where the fiscal assessments would normally be written are empty. GOV.UK tells us that the
“Exchequer Secretary to the Treasury, has read this … information and … given the available evidence”
concludes that
“it represents a reasonable view of the likely costs, benefits and impacts of the measure”.
As Britain sweltered, it turned out that 420 of our critical cool-chain food warehouses, which store half our nation’s food, could barely keep their contents cool enough. In Spain, when the lights went out, people on life-support machines died. Last week, if it were not for the kindness of strangers in France, the lights would have gone out. If we meet France in the World Cup in five days’ time, who knows what will happen? Is this the impact the Exchequer Secretary had in mind?
Labour has brought us a grid that is demonstrably more fragile, wholly less reliable and significantly more expensive. It has brought our manufacturing economy to its knees with the world’s highest electricity prices, and this measure will make them more expensive still. We might have expected a margin call in January, when short day lengths and low winds combined with high demand for heating can cause a shock. That is expected, planned for and avoided. However, we do not expect that in the summer, when we are told that solar panels will make us more energy secure.
This measure will have significant unintended consequences beyond jacking up prices. Quite simply, it will make the cost of generating electricity more expensive. That will harm the investment case for building new power stations, so we will become even more reliant on the kindness of strangers. The reason we have high prices is that supply is constrained. We have reduced the competitive tension in the market with an overfocus on renewables. The truth is that this measure will harm the generating fleet replacement of our power stations as they wear out. The hard truth is that, when the person in the NESO control room presses the button, we need energy generators to supply electricity. There is nothing wrong with having power stations ticking over that are available to leap into action when, if the price is high enough, the call to action is given. That is how the market works. In these moments, given a choice between having the lights go out or paying through the nose, we need to pay up and look big. However, when we are in that hole and need these people to jump to attention, increasing the levy from 45% to 55% is biting the hand that feeds us at the very moment we are in greatest peril.
This generator levy reduces the incentive for companies to participate in the break-glass market unless we accept that the wholesale price is driven higher still. I can hardly believe what I am about to say, because I agree with the noble Lord, Lord Sikka, that the way to fix the energy market is not to have even more levies. It needs reform, because crowd-pleasing price caps and rent caps such as this will never work. We need reform of the energy market to break the link with gas, but this is not the way to do it.
Disincentivising the replacement of our power stations is going to lead to something worse and wholly more sinister. There are special types of power station that must be spread throughout the grid for it to function properly. These power stations provide grid frequency stabilisation and ensure that power matches electricity supply with the right frequency, tightly controlled around 50 hertz. In fact, keeping within 1% of that 50 hertz figure is a legal obligation for NESO, otherwise we all get contagious blackouts and equipment damage, so these inertial power stations have special value, value that must be paid for and that is perversely bought within the scope of this measure.
We have a structural risk on our grid in that there are only two of these special power stations north of the River Humber. Both are scheduled for closure and none for replacement. With more levies, there are fewer incentives to build their replacements, so the Bill is laying the structural framework for the entirety of the electricity grid in our nation, which extends to Ireland, but especially in the north of England and Scotland, to fail, by disincentivising the replacement of the special power stations that maintain the frequency and protect our economy.
Perhaps the Minister should have a word with the Exchequer Secretary to the Treasury, in the few days he remains in post, to explain that there are, after all, plenty of consequences to the Bill. In the meantime, this is where Labour’s ignorant energy fundamentalism has brought us. It is not that the lights normally go out under Labour; it is that this Government are legislating to ensure that they do.
Earl Russell (LD)
My Lords, we on these Benches broadly support this Bill. It contains three sensible if modest measures responding to the real pressures households and business face because of the ongoing conflict in the Middle East, and we will not oppose them. Our wish is for the Government to do more to protect the public and the economy from the impacts of this continuing conflict, and to see that these measures are monitored, reviewed and reported on.
I note that the fragile ceasefire, which many had hoped would bring stability to the region, has now completely broken down again. We have now had three days of American attacks on Iran; Iran has struck numerous tankers in the strait; and Trump is now talking of imposing a toll on all ships exiting the strait. The cost of oil has shot up again overnight, so this conflict is far from over, and its consequences for the UK, in terms of energy prices, fuel costs and the cost of living, will continue to be felt for some considerable time. I seek reassurance from the Minister that today’s measures must not and will not be the limit of the Government’s ambitions. They are welcome but they are minor in scale.
This Bill does little to bring down the underlying cost of energy, particularly electricity, which remains stubbornly and unreasonably high. In brief, the Bill’s three measures are an increase in the electricity generator levy from 45% to 55%, targeted at exceptional returns when wholesale prices spike; an increase in the approved mileage allowance rate from 45p to 55p per mile for the first 10,000 miles, backdated to the start of this year; and a 12-month vehicle excise duty, or VED, holiday for most heavy goods vehicles renewing their licence between 1 July 2026 and 30 June 2027, reducing their liability to a nominal £1.
On the mileage rate, I echo the point made by my honourable friend the Member for St Albans in the other place that this increase is long overdue, and it will particularly benefit those who work in the care sector. What steps will the Government take to ensure that care workers are made aware of it?
On the vehicle excise duty, hauliers have understandably welcomed the relief, and we support it. Given that the conflict’s impacts represent ongoing costs beyond the 12 months, why did the Government not consider giving themselves the power in this legislation to extend the holiday for a further year without the need to bring back further primary legislation? What confidence do the Government have that this relief will be passed through to consumers rather than absorbed elsewhere in the supply chain? The public would rightly be concerned if haulage costs continued to rise. What monitoring is planned? And will this be reported at least by the Autumn Budget, or is there an option to do that sooner?
On the electricity generator levy, we have long argued for exactly this kind of decoupling of electricity prices from volatile gas prices that this increase is said to encourage, and we support that objective—although we do not feel that this measure alone is capable of doing that. Can the Minister assure the House that this levy increase will not undermine those ambitions?
The levy increase is in effect the stick to the carrot of longer-term contracts, and the interaction between these two policies is quite a complex matter. How will the Government keep the overall objective under further scrutiny? A higher rate is only a proxy for the real goal of moving legacy generators off spot price exposure and on to newer fixed-term contracts for difference.
I would be grateful if the Minister could set out how progress on the actual migration to CfDs will be monitored and reported. Without that information, it is quite difficult for Parliament to make a determination on how this wider policy objective has been achieved. More broadly, will the Minister confirm that, should the conflict continue, the Government will bring forward further measures as needed and keep both Houses updated?
We support this Bill, but it needs to sit alongside a much wider set of proposals that we believe are required—indeed, many across the House have strayed beyond the measures in the Bill into broader areas. My party has called for a three-month, extendable emergency transport package to keep Britain moving, an immediate 10p cut in fuel duty, a cap on bus fares at £1, a 10% cut in rail fares and a reduction in VAT on public electricity charging. We have also set out a permanent essential energy guarantee, giving every household a discount on its energy use, with vulnerable and larger households receiving more. And we continue to press for the wider structural reforms that would genuinely bring down bills for good, such as an energy security bank offering low-interest loans for home energy improvements and reversing cuts to insulation programmes so that we can halve energy bills within a decade.
Can we expect serious and detailed plans to come in the energy independence Bill to make sure that the cost of our energy is reduced—particularly the cost of electricity, which, as I know the noble Lord is aware, we need to bring down so that we can get people on to EVs and heat pumps? The cost of electricity remains too high, the crisis in the Middle East is not resolved, and much remains to be done. Should the crisis continue and deepen, we stand ready to co-operate with Ministers and government to protect our citizens and our economy from the worst of its impacts.
Lord Altrincham (Con)
My Lords, I thank all noble Lords who have spoken in this debate and the Minister for his usual courtesy in hosting it and for his explanation of the rather undefined windfall tax that my noble friend talked about. In particular, I note the lively contributions of my noble friend Lord Fuller and the noble Lord, Lord Sikka, who both touched on the fraught areas of contracts for difference and high wind—perhaps the Minister could comment on that.
As we have discussed, the Bill contains some small and mainly useful welcome measures. The Government’s recognition that more must be done to support small businesses is also a step in the right direction. However, the difficulty we see is that, while such measures may have a place as emergency, short-term relief, as the previous Government recognised, they cannot form the basis of a sustainable, long-term economic strategy.
More widely, noble Lords will be aware that the interim report of the Timms review of disability benefits spending was published last week, and it showed that spending is forecast by the Department for Work and Pensions to rise to more than £41 billion by 2031 on that benefit alone. As my noble friend and other noble Lords have made clear, the Office for Budget Responsibility has warned that taxes will have to rise or spending will have to be cut if we are to avoid an unsustainable path for debt. The tax rises that this Government have already imposed are themselves becoming unsustainable: they are penalising businesses, tourists, publicans, workers and those who want to come to this country to generate wealth, investment and employment.
A more sensible approach would be to take steps to increase domestic energy supply from the North Sea, to support growth and to ensure that any tax reliefs are matched by credible reductions in spending. The Government’s net-zero approach has weakened our domestic energy industry and left us increasingly dependent on global supplies, including from countries that continue to support Russian oil. In the latest round of sanctions, the Government left open a loophole for Russian oil that is refined into diesel and jet fuel in third countries. Indeed, we are now in the extraordinary position of relying on adversaries, and on global supply chains shaped by them, to meet demand that we could and should meet through domestic energy production. That is bad for our economy and has led to a degree of industrial collapse, as noted by my noble friend Lord Redwood. It is bad for our energy security and our standing in the world.
What we need from this Government is a serious plan to address the underlying problem. Spending must be brought under control—and quickly—if we are to keep public finances within the bounds of sustainability. Welfare would seem an obvious place to start, but any new Government will need the political courage, discipline and authority to deliver reform at the scale required. The wider economic challenge facing the Government will become only more serious if this is the approach that the new Administration, under the incoming Prime Minister, take to the economy, energy security and fiscal policy.
Lord Livermore (Lab)
My Lords, it is a pleasure to close this Second Reading debate on the Taxation (Energy and Vehicles) Bill. I am very grateful to the select group of noble Lords for their contributions and questions.
The measures contained in the Bill will support businesses across the UK as they deal with the immediate economic costs associated with the ongoing conflict in the Middle East. We did not start this conflict and we did not join it, but it is impacting our economy, including by putting pressure on energy markets and disrupting supply chains. That is why, as the Chancellor has said repeatedly, we must continue to be responsive to a changing world and responsible in the national interest.
The noble Baroness, Lady Neville-Rolfe, once again unfortunately sought to talk down Britain’s economy, yet the latest economic data shows that inflation in the UK held steady while it rose in other comparable countries. The noble Baroness and the noble Lord, Lord Redwood, spoke about economic growth, but they did not mention that Britain’s economy was the fastest growing in the G7 for the first quarter of this year. The noble Baroness also spoke about debt borrowing being forecast to fall in every year of this Parliament.
The measures contained in the Bill cover three areas: the electricity generator levy, mileage rates and the vehicle excise duty for heavy goods vehicles. The noble Baroness seemed keen to talk about almost anything other than the measures contained in the Bill, but when she did focus on them, she said that they were just short-term measures, a point also made by the noble Earl, Lord Russell. I disagree; the measures contained in the Bill will provide important immediate support to families and businesses as they deal with the consequences of the war in the Middle East, including the largest ever uprating to mileage rates and a significant reduction in the vehicle excise duty for haulage firms. The increase to the electricity generator levy also forms part of a wider long-term strategy to delink gas from electricity prices, helping to shield consumers from the impact of volatile prices. However, as I set out in my opening speech, the measures form just one part of the wider support we are providing to households and businesses, and we stand ready to go further where necessary.
The noble Baroness also asked about North Sea oil and gas. She knows that I agree with her that North Sea oil and gas production is an important and valuable resource and its workforce is a vital asset to our country. That is why we are harnessing our domestic supply by managing existing fields for their entire lifetimes, including by allowing tie-backs for those fields to ensure that they remain viable.
The first measure in the Bill concerns the electricity generator levy. The price of energy has risen since the war in Iran began, benefiting generators whose costs bear no relation to the price of gas. The Government’s objective is to ensure that those who benefit from these increased prices and volatility pay their fair share. That is why we are delivering an increase to the rate of the electricity generator levy from 45% to 55% and extending it beyond its original sunset date of 2028. Raising the rate will ensure that a greater percentage of exceptional generator revenues is made available to support businesses and households, and it will help break the link between electricity and gas prices by encouraging participation in the new wholesale contracts for difference mechanism.
The noble Baroness asked about the end date. The Government plan to extend the electricity generator levy beyond 2028 to encourage participation in the new contracts for difference mechanism and therefore provide more certainty to firms by offering a fixed price for the electricity they produce. We will work closely with industry to design the post-2028 electricity generator levy regime. DESNZ is planning to publish a consultation on the new contracts for difference mechanism later this year. The design of the electricity generator levy will be considered alongside this consultation.
The noble Lord, Lord Redwood, criticised the Government’s energy policy overall. My noble friend Lord Whitehead set that out, in probably greater detail than I can, in answer to the noble Lord’s question in the previous debate today. As the noble Lord knows, in this country we are particularly exposed to volatile gas prices, not least because the previous Government failed to invest in renewables. We need to invest in an economy that is as low carbon and based as little on gas as possible. By delinking from gas, a key part of the measures contained in the Bill, we can help to separate the price of electricity from the volatile price of gas internationally.
The noble Lord, Lord Fuller, said that we would increase the cost of electricity, but I believe that helping to delink from gas will do the exact opposite. The noble Lord also said that these measures would disincentivise future investment. They clearly will not do that, because the electricity generator levy has strong protections for new investment after 2023, which is exempt from the levy. The electricity generator levy is levied only on legacy renewable generators who stand to make extraordinary profits when high gas prices set the wholesale price without any commensurate increase in costs.
The noble Baroness, Lady Neville-Rolfe, asked about the wholesale contracts for difference scheme. Businesses have welcomed the announcement of the scheme and the certainty that these contracts will provide them with for years to come. The chief executive of the CBI said:
“If implemented correctly, voluntary contracts for difference could reduce the impact of gas on retail electricity prices and ensure the benefits of clean power can be realised across the economy”.
It is right that we now work closely with businesses on the detail, which is why they will have the opportunity to respond to the consultation that DESNZ is planning to run later this year.
My noble friend Lord Sikka asked a series of questions, which I will look at in greater detail. I will write to him, if I am able to do so.
The second measure contained in the Bill relates to mileage rates. I am grateful to the noble Lords, Lord Redwood, Lord Fuller and Lord Altrincham, the noble Earl, Lord Russell, and the noble Baroness, Lady Neville-Rolfe, for their support for this measure. As fuel prices have risen so has the cost of filling up the car or van for those who drive to work. Despite that, mileage rates have not changed since 2011. In recognition of these pressures, the Chancellor has announced the largest ever increase to mileage rates and the first uprating in 15 years.
The noble Baroness asked how the Government determined these uprated rates. In determining them, the Government considered the need to respond to the effect of the war in the Middle East on fuel costs after a prolonged period with no change, while balancing support for individuals with overall fiscal responsibility. She asked about the 25p rate. Our objective has been to focus support where costs are highest. The vast majority of drivers travel fewer than 10,000 miles a year. The 25p rate above 10,000 miles reflects the fact that the marginal cost of driving falls as mileage increases, with fixed costs such as insurance, servicing and depreciation covered by the higher 55p rate. Petrol and diesel motorists, including those who use their own vehicle for work, will also benefit from the extension of the 5p fuel duty cut to the end of this year.
The noble Lord, Lord Fuller, mentioned indexation. The decision the Government have taken on mileage rates is a targeted response to current cost pressures. The review announced by the Chancellor in March will consider the rate beyond 2026-27. Annual indexation is not currently the Government’s policy. The Government have already committed to a review of these rates and will set that out at the Budget.
The noble Earl, Lord Russell, asked about communicating to care workers. As he may know, the trade union UNISON has warmly welcomed this measure. I believe that we will communicate actively to its members.
The third measure contained in the Bill is the vehicle excise duty on heavy goods vehicles. The road haulage sector plays a vital role in transporting goods across the UK, but haulage firms are disproportionately exposed to higher fuel costs. That is why we are providing additional targeted support for the sector through the Bill, with a 12-month holiday from vehicle exercise duty for the majority of heavy goods vehicles. The noble Earl, Lord Russell, also asked about the power to extend this measure further, beyond one year. That would be perfectly possible in future Finance Bills and would not require any additional primary legislation.
The noble Lord, Lord Redwood, asked about smaller vehicles, not just HGVs, being included in this. Van drivers, for example, will benefit from the decision we have taken to extend the 5p fuel duty cut to the end of this year. Those who use their own vehicle for work will also benefit from the mileage rates increase in the Bill; that includes the 163,000 van drivers who are currently estimated to be claiming simplified expenses. It is right, though, that the Government balance direct support for firms with overall fiscal responsibility. Extending these measures to vans would cost an estimated £1 billion to £1.5 billion a year, but we will continue to keep this issue under review.
The noble Baroness, Lady Neville-Rolfe, asked about the impact of other taxes. Typical HGVs will save £600, while HGVs with higher vehicle emissions will save £912. In total, the decision taken since the general election to freeze fuel duty will save the average HGV over £2,000, compared with the previous Government’s plans.
This Government have the right economic plan to deliver secure and resilient growth in a changing world. The war in Iran continues to create uncertainty and volatility in the global economy and, therefore, higher costs for businesses here in Britain. The Government have responded by providing immediate support to help with these additional costs, including through the measures contained in the Bill. The Bill shows that, in the face of global pressures, the Government will continue to be responsive to a changing world and responsible in the national interest.
Cyber Security and Resilience (Network and Information Systems) Bill
Tuesday 14th July 2026
(2 weeks, 5 days ago)
Lords ChamberRead Full debate Cyber Security and Resilience (Network and Information Systems) Bill 2024-26 View all Cyber Security and Resilience (Network and Information Systems) Bill 2024-26 Debates Read Hansard Text Watch Debate Read Debate Ministerial Extracts Amendment Paper: Consideration of Bill Amendments as at 16 June 2025 - large print - (16 Jun 2026)
Baroness Lloyd of Effra
That the Bill be now read a second time.
Northern Ireland, Scottish and Welsh legislative consent sought. Relevant document: 3rd Report from the Constitution Committee
The Parliamentary Under-Secretary of State, Department for Science, Innovation and Technology (Baroness Lloyd of Effra) (Lab)
My Lords, we are a proudly online nation, embracing interconnectivity in all walks of life. Cloud-based working, the rise of software as a service, the advent of artificial intelligence and more have rocketed the UK forward. They have enabled us to work faster, more efficiently and with more flexibility than ever before.
However, with these advancements come risks. As the technology powering our modern economy has leapt forward, so too have the tools that our adversaries use to extort, disrupt and surveil. Last year, more than 600,000 UK businesses were subject to cyber attacks. This is not only holding businesses back; it is undermining our security. These are criminals and hostile state actors seeking to disrupt the very foundations of our country.
The UK is now the most targeted country in Europe for cyber attacks. It is the duty of this Government to take bold action. We have been clear that all businesses must protect themselves from cyber attacks, but this does not mean regulating every single business. They know their customers and their suppliers, and they are best placed to protect themselves, using the free tools that we have provided.
I commend those who have already signed our Cyber Resilience Pledge, and urge more to do so, committing to take the three simple steps recommended in it: making cyber a board-level responsibility and following the cyber governance code of practice; signing up to the National Cyber Security Centre’s early warning service; and taking a risk-based approach to requiring Cyber Essentials across supply chains. This is our government certification scheme to help organisations improve their cyber resilience. Cyber Essentials works. Organisations with it are 92% less likely to claim on their cyber insurance than those without it. Taking these steps can make a huge difference.
However, where the risks are so great that public safety, the economy or our national security is threatened, it is right that we regulate. The Network and Information Systems—NIS—Regulations 2018 are the UK’s only cross-sector cyber legislation. They apply to operators of essential services in the energy, health, transport, drinking water and digital infrastructure sectors, as well as some digital service providers. The NIS regulations are designed to protect the security and resilience of our most essential services, to keep lights on, to ensure that taps keep running and to protect our NHS. We regulate only where we must, which is why the scope of the NIS regulations is precise. They are a targeted security intervention and the best tool in our arsenal to protect our most essential services. However, the regulations have fallen out of date. If we do not act, the essential services on which we all depend will remain under threat.
That is why we have introduced the Bill. The Cyber Security and Resilience (Network and Information Systems) Bill is a vital opportunity to improve the UK’s defences. In fact, it is the first Bill in British history to have “cyber” in its title. It will update the NIS regulations for the modern age and ensure that the Government can maintain their effectiveness and respond to imminent national security threats.
The objectives behind the Bill are threefold. First, it will safeguard the services on which our people rely most, making our essential and digital services more secure. Secondly, it will deliver a step change in our national security, improving our defences against the cyber attacks that threaten this country. Thirdly, it will better protect our economy. The UK will be a safer and more attractive place for businesses to establish themselves, thrive and grow.
The Bill will achieve these objectives through proportionate and timely measures, which I will speak to in turn. First, the Bill brings more sectors into scope of the NIS regulations. As our economy becomes more interconnected, so do the routes that cyber criminals exploit. For example, data centres in the UK have become critical to nearly all our economic activity and public services. From NHS patient records to financial systems, these vast digital depots are a key part of the modern world. That is why data centres meeting the Bill’s thresholds will be regulated as essential services, ensuring that they take steps to secure their networks.
The Bill also brings large load controllers under regulation. These are organisations that manage significant electricity flows to or from smart appliances. They must be safeguarded to secure our electrical grid and protect consumers using such appliances.
We are also bringing large and medium managed service providers—MSPs—into scope of the NIS regulations. These are organisations offering ongoing services, such as remote IT support or cyber security threat management, to customers. MSPs have deep access into their customers’ systems. As more and more organisations rely on them, MSPs become an increasingly attractive entry point for disruption.
Noble Lords will remember last April’s cyber attack on M&S. It involved a managed service provider being socially engineered, with attackers being able to gain access and compromise systems. We need to close this gap. But these regulations must be proportionate and targeted. Large and medium MSPs comprise fewer than one in 10 of the MSPs active in the UK but account for around 97.6% of the UK’s MSP revenue, so small and micro MSPs will be exempt from this measure. By targeting regulation where the risk and reach are greatest, we will protect almost all MSP customers without burdening small businesses.
In limited circumstances, small and micro-businesses supply critical goods or services to the essential and digital services on which we rely. The Bill therefore enables businesses, including smaller companies, supplying critical goods or services to be designated as “critical suppliers”. This is designed to combat the cyber risks stemming from increasingly complex supply chains.
Members may be aware of the 2024 attack on Synnovis, a pathology provider to some NHS trusts. Criminals thousands of miles away deployed ransomware and made Synnovis’s files unusable, delaying 11,000 appointments. This demonstrates the ripple effect that a compromised supply chain can have on the services at the ends. Duties that critical suppliers will be subject to will be set out in secondary legislation.
I turn to our 12 NIS regulators, whose sectoral expertise is critical to protecting our essential and digital services. These regulators are often operating with one hand tied behind their backs. They do not have the information, resources or levers necessary to properly fulfil their duties. For instance, organisations need only tell their regulator about an incident once it has already caused significant disruption. Under the Bill, they will have to report more types of breaches, to their regulator and the NCSC, within 24 hours and provide a full report within 72 hours. This includes incidents such as pre-positioning and ransomware, where an incident may not cause immediate damage but poses a real threat to the UK economy or society.
This will not only enable the NCSC to support those affected more quickly and warn others but allow the Government to better understand the threat landscape. Furthermore, the Bill requires digital and managed service providers and data centres to inform their customers about reportable incidents that are likely to adversely affect them. This way, customers can take appropriate steps to protect themselves.
However, effective reporting must be matched by consistency. Our 12 regulators cover all NIS sectors and the UK’s four nations. We must utilise their sectoral expertise but ensure that the rules are applied consistently. We cannot allow any sector to become an easy target. This Bill enables government to designate a single set of strategic priorities, as well as objectives tied to them, that regulators must seek to achieve. This will complement the security and resilience requirements, to come in secondary legislation, setting clear, consistent expectations and putting good practice on a firmer footing.
The Secretary of State will be required to consult the regulators on a draft of the statement before designating it. In addition, the Bill gives regulators new powers to recover their full regulatory costs from the organisations that they oversee. This includes enforcement costs, ensuring that this is not conducted to the detriment of a regulator’s books. Regulators must consult on how these fees will be calculated and publish a yearly statement to show how these funds were used.
The Bill also raises the maximum penalty enforceable for regulatory breaches while simplifying the penalty bands for easier, more consistent application. Regulators must consider all circumstances of a case before setting a penalty. This is not designed to punish companies but to incentivise their compliance. The ideal scenario is no penalties at all.
We are also fixing legacy issues concerning information sharing, so regulators can better understand what can and cannot be shared and with whom. All information shared must meet a specified purpose or require permission to be shared and be relevant and proportionate to the purpose for which it is shared. This Bill unties our regulators’ hands, giving them the information, resources and powers that they need to hold the line. That is what effective regulation should look like.
Finally, the Bill contains some important measures to enable future resilience, ensuring that the NIS regulations remain effective into the future. This Bill introduces a targeted, essential set of delegated powers to enable the NIS regulations to keep pace with the ever-changing cyber landscape. These include powers by which the Government can bring new services or sectors into scope of the regulations, so long as they meet the Bill’s strict criteria, or make regulations to further mitigate the risks from security and operational compromises. In the majority of cases, these delegated powers will be subject to consultation and the affirmative procedure will apply. Today’s threats were unimaginable in 2018, so we must not legislate as though today’s threats will stand still. These are carefully targeted, and it would be remiss not to take this opportunity to provide for careful, proportionate delegated powers. In almost all cases of these powers, the Government must consult on any changes. Parliament will still have the final say over legislation made under these powers. Our delegated powers memorandum contains greater detail.
In exceptional cases, even secondary legislation is too slow. Right now, if our intelligence community becomes aware of a NIS incident that threatens our national security, the Government have no emergency power within the NIS regulations to protect our people. This Bill provides powers for the Secretary of State to direct regulators and regulated entities where national security is threatened. This could entail instructing a sector to follow new guidance in response to a crisis or requiring an organisation to take technical steps to remove an intruder from a network. These are essential last-resort levers. The Bill has strong safeguards to ensure that they are used accordingly and only where strictly necessary for national security.
This Bill is about protecting the foundations of a modern economy. Growth cannot flourish where essential services are vulnerable, where businesses are exposed to disruption and where hostile actors can exploit weaknesses. We are not choosing between security and growth; we are recognising that one depends on the other. This will help secure the services that our people rely on, give businesses the confidence to invest and grow and strengthen our national security in an increasingly dangerous world. I beg to move.
The Earl of Effingham (Con)
My Lords, I thank the Minister for introducing the Bill before your Lordships’ House this afternoon. His Majesty’s loyal Opposition support the objective which lies behind this legislation. The cyber threat facing the UK is growing incrementally, both in scale and in sophistication. From hostile states to organised crime, from ransomware attacks on our public services to increasingly complex attacks on critical national infrastructure, the need to strengthen our national resilience is indisputable.
Many noble Lords will be familiar with a number of reforms contained within this Bill, predominantly because they originate from the review of the Network and Information Systems Regulations undertaken by the previous Conservative Government following the consultation that was launched in 2022. It should not be a surprise that we welcome measures to improve consistency across the various regulators responsible for enforcing the existing regime. However, support for the objectives of a Bill should never prevent your Lordships’ House from asking whether the legislation is sufficient and proportionate.
Most importantly, noble Lords would be right to constructively challenge whether this legislation forms part of a coherent strategy. That should be a central question. We are being asked to scrutinise and revise one of the fastest-moving areas of public policy without the Government having first published the cyber strategy within which these measures are intended to sit. Ministers have described this Bill as merely one component of a wider programme to strengthen Britain’s cyber resilience, so it is entirely fair and reasonable to ask, “Where exactly is that programme? Where is the strategy? Where is the explanation of how these powers fit within the Government’s broader approach to protecting our digital economy and our critical national infrastructure?”
Only last Thursday, we heard an Oral Question on the impact of AI in vaccine technology. It is obvious to all that AI is, regrettably, also transforming how cyber attacks are conducted, increasing both their scale and their sophistication. Hostile states have become more aggressive. Organised crime has become more capable. The boundary between economic security and national security has become ever more blurred. Yet little of that ever-shifting landscape appears to find expression within the Bill itself. In fact, artificial intelligence does not appear to feature in the legislation. Quantum cracking does not feature. Weaponised disinformation does not feature. The wider question of how government intends to respond to AI-enabled cyber threats remains unanswered. Nor does the Bill address the long-standing concerns surrounding the Computer Misuse Act, despite repeated calls from the industry for reforms that better reflect modern cyber security practice and remove the legal uncertainty facing legitimate cyber security researchers.
Legislation in this field is unlikely to come before Parliament every year. That places a particular responsibility on noble Lords now to ensure that what is enacted today remains relevant, as much as it realistically can be, tomorrow.
The Government have shown an enthusiasm for regulation across a number of sectors. Sometimes regulation is necessary; sometimes it is unavoidable; but good regulation should always be proportionate. This is especially true when it comes to firms that are already navigating an increasingly complex regulatory environment and face ever more costly obligations under the Government’s direct and indirect taxing of small businesses. The Bill introduces new obligations, new reporting requirements and new compliance duties for organisations operating in sectors that are undoubtedly important to our national resilience.
It may be the case that some of this regulation is justified. However, it also raises many questions for the Opposition, the most pressing of which is: what assessment have the Government made of the cumulative regulatory burden these measures will impose on businesses? Many organisations are already subject to reporting requirements under data protection legislation, sector-specific regulation and forthcoming proposals concerning ransomware reporting. If these various obligations are not properly aligned, businesses risk finding themselves complying with multiple reporting regimes for what is in reality the same cyber incident. This would not strengthen resilience but rather create additional bureaucracy during a time of crisis.
Nowhere is this of greater concern than for small and medium-sized enterprises. Large multinational organisations generally possess dedicated legal and compliance teams and cyber specialists capable of navigating increasingly complex regulatory requirements. Smaller businesses simply do not have the resources to do that, and often these businesses are the very scale-ups and high-growth companies upon which our future economic prosperity and unicorn status depends.
Everyone wants economic growth—none more so than His Majesty’s loyal Opposition—but if the Government want growth, they must ensure that cyber regulation does not become yet another barrier to enterprise and innovation. Will the Minister therefore confirm to your Lordships’ House that the overwhelming majority of SMEs will remain outside the scope of these new regulatory requirements? By what benchmark will an SME be defined in the legislation? Will the Minister please explain what support, alongside the new obligations, the Government intend to provide for those smaller organisations that may ultimately fall within the regime? Resilience cannot simply be legislated into existence; it requires expertise and resources.
The Bill grants significant new responsibilities to regulators operating across a wide range of sectors. For these provisions to operate successfully, the legislation assumes that such regulators possess both operational capacity and the expertise necessary to exercise those responsibilities effectively. Will the Minister outline how these assumptions have been stress-tested?
Finally, the Bill confers important national security powers on the Secretary of State. Although these powers may well prove necessary, they also reinforce the importance of transparency. The exercise of national security powers should be informed by clear principles and robust accountability, particularly where they concern hostile foreign actors seeking to undermine our critical infrastructure. Will the Minister inform the House what mechanisms are going to be in place to ensure such accountability?
His Majesty’s loyal Opposition do not dispute that the cyber threat facing our country is real; nor do we dispute that the Network and Information Systems Regulations require updating. Indeed, much of the work underpinning this Bill was initiated by the previous Conservative Government. But surely we need a strategic framework instead of having to ask: why these sectors, why these thresholds and why these powers, and how does this legislation fit alongside artificial intelligence, ransomware policy, national resilience and wider cyber reform? These are not unreasonable questions. They are precisely the questions that a responsible analysis of a slew of updated proposals require, and we ask the Government to provide the strategic context which accompanies the Bill before us.
Baroness Northover (LD)
My Lords, I too thank the noble Baroness for introducing the Bill. From these Benches we welcome the Bill, but we feel that in a number of ways it does not go far enough. Hostile state actors, organised crime and others are increasingly targeting our systems at every level with potentially catastrophic effects, as previous speakers have said. Attacks on our energy networks, water supplies, transport systems, financial infrastructure and digital services are becoming more frequent. It is clearly vital that organisations that deliver essential services have high standards of cyber security and that they should report serious incidents promptly and transparently. We also recognise that the coverage of those who need to report in this way should be widened. However, is the Bill ambitious enough?
I serve on the House of Lords Select Committee on National Resilience—there is at least one other speaker in the debate who also serves on that Select Committee—and I will draw here from some of the evidence that has been submitted to us. We were, of course, part of the EU arrangements until Brexit, and this is yet another area we needed to address after that. That resulted in the 2018 regulations, which this Bill seeks to update. The post-Brexit arrangements seem to have complicated putting in place clear primary legislation. The Minister in the Commons noted that Brussels is pressing ahead with its own updates “while we lag behind”. He stated that this
“procedural quirk has left essential UK services more exposed, which perhaps tells us something about why the UK has such appalling figures compared with some of our EU counterparts, as hackers and cyber criminals exploit gaps in our dated laws”.—[Official Report, Commons, 6/1/26; col. 179.]
We do indeed have the worst record in Europe for such attacks. I would argue, from submissions we received to our Select Committee, that it makes most sense for us to be aligned with the EU regulations. It has been put to us that this would mean that organisations do not need to answer to two sets of regulations in Europe. It is clear that this would assist us anyway, given that the EU regulations cover a wider range of areas, which it makes little sense to overlook as the Government appear to be doing. As it was put to us by ISC2,
“the government may have missed an opportunity to have the same taxonomy of CNI across jurisdictions. For example, the EU’s NIS2 directive on cybersecurity includes manufacturing, public administration and food production … These sectors are critical for the UK’s national and economic resilience. Under the proposed regime manufacturers operating across the UK and the EU, when victim of a cybersecurity incident in the UK, will be mandated to report”
this to EU authorities but not to the UK.
One of the submissions notes that the Bill is narrow in scope:
“large parts of the economy, including organisations that are economically significant due to their scale, interconnectedness or role in supply chains, will remain outside this regulatory perimeter. The Government’s approach to … these unregulated sectors relies primarily on voluntary governance mechanisms, including its new Cyber Governance Code of Practice”—
although we have seen that yet. The submission argues:
“Without stronger incentives, measurement and accountability, there is a risk that this … will not deliver consistent or meaningful improvements”.
It warns:
“This creates a disconnect between the regulated NIS economy and the wider, unregulated economy, despite risks flowing directly between them”.
We know the wide, deep and prolonged effect of cyber attacks on M&S, JLR and Synnovis, yet JLR and M&S will be out of the scope of the Bill, as the Commons Minister himself noted. Surely, we need to take a whole-of-economy approach. We should surely include the public sector, and economically significant sectors such as retail and manufacturing.
In evidence to our Select Committee, UK Defence First also argued that the potential loss of control of satellite communications is a “severe” national risk and that the Bill should
“explicitly treat space assets as critical national infrastructure”.
Could the Minister comment?
DSIT has estimated that significant cyber attacks on businesses cost the UK almost £15 billion in 2024. The National Cyber Security Centre reported that nationally significant cyber incidents had more than doubled in a year. As ISC2 says:
“It is no longer a question of if an organisation will be attacked, but when”.
ISACA, a global professional association focused on this area, emphasises:
“Digital service providers, particularly cloud infrastructure, also represent a growing concentration of systemic risk. The financial sector is increasingly reliant on a small number of cloud providers, creating potential single points of failure across critical services. For example, evidence presented to the Treasury Committee highlighted that 73% of UK cloud services are provided by just three providers”.
ISACA also warns:
“Cyber risk is inherently systemic, meaning disruption is rarely confined to a single organisation or sector, but is increasingly transmitted through supply chains, shared infrastructure and third-party dependencies”,
which the Minister made reference to. According to the cyber security breaches survey, only 7% of UK businesses have formally reviewed the potential cyber security risk presented by their wider supply chain.
In addition, it is reported that many SMEs may perceive that they are too small to be a target, yet government research has found that 50% of UK SMEs faced some kind of cyber breach or attack in 2025. It is also reported that, for small businesses, a cyber incident can be existential: roughly 60% of SMEs that fall victim to a cyber attack go out of business in six months. It is all very well, as the noble Earl just indicated, being outside regulation here if our SMEs simply go to the wall as a result of inadequate preparation and protection.
Evidence to our Select Committee suggests that skills shortages are a key challenge for companies, especially SMEs and those in the public sector. Is that why the Government have not included them here? That leaves our economy wide open; that is surely not the right answer. Cyber education, training, apprenticeships and investment in skills must accompany regulatory reforms, and the regulators themselves will need to be properly resourced so that they can deal with their new responsibilities. We know that public bodies have often found themselves dependent on ageing digital systems, with the risks from that.
We also need to recognise the need for the highest level of leadership in this area in companies and other organisations. It cannot simply be left to IT departments: cyber security must now be a major consideration at board level. We also need leadership from the Government, working with allies on intelligence sharing, common standards, co-ordinated responses to hostile activity, and co-operation on investigation. We know we face increasing attacks from rogue states: it is spoken of now as being low-level warfare, and we have seen the effect in many other countries as democracies are under attack.
In conclusion, although we welcome the Bill, we are seriously concerned about its limitations. A start would be to align with the EU, which already recognises that a whole-of-economy approach is the right one. I look forward to the Minister’s response.
Lord Birt (CB)
My Lords, the Government’s own cyber survey reports that 43% of UK businesses experienced a cyber attack last year, costing the UK economy an estimated £15 billion. Here are just a few examples of those many attacks: a deepfake video call cost Arup £20 million; Marks & Spencer was attacked in Easter last year, losing an estimated £300 million, with operations fully restored only three months later; and, most impactful of all so far, Jaguar Land Rover suffered an attack, had to halt production for around five weeks, was unable fully to restore its supply chains for four months and lost around £500 million. Moreover, the Government had to step in and guarantee a loan of £1.5 billion to stabilise JLR’s extensive supply chain. Yet our economy is barely touched by the Bill, as the noble Baroness, Lady Northover, just identified.
I think that a lot of people, untutored, have a mental model of a technology platform as something you might offload off the back of an HGV; in reality, any technology platform, even in a medium-sized business, can be a highly complex network composed of hundreds of providers, any component of which can present a vulnerability. Just two examples among very many are the widespread reliance by providers on free-to-use but vulnerable open-source software maintained by volunteers, and the external software providers bolted on to a technology platform offering a myriad of services —for example, payroll, finance, logistics, e-commerce or customer relationship management.
There is a possible vulnerability in every part of this complex network of providers, with many doors to pry open. Once one door is opened by a bad actor—a fraudster, a foreign power, a hacktivist or a ransom gang—there is the potential to explore and disable much or all of the system. Entry can be through a clever phishing email, perhaps AI-personalised with stolen data, or through application, network and infrastructure vendors failing to close down vulnerabilities immediately they are identified.
Here is a frightening example: a Chinese entity was able to penetrate a large number of services provided by Microsoft to the US Government. As a result, the mailboxes of the Secretary of Commerce and the US ambassador to China, among many, were read. In a coruscating report, the Cyber Safety Review Board, the US government agency that investigated the breach, concluded that
“Microsoft’s security culture was inadequate”
and that the incident resulted from
“the cascade of Microsoft’s avoidable errors”.
We need to act now, to protect our wider economy as well as our public sector institutions.
I am not a technologist, but for three decades I have had to deal constantly with digital technologies and technologists from a position of authority in many large organisations in the public and private sectors, at national, European and global level. I have discussed the Bill extensively with technology and cyber experts who I know and respect, and it has become perfectly clear to me that the Bill as constructed does not begin to match the threats that we in the UK face, which will only grow.
For instance, AI will increasingly empower malign reconnaissance, enabling attacks that probe, diagnose and bypass defences. At some point, quantum computing, with its awesome power, will fatally undermine our current approach to encryption. This is a highly demanding and ever-changing environment, and it is, frankly, preposterous to suppose that the 12 existing sector-specific regulators of our national infrastructure can acquire and constantly update the knowledge effectively to regulate cyber resilience.
I conclude emphatically that we need a single, focused, dedicated and expert regulator, which I suggest we call the office for cyber resilience—OCR—to span both the public and private sectors, including organisations and, vitally, those who supply them with the technologies they use. For clarity, the OCR should also regulate the national infrastructure providers.
First, I propose that the OCR should regulate platform and software providers to ensure that they sell and vouchsafe secure products up front and update them immediately when vulnerabilities become apparent. That does not happen at the moment. The Office for Product Safety and Standards does that in the UK for consumer goods and the Vehicle Certification Agency does it for cars. Why should there not be protection for our vital technology?
Secondly, companies and institutions of a significant size are currently required under statute to face an annual external audit, the purpose of which is to maintain high standards in financial reporting and corporate governance, under a code set by the FRC—Financial Reporting Council. We should extend the remit of that audit, under the auspices of the OCR, to report on the audited organisations’ and their suppliers’ management of cyber security and thus bring company boards clearly into play.
Thirdly and finally, we need to professionalise the skills of the cyber and IT community, which are highly variable. Every profession of which I am aware that can have a significantly adverse impact on individuals or society faces a hierarchy of qualification before a professional can operate at different levels—whether physician, lawyer, chartered accountant, architect or airline pilot.
How far across the economy would the OCR’s remit reach? It would extend precisely to the same extent as the obligation to have a statutory audit; that is, to companies with an annual turnover of about £15 million that have in excess of 50 employees. I have a perhaps surprising statistic for the noble Earl, Lord Effingham: that would mean only 2% of UK companies. But those companies represent around 70% to 80% of the UK economy.
To conclude, we simply must be bolder. We must take the opportunity that the Bill presents better to enable every kind of organisation in the UK to withstand the ever-growing and deeply disruptive threat of cyber attack.
Lord Arbuthnot of Edrom (Con)
My Lords, what a pleasure it is to follow such an interesting and constructive speech. I hope the noble Lord will take full part in Committee on the Bill. I declare my interest as chairman of the advisory panel of the technology company Thales UK. I thank the Minister for the briefing that she gave noble Lords a couple of months back, which was extremely helpful.
The best legislation has a permeating principle that helps to explain the purpose of the new law and inspire obedience to and observance of the new law. The Joint Committee on the National Security Strategy held an evidence session yesterday on deterrence in an age of Russian aggression, in which one of the witnesses told us that the key thing that should be included in the Bill is that it should hold vendors of software accountable for the reliability and security of their product. That follows on from what the noble Lord, Lord Birt, just said. That, after all, is what we do with cars. When Ciaran Martin was the head of the NCSC, that was one of his overall aims.
However, that is not what this Bill does—it does not have a permeating principle. It is a bit of a muddle. Winston Churchill might have said that this pudding has no theme. My noble friend Lord Effingham asked about strategy, and he was absolutely right to do so.
The Bill draws in some sectors but not others, without any clear explanation of the difference between those that it includes and those that it excludes. In another place, the shadow Secretary of State for Science, Innovation and Technology, Julia Lopez, said that she supported the Bill but feared it might not work in practice. I too support the Bill but fear it might not work in principle.
We live in an age when everything is connected to everything else. Drawing dividing lines between, for example, the private sector, some of which is included and some of which is excluded, and the public sector, which is excluded, is perilous and leads to incomprehension of the law.
That set of unclear distinctions also ignores the effect of cascade. During lockdown, a health crisis turned into an education crisis, with exam results becoming an unexpected casualty of Covid. When everything is dependent on computers, and the public sector is dependent on the private sector, and vice versa, it is unwise for new legislation to specify rigid demarcations.
Those taking part in this debate have received many useful briefing notes, from the Association of British Insurers, correctly drawing attention to the great value in behavioural terms of insurance, which can have a real impact on resilience of all types as well as cyber resilience; from the News Media Association, about the real danger posed by bots, which now form 50% of all internet traffic, which is accelerating fast; and from Zurich, correctly identifying the huge role played by SMEs in the cyber security sector yet worrying about the ability of SMEs to bear the demands of regulation, not least in reporting incidents within 72 hours; and many more.
I know that the Government are committed to reforming the Computer Misuse Act in the coming national security Bill, as the noble Lord, Lord Clement-Jones, has been demanding for many a year now. CyberUp’s long-running campaign on this is far too long-running. While I am talking about cyber security professionals—because that is the point of amending the Computer Misuse Act: to give them proper protection—I cite the very helpful briefing from ISC2. It says that the Bill will dramatically increase the demand for cyber security professionals even though there is currently a significant shortage of them.
As I understand it, the number of cyber security positions in government that are currently vacant stands at 50% of the total. That is horrifying. Some 58% of UK organisations have a critical or significant skills need and 87% of teams have experienced at least one consequence due to skills needs. The members of ISC2 have said that the biggest impediment to them complying with cyber legislation and regulation is a shortage of skills, so what does this legislation do to increase those skills? Could we look at defining the meaning of a “skilled person” in the Bill?
The shortage of such skills is likely to be exacerbated by there being 12 different regulators—here again I rather echo what the noble Lord, Lord Birt, said. There is going to be a risk of duplication of regulation, even potentially of contradictory regulation. What is an organisation meant to do if one regulator requires that it does one thing but another regulator requires that it does not? Will the Government ensure that regulators adopt common forms of evidence for demonstrating compliance and common cyber security standards? How does the legislation take into account the fact that many organisations will be subject to foreign legislation as well? I agree, as on many other things, with what the noble Baroness, Lady Northover, said about encouraging alignment with the European Union. How are we learning from overseas experience?
This is a well-meaning but muddled attempt to deal with an exceptionally fast-moving, difficult problem. Governments always find it hard to keep up with the pace of technology, so is it right that we should re-examine this Bill only every five years? The Secretary of State should have to report to Parliament earlier than every five years. I know I sound a bit miserable, but I support the Bill. I really do. It could be better, and we will have a lot of work to do in Committee.
Baroness Paul of Shepherd’s Bush (Lab)
My Lords, the Government’s whole-of-society approach to national security rightly recognises that resilience is not delivered by the state alone; it is delivered through partnership between government, regulators, industry, communities and, crucially, the private sector. Cyber resilience is no exception. It requires every bit of the infrastructure to play its part: those who defend networks, those who regulate standards and those who help organisations recover when incidents occur.
I welcome the Bill and I note the broad support it has received from across the resilience sector as a good start. The Bill makes important progress in strengthening incident reporting, modernising the NIS framework and placing greater obligations on essential service providers, digital services and critical suppliers. I particularly welcome the inclusion of managed service providers within the regulatory regime. As other noble Lords have mentioned, more and more organisations rely on MSPs to help them keep pace with the changing nature of the threat and the ever-expanding tools required to remain secure. Without them, many businesses and parts of our critical national infrastructure would struggle to access the expertise they need to keep themselves safe. At the same time, MSPs can present a potential vulnerability because of the privileged access that they often hold to clients’ infrastructure. The Bill is right to recognise this, and I am pleased to see them brought into scope.
In welcoming the Bill, I must also point to what I think is a significant omission, on which I will focus my remarks. There is no mention of the insurance sector, nor any real mention of the part that the private sector can play. I raise this not as a criticism, because there is ample opportunity to put this right and to enhance the Bill’s ambition. The Bill already expands incident reporting and increases the volume and quality of cyber incident data available to regulators and public authorities. That is an excellent step forward, but if the purpose of the Bill is to improve our understanding of cyber risk and strengthen resilience across the economy then it is worth asking whether we should enable structured, anonymised incident data to be shared with the insurance sector and others who can use it.
The purpose of this data is to provide a clear picture of the threat, so it is important that we share it as widely as possible with those who can help protect us. I ask the Minister to consider this. It would be an extension to the Bill, not a departure from it. It would build on the reporting architecture that the Bill already creates, and it would do so in a way that supports the Government’s whole-of-society approach to resilience. The principle is simple: better data enables better modelling; better modelling enables better pricing and strengthens resilience; and better pricing increases access to cyber insurance and strengthens resilience across the entire economy.
Cyber insurance is already an important part of keeping businesses safe. We know that it enables us to transfer financial risk so that it is shared between businesses in the private sector rather than being borne by the taxpayer. I am sure we all agree that cyber incidents and the cost of recovery should, in most cases, fall on the organisations affected.
As noble Lords know, insurance remains one of the most effective and economically efficient ways of achieving this, but it does not just pay out after an incident; it changes our behaviour before one. To secure affordable premiums, organisations are required to adopt practical cyber hygiene measures, such as multifactor authentication, timely patching, network segmentation and robust incident planning. These requirements are not set in stone but change as the threat involves. Beyond legislation which will mandate a change in behaviour, there are very few other ways to incentivise the scale and pace of the behavioural change required to improve our resilience than insurance. We have locks on our doors, safety features in our cars and sprinklers in our buildings because insurance encouraged and rewarded these measures. It has the potential to play the same role in cyber resilience.
It is worth noting that Cyber Essentials, which the Minister mentioned in her opening remarks, is believed to be held by just 1% of businesses. Although the growth rate is increasing, it would take decades to get to the point where Cyber Essentials is going to provide us with the level of resilience that we need, so we need to do something different and we need to incentivise things differently.
As we also know, cyber insurance helps mitigate the moral hazard where organisations underinvest in security because they assume government or someone else will bear the consequences. The risk to our economy makes this unsustainable. Independent analysis commissioned by the Department for Science, Innovation and Technology, which sponsors this Bill, shows that cyber attacks impose almost £15 billion of economic harm on the United Kingdom every year. That is equivalent to one month’s NHS expenditure, almost the entire annual policing budget, 30 new hospitals or more than three decades of universal breakfast clubs for every primary school child. It is enough to wipe out an entire year’s profit for vast numbers of British businesses.
Yet only a small proportion of that national cyber risk is insured. Based on the department’s modelling data, together with that of the Association of British Insurers and Lloyd’s of London, it is estimated that the UK cyber insurance market currently covers approximately £700 billion of annual losses. In other words, less than 5% of the economic harm caused by cyber incidents is insured. Therefore, more than £14 billion of losses fall directly on businesses, public services and, in some circumstances, the taxpayer. We all know that Marks & Spencer had cyber insurance and reportedly made a claim of around £100 million following its cyber incident last year, whereas Jaguar Land Rover did not have any cyber insurance and, in the end, the Government had to step in and provide a loan. As the frequency and severity of cyber events increases, it is in our interest to increase insurance take-up.
The Bill strengthens reporting obligations. Named suppliers will be required to report significant incidents within 24 hours and to report fully within 72 hours. The Bill expands the definition of a reportable incident to include pre-positioning attacks, significant near misses and incidents likely to have societal impacts even where disruption has not occurred. It must be permissible for regulators to share this information across public authorities and with insurance companies to create a more coherent national understanding of cyber risk. If we accept that it is possible to share in some circumstances, it must be possible for us to consider that it could be shared in others.
Lloyd’s of London, the ABI and brokers including Marsh, Aon and Willis Towers Watson have warned that scarcity of reliable data is one of the principal constraints on market and product development, so why would we not want to facilitate improvement in cover? Market analysis suggests that there is potential for the global cyber insurance market to expand annually by 25%. If the UK were to capture even a modest share of that growth, our domestic cyber insurance market could expand from its current value of around £700 million to well over £2 billion in a few years. This would lead to more highly skilled jobs in London and would maintain London’s position as the world’s leading centre for specialist insurance.
The Bill sets us in the right direction, but we have an opportunity to ensure that insurance is properly recognised as part of the resilience community. I believe that enabling structured, timely, anonymised data to be shared with insurers would be a modest extension to the Bill but would have the capacity to deliver enormous change to the cyber resilience of our country. I hope that the Government will consider this as the Bill progresses through the House.
Baroness Neville-Jones (Con)
My Lords, I support this Bill. I rather agree with those who have spoken previously that it is not particularly ambitious in its aims, but, if successful, it will be a largely useful piece of legislation. It is modest in its aims but liable to be of service for a period.
What it does not do is look forward very much. The threat landscape is deteriorating. I will not describe it, as that has been done well by others, but the criminals, and indeed other state operators, are leaders in technology adoption. We can be sure that AI is going to be used against us, and so we must be in a position to exploit it ourselves.
One of the conclusions that I draw from the discussion so far is that we will somehow have to learn to both legislate and make policy faster than we are doing at the moment. This Bill has taken a long time to get through the Commons. I hope that it will not take so long to get through this House. I suspect that we are already behind the curve again.
We have to learn to be willing to experiment and to change course if it is not working. We can take many views on the subject of whether we should have sectoral regulation or a single regulator—there are arguments in both directions. At the moment, I am, on the whole, willing to try sectoral regulation, which brings with it potentially more flexibility, as well as more complexity. If it does not work, we will need to be prepared to say that it is not working and that we will do something different. Changes of gear, and willingness to change gear, are things that we will have to come to terms with. When it is the case that we have not got it quite right, we will need to be prepared to say so.
The thrust of the Bill is certainly in the right direction. I will focus on some of the more detailed points in the drafting where I think we need to try to accomplish some improvements. There is quite a lot of looseness in the drafting, which needs tightening up. For example, terms such as “managed service provider” and “critical supplier”, as well as the wide definition of the notion of “incident”, all need greater precision. We need to avoid situations where words such as “incident” become a way in which companies that have no particular involvement get tangled up in regulation. If part of a company provides managed services, we need to know, and the company needs to know, whether the whole company is caught by the Bill or whether it is simply that part that provides managed services.
There is plenty of implementation detail on which we will need to have a closer fix. I am willing to give the Government the power to fill in the detail and update the law through secondary legislation, as it seems to me that we cannot always have primary legislation doing everything. However, we will need a duty to consult written into the Bill for it to be a safe proposition. One thing I would like to ask the Minister is about the timetable for secondary legislation. Will the Government be willing to consult when it comes to putting that through? That will be a very substantial part of the Bill.
I want to make a couple of comments about the effects of the scope of the Bill. First of all, with the exception of service providers, who are classed as “critical suppliers”, and data centres, the Bill, as other people have remarked, is exclusively concerned with the public sector. As the Government Minister and indeed others have pointed out, some of the biggest losses have occurred in the private sector. I do not need to describe these, as they have been described already.
The Government may argue that they properly seek not to regulate the private sector. I certainly have considerable sympathy with that, but it is not satisfactory from the point of view of the taxpayer that the Government had to bail out with public finance Jaguar Land Rover. Under current conditions, I do not think that that breach, which was expensive, is likely to be the last one with sizeable financial effect.
The Government have recognised the problem and are encouraging private sector companies to make a pledge to improve the management of cyber security at board level. I am all in favour of that: improve reporting in the corporate code and increase activity by the audit committee, whose members, if properly equipped with cyber expertise, will make a valuable contribution. That is part of the way that we must move forward. Having said all that, private sector security self-help, while essential, is not sufficient. So what should we do?
The Government correctly tell us that their first duty is the defence and security of the nation. Cyber security strategy—which I know something about, having been involved in it—was founded on the proposition that the protection of the economy involved active partnership between public and private sectors. The NCSC does a vital job in increasing understanding about the threat and giving advice and guidance on countering it, but it could do an even more important and larger job. It was intended at the outset to be more public-facing than is currently the case. It has, to some extent, retreated from its previous public start. I would like to see the NCSC re-emerge from the shadows with more threat analysis, advice and guidance, and its funding increased to do this.
This would be particularly helpful to SMEs. We have all been worried about their access to expertise and considered that the cost to them of security, which is not insignificant, should be somehow alleviated. They are valuable to us. Small companies provide very important parts of larger systems. If the NCSC were to be a much more active security partner to the corporate world, there would be a strong case for financial support from the private sector to it, to make this much more of a joint enterprise.
I urge the Government to put their intelligence capabilities to greater effect in supporting the private sector to raise its level of security. I do not think this is beyond us. We ought to try to do something where there is much closer co-operation between public and private sectors. The banking world, though different, gives us some pointers on the way in which that could be done.
Secondly, within the public sector, the scope of the Bill is puzzlingly selective, as other speakers have touched on. There is palpable anxiety among the general public about the security of One Login and accessing government services safely. This is a moment when the Government could increase confidence. However, not all government services are covered. To take an example, DWP has in its possession detailed personal—not to say intimate—information about its clients and beneficiaries. Surely it should be a candidate for coverage, but it is not. What are the criteria that govern whether a public sector service is covered or not? On the face of it, I do not think selectivity looks wise. The Government have chosen—
Baroness in Waiting/Government Whip (Baroness Ramsey of Wall Heath) (Lab)
I gently remind the noble Baroness that there is an eight minute advisory Back-Bench speaking time.
Baroness Neville-Jones (Con)
I will conclude. The Bill recognises the need for regulatory co-operation, and it is certainly going to be very important if it is made to work. I also agree with those who think that we should align with things such as NIS2 to reduce the potential conflict between us and other international regulators.
My last thought is that we need to ensure that another definitional issue in the Bill, the level of security
“appropriate to the risk posed”,
is pinned down. There is a great deal in the Bill that we will want to talk about in Committee so that those implicated know exactly where their limits lie.
Baroness Alexander of Cleveden (Lab)
My Lords, this is proving a fascinating and valuable debate, recognising the Bill’s many strengths, what could be tweaked, and what perhaps is missing as we look ahead. To begin with the strengths, we heard from the noble Earl, Lord Effingham, that the Bill builds on the work of the previous Government and commands cross-party support. We have just heard from the noble Baroness, Lady Neville-Jones, that national security is the first obligation of government. This is unarguably an important step in protecting the nation against cyber criminals, hacktivists and hostile states. It will quite simply make the UK a better place to live, work and do business in.
We have heard already from the noble Lord, Lord Birt, about the economic impact of cyber attacks and from my noble friend the Minister about the 11,000 NHS appointments that are lost to cyber attacks. It therefore seems very timely that we have this Bill, which will cover more essential services, improve regulatory effectiveness, and speed up responses to cyber threats. It is clearly desirable that we have a stronger board level responsibility around cyber. It must be right that data centres are now included in the Bill, helping maintain the UK’s position as a global destination for secure data hosting and for innovation. The focus on high-impact firms means that small companies will not be unduly burdened.
As my noble friend the Minister made clear, this is part of a wider national security effort that includes a cyber action plan for the public sector, a forthcoming cyber action plan for business, the Cyber Essentials certification scheme, and free cyber security support from the NCSC. All these measures will help contribute to our cyber security. The 24-hour incident reporting system will mean that regulated entities have to notify customers impacted by incidents. The tougher penalties for breaches will modernise enforcement and, I hope, improve the uptake of cyber insurance in the way that my noble friend Lady Paul has indicated is so vital. We have to hope that, together, this will mean that cutting corners will no longer be cheaper than doing the right thing. Nevertheless, given the speed at which new cyber threats are emerging, the Bill tries to strike a reasonable balance between maintaining parliamentary oversight and ensuring that the Government can act quickly, as required.
I turn to the question of tweaks. Many of them have been touched on so I will not dwell further on them. We heard from the noble Lord, Lord Arbuthnot, about the importance of the workforce and the increasing demand for cyber security skills. Will the proposed codes of practice include a framework for workforce development and training?
The second tweak, as many noble Lords have touched on, is to the Bill’s scope. I have some sympathy with the noble Baroness, Lady Northover, about the case for closer alignment with EU regulations when we have British companies operating and complying with EU legislation in the areas that are covered. I also think that a broader scope would drive the sort of behavioural change that my noble friend Lady Paul cited. I note that the Minister already said that secondary legislation is available to expand the scope. I look forward to her comments on why we do not have a broader scope now, given the groundswell already in this debate, perhaps to include public administration, in particular local government, given the scale and sensitivity of data and the essential nature of public services.
The third tweak is something else that has been widely noted already: the risks associated with having 12 regulators. I appreciate that the Government’s intent is minimising regulatory upheaval. There is a balance to be struck. The noble Lord, Lord Birt, approached the issue of risk from the desire and need to ensure expertise. I will look at it through the lens of the risk of duplication. At lunchtime today, I spoke at a NED event hosted by a US law firm that counts among its clients a major cloud provider, insurance companies, professional services firms and a board effectiveness practice that works with both public and private sector organisations. The strong consensus in the room was that a common cyber security standard across all regulators, upon which appropriate sector-specific requirements could be layered, merits consideration. This approach is in the spirit of the Government’s amendments, tabled in the other place, to streamline reporting and avoid unnecessary complexity. I hope that issue is given further consideration.
In my few remaining minutes, I will touch on what is not in the Bill. As others have noted, technology is advancing faster than government frameworks can keep pace with it. The Bill was published last year, just as it became clear that AI was tipping the advantage to attackers. Attackers need to succeed only once, while defenders potentially need to patch millions of users. There is currently no technology to automate patching at the pace required. The Bill needs to say more on the role of integrating AI tools into cyber defences. The Bill arguably has an AI-shaped hole in it, although I am encouraged that the incoming Prime Minister has signalled a fresh look at AI regulation. Even Sam Altman, faced with a capricious President, has come round, writing in the FT that
“citizens and their elected representatives must make the rules”.
We have also seen the Five Eyes intelligence partnership warning in a very rare joint communiqué last month that the West’s adversaries were within months of developing cyber attacks that could overwhelm the defences of Governments and companies and noting that frontier AI models will fundamentally transform cyber capabilities. All this is now with us, so raising our defensive capability in the face of this rising AI functionality will be essential. Our spy chiefs are asking western companies to use AI models to strengthen their defences.
I fully appreciate that the Government are completely across this threat landscape. The question is: how do we collectively legislate or regulate in such a threat landscape? Some suggestions that we can consider in Committee are, first, that advanced AI providers could perhaps be designated as covered entities under the Bill. Secondly, since the impact of AI in the cyber field is increasingly systemic rather than sector specific, perhaps we need common AI cyber security guidance supporting all regulators in this fast-moving landscape as they then layer on the needs of their sector. Thirdly, perhaps there should be an AI field in the mandatory incident reporting regime. Finally, we should perhaps think about an AI oversight framework giving the NCSC more teeth and the AISI a more co-ordinating role.
In conclusion, as widely recognised, the Bill will support our economy and our people and make the country safer. It is part of a package. It is a crucial building block rather than the final destination. I strongly commend it to the Chamber.
Baroness Kidron (CB)
My Lords, there is a risk of agreement breaking out at this juncture. I too very much welcome the cyber security Bill and agree with others who have raised the omissions. There is nothing for the private sector and nothing on local authorities. It focuses on the size of service provider rather than risk and, in doing so, fails to learn from the battles during the Online Safety Act which established beyond doubt that the size of the company does not equate to the risk it poses in any system. There is also no mandate for executive responsibilities, as in NIS2 in Europe. All these things feel like critical omissions but, above all, there is nothing on AI, as we have just heard. That is where I will focus my remarks.
In February, Darktrace, a cyber security firm based in Cambridge, surveyed cyber security professionals; 73% of them reported that AI-powered threats are already significantly impacting their organisations. Nine out of 10 said they needed major upgrades to their defences. Only weeks ago, the US Government instructed Anthropic to withdraw two frontier models, going from zero regulation of AI to a 100% ban within 90 minutes. This was on the understanding that it posed a national security threat, with capabilities that experts anticipate will be mirrored by other frontier models, including Chinese ones, within months. It seems extraordinarily ill advised, therefore, that AI is not front and centre of the Bill. Clearly, this is a decision rather than an omission so, when she responds, can the Minister explain why, given the scale of the cyber security threat presented by AI, the Government have chosen not to identify it and tackle it explicitly in the Bill?
The absence of AI from the Bill also means the absence of the AI Security Institute. AISI is recognised globally as world leading, yet since this Government came to power its name has been changed from “Safety” to “Security” institute. We have heard repeatedly from insiders that they have been instructed not to upset the Americans. Most recently, a decision was made to fold its societal resilience team—which dealt with things including psychological harms, child safety, environmental harms, synthetic media abuse and faults with using AI for hiring, police and credit scoring—in favour of the existential threat agenda, which frontier companies prefer to discuss because industry prefers to talk about the harms of the future rather than the ones that are here right now.
I sit on the Joint Committee on the National Security Strategy and simply cannot overstate the repeated cries from security experts for society-wide resilience and a broader definition of security, including information integrity and digital sovereignty. They understand that threats to security are structural and multifaceted and need constant oversight. Can the Minister say why we are not using this Bill to strengthen and empower AISI as an independent statutory body to ensure the safety and security of the nation and to provide a constant source of wisdom and expertise over AI across all domains, with a statutory remit that allows it to investigate the full spectrum of unsafe security risks and mandatory rules for AI safety training and reporting of security incidents directly to it?
It is easy to dismiss these issues as outside the cyber security remit, but that is not the case. I was at a conference about agentic AI last week where medical researchers showed that, in 51% of cases where a person should go to hospital, AI told them not to. This has profound consequences for the health of a nation. More chilling still, the same experts pointed out that, as AI becomes integrated with health records and prescribing systems, a malign actor or hostile state could in one fell swoop manipulate the online prescriptions of an entire nation.
Similarly, in my conversations with specialist police they have said that they are extremely worried about the way digital services are fuelling an ever-growing pipeline of extremists. Recent research by the Center for Countering Digital Hate shows that eight out of 10 chatbots are willing to plan a school shooting or an attack on a synagogue. In 2025, for the first time, automated traffic overtook human traffic online, much of it concealing its identity, leaving operators unable to distinguish benign automation from hostile traffic. This enables the mass harvesting of data used to facilitate a future cyber attack at scale. As non-human traffic climbs, our exposure to cyber attacks grows with it.
At best, the Bill is unclear how these sorts of harms impact our security and adds to the mishmash of provisions and the powers taken by the Secretary of State in several previous Bills. At worst, these issues are not covered at all. The Minister in the other place said that the Bill is “technology agnostic”. Can the Minister explain what that means in practice? AI is not simply another risk to be regulated; it changes the nature, speed and scale of cyber attacks themselves.
Two weeks ago, I and several other noble Lords received a briefing from the Institute for AI Policy and Strategy and the Centre for Long-Term Resilience. They are at the forefront of tracing emerging technologies and threats and have set out a clear strategy built around four ideas: delay, defend, detect and disrupt. They have practical proposals under each heading to improve the Bill, giving us greater oversight and transparency and narrowing and neutralising the spectrum of risk. But as it stands, the Secretary of State, as she has done on so many occasions, has taken powers herself rather than offering Parliament a coherent plan of action.
In short, the greatest omission from the Bill is that it focuses primarily on what a limited set of companies and service providers should do and too little on the resilience of the wider digital system. Over the last two years, we have seen the way in which dependencies on US tech have muted our ability to protect children and creatives and made our NHS, government data and our economy vulnerable. A truly secure cyber policy is a sovereign one which gives the Government control over key chokeholds in the system and oversight over critical infrastructure while encouraging a far greater range of providers. It is one that retains valuable data in the UK, prioritises UK tech companies and deliberately works alongside other middle powers by building relationships in which we are a rule-maker rather than a rule-taker. That, to my mind, is the real opportunity presented by this Bill. It is an opportunity yet to be realised.
Baroness Bennett of Manor Castle (GP)
My Lords, it is a great pleasure to follow the noble Baroness, Lady Kidron. I will come back to her points about digital sovereignty. I also thank the Minister for introducing this Bill.
I have been reflecting back. I am approaching my eighth year in your Lordships’ House, and we have come a long way. About seven years ago, I was standing behind the Bar and a Member of your Lordships’ House who shall remain nameless sidled up to me and said: “They’re talking about catfishing. I gather that doesn’t mean being beside a river with a rod”. I said, “No, you’re right. Well done, well worked out”. We have come a long way. But, of course, the world has changed an enormous amount in those eight years and the message from all corners of your Lordships’ House today is that the Government are not keeping up. Your Lordships’ House will have to do its best to keep up for them and push the Government in those ways.
In her introduction, the Minister talked about data centres being a key part of the modern world. Their security is very reliant on water and energy supplies, just as all our security is being impacted by their consumption of those supplies. Something we have not really talked about yet, but need to think about a lot, is that we tend to think about these information systems and networks as being up in the cloud, but of course they are very much physically down to earth and dependent on all our natural physical systems. That cannot be forgotten.
I will focus mostly on two areas of concern that are missing or inadequately covered in this Bill in terms of our network and information systems. In Trafalgar Square at this moment, there is literally a Trojan horse—a reminder, in mythological form, to beware of Greeks bearing gifts, at least if they have just been besieging your city. I put it to the Government that this is a parallel that they should be considering: beware of Silicon Valley tech bros bearing shiny undeliverable promises, with large lobbying budgets and frighteningly undemocratic values, and that bear allegiance to a state with doubtful levels of democracy and consistency. I also want to respond directly to the noble Lord, Lord Birt, who spoke about the risks of volunteer-run, open-source software. Of course, it is very possible to question which is the greater risk: a Silicon Valley tech bro or a whole lot of people who are trying to work for the common good. We might debate that as we go along.
As the noble Baroness, Lady Kidron, identified, we are talking about digital sovereignty. I draw the attention of your Lordships’ House to an amendment tabled by my honourable friend Siân Berry in the other place, which was not debated there, calling for the Government to have a digital sovereignty strategy. It proposed that the Government should have and maintain such a strategy and
“set out the Government’s assessment of the risks to … network and information systems arising from … dependence on hardware, software, or digital services that may be subject to foreign interference”
of the kind that the noble Baroness, Lady Kidron, referred to, in terms of AI systems;
“extra-territorial legal requirements that may be imposed on non-domiciled suppliers;”
and
“vulnerabilities, undue control, or supply-chain dependency on foreign states or entities”.
I am sure everyone in your Lordships’ House knows what I am talking about, but I will pick one example as a case study: the company whose place in our society, and the values of its founders, owners and leaders, are a great cause for concern in Parliament and with the public. I am talking, of course, about Palantir. Last month, the Science, Innovation and Technology Committee warned that
“it’s not the only company capable of providing the ‘middleware’ required by public bodies”.
The committee also identified Microsoft and Amazon Web Services. Let us focus on this: you do not even need the fingers of one hand to count the absolutely central suppliers here. The committee said such dependencies were putting us
“‘at the mercy’ of foreign actors”,
and it very explicitly called for the Government to exercise the 2027 break clause in the NHS Federated Data Platform contract—ideally to develop an in-house replacement. That is one sovereign issue.
A second sovereign issue faces towards a more obvious international danger that the Government will not, I hope, deny. As debated in the other place, this is the need for critical safeguard in this field for an anti-transnational repression amendment. I happen to know that the noble Lord, Lord Alton of Liverpool, who cannot be with us today unfortunately, intends to table an amendment as we progress this legislation. At the moment, this Bill creates a dangerous loophole. It permits the sharing of highly sensitive network and information systems data with overseas authorities, without checking whether those authorities operate within a system that guarantees legal standards and human rights. There needs to be a rule that says, “Let’s check and think before we share”.
It is important to say that this would not be an actor-specific measure; it would be a universal principle-based safeguard that would apply to any regime, anywhere in the world, that rejects the rule of law. It would require the Secretary of State to actively consult subject matter experts and civil society groups to identify compromised jurisdictions. We have to be realistic about the state of the world now. Authoritarian states have a long and troubling track record of using international structures, such as Interpol notices for example, to mask political persecution under the guise of criminal justice.
I should declare at this point that, until recently, I was co-chair of the All-Party Parliamentary Group on Hong Kong, and I will focus briefly on the issue of China. UN special rapporteurs have pointed out the issues there. We cannot assume that so-called safe third countries will protect dissidents. Countries such as Spain have authorised extraditions to China, Cyprus has accepted individual “assurances”, and countries such as Hungary and Serbia are deepening judicial co-operation with Beijing. The UK has suspended its formal treaty with Hong Kong, but recent proposed changes to the Extradition Act 2003 open the door to case-by-case ad hoc arrangements. NIS data includes IP addresses, digital fingerprints and user-level logs, so the concern is not just about extradition but that this would allow authoritarian states to identify dissidents in the UK. We know that transnational repression against dissidents has been a great and growing to diaspora communities and human rights defenders.
This Bill needs a lot of work, as many people have said. There is really foundational work here that needs to be done.
Lord Forbes of Newcastle (Lab)
My Lords, the Bill sits squarely within the wider national security and preparedness agenda to which this House has repeatedly returned in recent months since the publication of the strategic defence review. We have spoken often about the interlocking nature of modern threats: geopolitical instability, climate shocks, pressure on critical infra- structure and the growing complexity of our digital systems. The Bill is therefore not a narrow technical measure; it is a national security Bill, and it deserves to be treated as such.
Every essential service in the United Kingdom, whether that be our energy grids, water systems, transport networks, hospitals or financial services, now depends on digital infrastructure. The boundary between physical and digital security has dissolved. A cyber attack on a hospital is not an IT problem; it is a threat to life. A breach in a water company’s control systems is not a data incident; it is a public health emergency. A compromise in a major data centre or managed service provider can cascade and cause chaos across the economy in minutes.
In recent years, we have seen how ransomware attacks have disrupted patient care or student learning, how supply-chain vulnerabilities have exposed critical national infrastructure, and how hostile actors—some criminal, some state-linked—have sought to test the resilience of our systems to destruction. The economic costs run into billions. The strategic cost is greater still: weakened confidence, reduced competitiveness and a nation continually forced into reactive crisis management rather than forward-looking preparedness. Resilience is not a cost; it is a foundation stone of our national strength. And the Bill is a necessary step in strengthening that foundation.
The existing Network and Information Systems Regulations, introduced in 2018, were an important milestone, but the digital ecosystem has changed beyond recognition in the years since. Cloud computing, large-scale data centres, outsourced managed services and complex supply chains now underpin almost every aspect of our national life. The regulatory perimeters and safeguards put in place almost a decade ago have not kept pace with the reality of modern risks.
The Bill addresses that gap. It expands the scope of regulation to include data centres, managed service providers and critical suppliers. Crucially, it recognises that vulnerabilities often sit not in the front-line operators but in the third-party services on which they depend. It strengthens incident reporting by ensuring that regulators receive timely, accurate information and that customers are informed when their services or data may be affected. It introduces statutory codes of practice, giving clarity to industry and consistency to regulators, and provides modern enforcement and cost-recovery powers, enabling regulators to act decisively when standards are not met.
Crucially, the Bill requires the Secretary of State to publish a statement of strategic priorities for cyber resilience. This is a significant and very welcome development. It aligns regulators, industry and public services around a shared national mission. It ensures that our approach to cyber resilience is not fragmented or reactive but coherent, strategic, and future-focused.
The Bill is not simply about technology; it is about people. Cyber incidents disrupt lives through cancelled hospital appointments, delayed trains, compromised personal data, businesses being unable to trade and local authorities unable to deliver essential services. The public rightly expect that the systems they rely on every day are secure. The Bill helps us to continue to meet those expectations. It also fits squarely within the broader preparedness agenda that many of us in your Lordships’ House have championed since the gracious Speech. We have argued consistently for a whole-system approach to resilience: one recognising that national security considerations are not confined to the worlds of defence or intelligence, but include the stability of our infrastructure, the integrity of our supply chains and the confidence of our citizens. Cyber resilience is now as fundamental as physical resilience. The two cannot be separated.
We have also emphasised the importance of place-based resilience. Local authorities, NHS trusts, utility companies and regional industries all depend on secure digital systems. A cyber incident in one part of the country can have national consequences. Strengthening digital resilience strengthens local resilience, and vice versa.
We also continue to make the economic case. Secure systems underpin investment, innovation and job creation. They are essential to the competitiveness of our industries and the stability of our financial markets. In a world where digital infrastructure is as critical as roads or railways, cyber resilience is now an economic imperative. Cyber resilience is, and must be, a shared responsibility. Government, regulators, industry, public services and communities all have a role to play. The Bill strengthens the framework within which that shared responsibility can be exercised, so it is timely and necessary, but it is not sufficient.
Legislation alone cannot deliver the resilient digital nation we need to become. We must understand the current limitations of our sovereign digital capabilities and take urgent steps to address this major vulnerability. We must invest in skills, innovation and the capacity of regulators. We must support industry to meet higher standards, and foster a culture of preparedness: one that anticipates risk rather than waiting for crisis.
I end with a brief reference to the motto of my home city of Newcastle upon Tyne. I am not a Latin speaker, so I apologise if my pronunciation offends any of your Lordships who are. “Fortiter defendit triumphans”—triumphing by brave defence—emblazoned across our city’s crest, celebrates the victories it won in the 1600s against marauding invaders. It symbolises the city’s ability to withstand such assaults through its collective spirit of preparedness and fortitude. The lesson I believe we can draw from the history of Newcastle for this modern age is that by strengthening the digital sinews that hold our country together, we strengthen the country itself. In the very act of doing so, we cast a defensive shadow against those who seek to do us harm and, ultimately, we reduce the risk of attack in the first place. The Bill is an important step in that direction, and I am pleased to support it today in your Lordships’ House.
Baroness Ludford (LD)
My Lords, I see that I have gone down on the speakers’ list as “B Ludford—first half”, presumably in the expectation that I will make the second half of my speech later. I am only kidding.
I knew that I would learn a lot in this debate and I have not been disappointed. I am no expert on cyber issues and I am speaking only because, first, it is an interesting as well as vital topic; secondly, because my noble friend Lord Clement-Jones is very persuasive; and, thirdly, because the Bill has prompted me to revisit my memory of being the victim of a cyber attack 13 years ago.
As an MEP I was involved in drafting the general data protection regulation—GDPR. I see the noble Lord, Lord Moraes, nodding in collective memory. I had sought to take a balanced approach, safeguarding personal data while not totally hampering digital services by overloading them with red tape. This middle way did not please a group of extremist hacktivists, who labelled me an agent of big tech and launched a denial of service attack against my MEP website. It was successfully defended by the small firm which hosted my website—and those of some Lib Dem MPs, including a coalition Minister or two—and it kept all the logs for me, as I wanted to notify the police. I could not find anyone in the Met to speak to so, since I was in touch with Europol and its British director at the time, his chief of staff kindly spoke to old Met colleagues and got an inspector to ring me. This chap was not only uninterested but cross that I had got rank pulled on him, and he did not deign to pursue any inquiry.
I relate that anecdote to illustrate, first, that cyber resilience is a whole-of-society concern which needs to bring in all of us non-experts but, secondly, that the exclusion from the Bill of public sector services is a worrying hole. Politicians and political parties as well as the police, local authorities and others are rather key players in the cyber security ecosphere. I hope that we will explore at further stages the Government’s rationale for exclusions.
At Second Reading in the other place, the Minister for Digital Government and Data, Ian Murray, agreed that cyber security
“is very much an economic growth issue … as we can see from the impact it has on our economy”.—[Official Report, Commons, 6/1/26; col. 171.]
Both Mr Murray and his DSIT colleague Kanishka Narayan cited the £15 billion a year cost of cyber attacks to UK businesses. But in response to calls to include sectors such as retail and manufacturing, as well as small and medium-sized companies, Minister Narayan claimed:
“Introducing blanket coverage for whole new sectors would create extensive regulatory burdens for more of our economy, stifling economic growth”.—[Official Report, Commons, 6/1/26; col. 226.]
So, on the one hand, the Government acknowledge the devasting cost to the economy of cyber security breaches of both public and private operators but, on the other hand, say that including them in the Bill would damage the economy. There is absolutely no logic to this.
The sorely needed intent to boost the pipeline of professionals is of course welcome. But another thing the Government could do on training is to protect the practice of ethical hacking, as part of the testing of networks, so that this workforce is as prepared as it possibly can be to combat weaknesses in cyber protection. Is this going to happen via reform and updating of the Computer Misuse Act 1990?
The effort needs to encompass not only professionals but all of us non-techies, even oldies such as me, given that the most common password in this country is apparently “password”. Much lip service is paid to addressing digital exclusion but there are huge numbers of people—a lot, but not all, of them old—who have not received any training and are still left out. How do the Government plan to extend whole-of-society awareness of cyber safety to everyone living in this country and not regard it just as a limited legislative exercise? While doing that, the Government could surely not avoid the issue of cyber-enabled fraud, a multi-billion-pound epidemic in which criminals often compromise individual customers as a route into wider systems. I do not think that is covered at all in the Bill.
The Government’s response to demands for the Bill to place responsibilities on boards and senior executives has been as feeble as their muddle on the economic impact. Minister Narayan told the other place that last year the Government wrote to chief executives “requesting”—requesting—
“that they make cyber-security a board-level responsibility”.—[Official Report, Commons, 6/1/26; col. 228.]
That in my opinion is pathetic. With the consequences of neglect so clear, a request is simply not good enough. The Government should make cyber security a legal requirement on bosses, which would boost accountability. Alongside that, they could slim the Bill’s administrative load by clarifying responsibilities, definitions and thresholds, having a single unified reporting portal rather than 12 regulators, avoiding overreporting, which would simply make the wood invisible for the trees, and including a duty, not just an option, to consult on secondary legislation—among many other streamlining measures.
Leaving the strategic priorities statement to the Government to draw up is a huge chunk of delegation. This Bill is really a bit of a mess: a combination of lots of executive power and lots of amending of the 2018 NIS regulations. It might have been better to write a whole, clean, comprehensive new Bill.
We can no longer channel EU law into our jurisdiction because the European Communities Act was abolished, but, in an era of alignment—indeed, dynamic alignment —the disparities between the Government’s choices in the Bill and the EU’s proposed NIS 3 directive are puzzling, as my noble friend Lady Northover and others pointed out. Both to lighten the regulatory load on UK companies working across Europe and to facilitate co-operation with the EU, it would make sense to have greater similarity between this Bill and the EU’s imminent new directive.
The Bill is much more limited than the draft directive in its sectoral coverage and regulatory design: for instance, keeping different categories of regulated entities when the EU is bringing them all together, and then distinguishing purely between “essential” and “important”. I am all for regulation being proportionate and flexible when that works—I and some other British MEPs sought with some success to bring that into the GDPR—but can the Minister be explicit about why the Government have diverged rather decisively from the EU model, and indeed left so much detail to executive discretion?
When it comes to the desired digital sovereignty, to avoid in future the servitude to US tech and the US Government that the Mythos episode demonstrated, would it not make more sense to work more closely with the EU so that British companies can help contribute to and benefit from a European market in digital commercial opportunities?
I look forward to working with colleagues on these Benches and across the House to improve this rather unambitious Bill.
Lord Vaizey of Didcot (Con)
My Lords, it is a pleasure to take part in this debate at Second Reading. I am taking part not because I was once hacked but because I was very briefly the Cyber Security Minister—which is almost as surprising as learning that I was once the Minister of Fashion.
Several themes have emerged during this very interesting debate and I always find it interesting to debate a Bill on technology, because the process of legislation is so ponderous and takes so long while digital technology moves so fast. I think there is a recurring theme, of course, that everything is digital. The other thing I always find odd when we debate legislation such as this is how we seem to continue to work in silos. AI has been mentioned so many times and it so important, but I recognise the need for legislation to provide the Government with a framework, just as the Online Safety Act has provided the Government with a framework on which we can move forward on online safety. I am less concerned about executive action and endless consultation; I want the Government to have the powers to move quickly in this important area.
As an opening remark, I will say something perhaps counterintuitive, which is that cyber security as well as being a threat is also a great opportunity. It is very important for us not to lose sight of the fact that the UK is one of the leading countries in the world for cyber security expertise. We have a cluster of great companies built around GCHQ. We must not lose sight as we debate these important issues of the fact that we have world-leading expertise that can contribute to the growth in our economy. When we talk about the defence investment plan, for example, it is important to talk about the huge opportunities we have to create great defence tech companies. Nor should we lose sight of the opportunity to create great British cyber security companies, which goes to the whole debate about potential sovereignty and giving us our own capability.
Let me begin by echoing a number of speeches about how important it is to work in lockstep with our EU partners. It is a piece of irony that this legislation emerges in effect from a European directive that we were beginning to debate when I was the Cyber Security Minister. In fact, the legislation is necessary because we can no longer transpose European legislation directly into British legislation. The noble Baroness, Lady Ludford, mentioned the GDPR, and it is a fact that Brussels can often take the lead in regulation such as this, and that big multinational companies tend to look at the biggest regulatory space in order to adhere to it. So it is important that we are mindful of how Brussels plans to proceed in this area, even if we find areas where we can be more flexible.
People have talked about our bad record in the UK on cyber security on account of cyber security attacks. I suspect that that is because we remain, I think, the most digital nation in the EU, and the English language as well provides us, weirdly, with some kind of vulnerability. But we are at the forefront of cyber security attacks, and it is important that we have the legislation and the bodies capable of responding to them.
Several themes have emerged. When I was the Cyber Security Minister, we began preparations for the National Cyber Security Centre: I thought that was incredibly important. I used to have a mantra that business in particular needed one front door that it could walk through to get the advice and expertise it needed to draw on to protect itself. We have talked constantly in this debate about 12 regulators, and I echo the calls to provide a uniform platform that can read across all the regulators, and they can add on top of that any sector- specific needs they meet.
I also recognise the calls from many noble Lords to say that this is perhaps an artificially constrained Bill, focusing on only a few vital sectors that are important to protect, instead of, as it were, seeing the whole picture and understanding, as many noble Lords have said, that cyber security pervades everywhere. There are so many ways in which we should look to protect ourselves in this age, one of which, of course, is in not losing sight of the hardware. The Minister spoke about software as a service. It is very important to remember that many of our public service providers, for example, still rely on ageing infrastructure, which provides huge vulnerabilities to cyber security attacks. I wonder whether the Government have a strategy to update much of the hardware that is still being used.
I was also interested in the remarks made about how vendors of software should be accountable. That is a very important avenue to explore: perhaps we could introduce kitemarks and audits of software providers to ensure that they are providing cyber-secure software that is as robust as it can be—again, as the noble Baroness said, we can count on the fingers of one hand the main providers of the software that is used in a vast number of businesses—and that they also work with us, as it were, to be on the front line.
It is interesting that this issue has become one of sovereignty. I am fascinated by the debate on the use of Palantir, for example. Personally, I have no problem working with Palantir. I think it provides a vital service, and I hope that the Government will be cautious in listening to the siren calls of people who say “Don’t work with these companies” simply because they disagree with the slightly bizarre views of some of their chief executives. Nevertheless, it perhaps calls for the Government to have a consistent story on this.
One thought that occurred to me during this debate was what has happened to the debate about encryption? This is a dog that no longer seems to be barking. In the last few years, we have had a vigorous debate on potential backdoors to encryption and security services being given, as it were, cyber keys to access encrypted services such as WhatsApp and Signal, and we saw a big pushback from the tech industry on how that would create big cyber vulnerabilities. I wonder whether the Government have come to a settled view on that.
Returning to the theme of the opportunities for the economy, the need to invest in cyber skills in our workforce is absolutely vital. We need to create a cyber workforce and a cyber defence force that work to protect the country, as well as giving companies the kind of skills base they need to make themselves secure. I echo the call from the noble Baroness, Lady Ludford, about boards. I was astonished to read in the House of Lords Library briefing that the number of board members with a responsibility for cyber has apparently fallen. I do not know if that is true, but I wonder whether it is possible to work with business bodies such as the IoD and the CBI to make it a strong corporate governance recommendation that every board should have somebody with a responsibility for cyber.
As I said at the beginning, this is a partnership: it is business, as much as government, that will protect us from cyber. For example, there has been reference to the insurance industry. One of the best ways we can ensure that companies invest in cyber security is to make it mandatory for them to get cyber insurance—which you cannot get unless you put cyber-secure measures in place—and to employ law firms to protect themselves from liability and to put in place important cyber measures.
I have not had a chance to support the noble Lord, Lord Clement-Jones, in his 50-year call for ethical hackers to be allowed to hack. I also echo the earlier call to hear the Minister’s views on the rise of bots and their impact on cyber security.
Baroness Gill (Lab)
My Lords, too often we hear in the news that our local hospital cannot access patient records, or that the transport network in our cities has stalled, or, as I experienced last year, that the power has gone on and off for over a month as the local electricity grid is affected by cyber attacks. A decade ago, some of this would have sounded like the plot of a Hollywood movie. Today, it is a weekly briefing on the desk of our cyber security data centres.
Our world has fundamentally changed. We are no longer just fighting off rogue teenagers or opportunistic hackers looking for a quick payout. The UK is currently navigating a highly sophisticated and aggressive digital battlefield. Malign actors are often directed, tolerated or unleashed by hostile nation states such as Russia, Iran and China, which are actively infiltrating key UK assets. They are mapping our infrastructure, stealing government credentials and probing our defences. That is why I welcome the introduction of the cyber security and resilience Bill. It is a critical and long-overdue overhaul of our national baseline defence. It marks the moment that the UK stops playing catch-up with hostile states and starts to dictate the terms of its own digital safety.
To understand why the Bill matters, we have to look at how our digital ecosystem functions. Hostile actors do not just knock on the front door; they look for the weakest link in the supply chain. Look at what happened in September 2025, with the devastating cyber attack on Jaguar Land Rover. Russian-linked hackers deployed sophisticated ransomware that completely paralysed JLR’s IT networks and forced a total shutdown of production lines across major UK plants for weeks, which had a major impact on the workforce in my old West Midlands constituency. The disruption that cascaded down into the automotive supply chain affected thousands of component manufacturers, mostly SMEs, with many workers in the region facing lay-offs. It had a major impact on the regional economy. Likewise, the attack did not just hurt the brand; it cost the British economy an estimated £1.9 billion, directly denting our national GDP. This was not just a corporate crime; it was an act of economic sabotage.
The threat extends far beyond manufacturing. Just weeks later, a massive cyber incident crippled electronic check-in and baggage systems at Heathrow Airport and across Europe. Was Heathrow’s central system breached directly? No. The attackers targeted a third-party vendor, Collins Aerospace, and scrambled the shared MUSE software that multiple airlines rely on. The result was chaos at terminals, hundreds of disrupted flights, and over 1.5 million passenger records being compromised. This new legislation fundamentally expands our defensive perimeter to address this exact vulnerability. For the first time, it brings data centres, managed service providers and supply chain partners directly into the regulatory spotlight, establishing a framework to name designated critical suppliers. The Bill recognises a hard truth: our infrastructure is only as secure as the third-party software we plug into it
Because of these aggressive state threats, a wider net is useless without sharper teeth. The Bill introduces two massive shifts in how organisations must run: rapid transparency and genuine board-level accountability. Under the new rules, if a covered organisation suffers a significant incident, or even a near miss capable of causing harm, it must file a notification within 24 hours, followed by a full report within 72 hours. In a cyber crisis, time is our most valuable currency. When assets such as Heathrow or JLR go down, an early warning allows the National Cyber Security Centre and regulators to contain the digital contagion before it spreads.
There are real consequences of negligence. For too long, cyber security has been treated by some boards as a minor IT issue, tucked away obscurely in finance or some other department. I am very pleased that the Bill changes this calculation. Companies that do not comply face financial penalties of up to £17 million, or 4% of their worldwide turnover. This will force executives to realise that robust cyber security is a core fiduciary duty. If you do not protect your network, you are jeopardising your entire business.
Crucially, this legislation is built to outpace our adversaries. Nation states use criminal proxies because they are fast, scalable and disguise geopolitical motives. Static laws become obsolete within months. The Bill grants the Government agile powers to update regulations swiftly through secondary legislation. This means that, as new state-sponsored threats emerge—whether through weaponised artificial intelligence or quantum decryption —the UK can adapt its defences instantly, without waiting years for a new Act of Parliament. The Bill also mandates companies immediately to notify their own customers if a breach puts those customers at risk.
To conclude, let us be entirely clear that the Bill is demanding. It will require an unprecedented level of capital investment and profound cultural change in every boardroom in this country, though I urge the Minister to consider undue burden on the SME sector, while recognising that it can sometimes be the weakest link. But we cannot ignore the reality of implementation. Cultural change does not happen purely through good will; it happens when the risk of non-compliance becomes completely indefensible. I ask my noble friend the Minister a fundamental question. While the target of the Bill is correct, the level of commercial investment and cultural transformation needed to meet these 24-hour deadlines is staggering. Beyond the immense financial stick, what mechanisms, support and enforcement frameworks will the Minister use to ensure this legislation drives genuine resilience, rather than just defensive corporate box-ticking? How will she guarantee that this heavy stick builds a shield?
Lord Ravensdale (CB)
My Lords, I declare my interest as a chief engineer working for AtkinsRéalis and I support the Bill. Given the threats that we are facing, strengthening the cyber security of the UK is vital. I think that the flexible, risk-based approach taken within the Bill is the right one.
Noble Lords have made many of the broader points already, so I will focus on a few narrower points. My remarks are really centred around the impact on economic growth and the need for proportionate regulation, because this legislation supports growth through, first, increasing our cyber resilience. The noble Baroness, Lady Northover, gave the example of the £15 billion cost of cyber attacks in 2024: that is a significant fraction of our GDP, around 0.5%.
I am also glad that the noble Lord, Lord Vaizey, brought up our world-leading cyber industry: the Bill represents a great opportunity for one of our key industries. However, there are threats to that growth agenda within the Bill, particularly through how larger corporates and SMEs will be affected, and we need to tread extremely carefully here. Business already has to deal with much burdensome regulation, as the noble Earl, Lord Effingham, set out. As ever in legislation, we need to think about those unintended consequences. To this end, there are three points I want to make.
Looking at some of the detail of the Bill, my first point is around supply chains. Clause 12 rightly brings in the concept of “critical suppliers” and ensures that supply chains are within the scope of the regulations. However, given the ambiguity of the criteria for designation, there is a risk that a significant number of SMEs could be affected, perhaps unintentionally, by this legislation, so I would be grateful if the Minister would set out what steps the Government are taking to ensure that the “critical supplier” designation is restricted to suppliers posing genuine systemic risks to the UK economy. Terms such as “potential to cause disruption”, which is the wording used in the Bill, are qualitative, and there are no hard quantitative thresholds in the Bill. The risk, of course, is that a significant number of SMEs could be bought within scope, stifling those businesses with unnecessary regulation. We need to ensure that is proportionate.
Secondly, going through the Bill and continuing on this theme, we come to Clause 15, on reporting. To expand on what the Minister set out at the start, Clause 15 expands the definition of “a reportable incident” to include those capable of having
“an adverse effect on … network and information systems”.
The risk is that this could lead to overreporting, as even a minor phishing email could be deemed to be capable of having “an adverse effect”, and then we could perhaps see overreporting overwhelming systems and bringing the risk that genuine threats could get through. So, I would also be grateful if the Minister could tell us how the Government will ensure that the “capable of having an adverse effect” threshold does not lead to overreporting of low-level incidents.
Thirdly, we have heard a lot of talk about AI in this debate, and perhaps a little less about quantum. I want to bring up quantum as a specific aspect, as the noble Lord, Lord Birt, referred to. I appreciate that there is a difficult balance here. This is a framework Bill, and it is perhaps not appropriate to set out specific technologies or technology impacts in it. However, the threat of quantum computers using algorithms like Shor’s algorithm to crack current public key crypto, such as RSA, enabling “harvest now, decrypt later” attacks on sensitive data, is something that will come, sooner or later, and quantum computing is evolving astonishingly quickly. The Parliamentary Office of Science and Technology, POST, where I am vice-chair of the board, has set out around a 10-year timescale for when a quantum computer will be able to break conventional encryption, and that aligns with the National Cyber Security Centre, which has already set out that organisations must complete migration to post-quantum crypto by 2035. I would be grateful for the Minister’s thoughts on how this could perhaps be strengthened within the Bill. For example, could there be something in the statement of strategic priorities in Clause 25 to help to join together the regulators in terms of the focus that is required on quantum cryptography? I would be very grateful for the Minister’s thoughts on that key area too.
In general, as I said, I support the Bill and I look forward to working with the Minister and her team as we move towards Committee.
Baroness Harding of Winscombe (Con)
My Lords, earlier today, the noble Viscount, Lord Colville, and I were saying that we were both quite late down this list and feared that everything would already have been said. That appears to be the case, but, fear not, I will still use my eight minutes.
I support the Bill and I agree with many noble Lords that we also need a much more comprehensive cyber security strategy. Like others, I have some specific suggestions for this specific Bill. My unique contribution, if it is unique, is not that I am an engineer and tech expert, as the noble Lord clearly is. I think that, in health terms, I would be described as an expert by lived experience, in that I suspect I am the only noble Lord today, probably the only noble Lord on the roster, who has actually been a CEO faced with a cyber attack. I have been that CEO whose company has been targeted by a gang of hackers, trying to work out how to navigate the crisis. I have had to go out and communicate to regulators, to customers, to shareholders.
Baroness Harding of Winscombe (Con)
To Ministers, indeed—to my noble friend himself. In those days, the National Cyber Security Centre did not exist—I am obviously referring to my time as chief executive at TalkTalk. Instead, we were directed to the Metropolitan Police’s hostage negotiation team. They were lovely but unfortunately had no tech experience at all. In fact, we did no better ourselves. The security expert who came to brief the TalkTalk board had just come from Mexico, where he had been trying to get a bank manager back who had been kidnapped.
That was only 11 years ago. At TalkTalk, we took the view that communicating was the only way to help our customers and therefore the only way to save the company, and I stand by that decision now, but not everyone takes that view. I was accused at the time of being hopelessly naive for going out, within 24 and 48 hours, on to the airwaves and saying, “My customers have been attacked and, no, I don’t know exactly what has happened”. That is the timetable in this legislation. Most CEOs I talk to say, first, “God, I’m glad I wasn’t in that situation. That’s my nightmare”. Secondly, they are surprised when I say that, actually, I would communicate earlier if I was in that situation again and not later. Cyber attacks are a modern-day taboo in the business world. Business leaders are terrified of admitting that they have been attacked, and I am afraid that that means that mandating reporting is essential, because, 11 years after I was in that situation, I do not think that that has changed. I think that unless we make it mandatory to report, people will not do it.
I was surprised at the time, in 2015, that had Sainsbury’s or Tesco been hacked, I would not have had to tell anybody—I had just come from Sainsbury’s in my previous job. It is really depressing, 11 years later, to see that retail is still excluded. I cannot quite understand why water is “essential” but food is not. I think that Covid taught us that our food retail supply chain is an essential service, and those who work in it are essential workers.
Managed service providers are in, but generative AI is out. Only a decade ago, that might have been OK, but it is not now. In the other place, the Minister said there are powers in the Bill so that we can get it right in the future. Well, we need to get it right now, and we also need the powers to try to keep up. I am not against giving Ministers the power to keep this live, but that is not an excuse for not being up to date today. As other noble Lords have said, it looks, sadly, as though the EU has got this more right than we have. We should be humble enough to admit that, rather than be afraid and insist on doing the wrong thing.
The other area I have some lived experience in, which, again, has been mentioned by other noble Lords, is the challenge of 12 NIS regulators and the lack of join-up. When the TalkTalk hack happened, we immediately stood up a series of workstreams—the obvious things such as trying to work out what had happened. That is the biggest problem with a cyber attack—you genuinely do not know whether you have been attacked by a nation state or kids in a bedroom. You somehow hope it might be the former, but more often than not it turns out to be the latter. So you have to know what has happened and you have to start communicating before you know what has happened. That is two workstreams. You have to work out how to get your systems back up again. That is another workstream. Even 11 years ago, without any of these additional regulators, we had to have a “communicating with regulators” workstream.
Now, spare a thought for the poor managed service providers. They are companies that serve transport, telecoms, energy and the NHS. I think they might have a full house. If you were a managed service provider that was the victim of an attack, you would probably have to deal with all 12 regulators. Those of us who have been here for a while know that if you give 12 different public sector bodies the ability to define terms, they will define them in 12 different ways and have 12 different forms. That will stop you, in the first day or the first week of a cyber attack, doing the things that you should be doing to try to protect your customers. As an expert through lived experience, I plead with the Minister: join-up is essential. It should not be optional. We all know it is hard to do. If you do not sort it out in the Bill, it will not happen. Please do not make that join-up a forum.
I can take myself back to October 2015 and imagine having to communicate with—as much as I love it—the DCRF. If we had had to convene a meeting of 12 regulators in the heat of the crisis to work out what to do, that would not have helped anybody. So we need either a single regulator, as the noble Lord, Lord Birt, so eloquently set out, or a lead regulator, as I know the Government are looking at in a number of other areas, to try to reduce the burden of regulation. I very much support what my noble friend Lord Effingham said: regulation does look like it is necessary here but we need to be careful that we are not just layering burden upon burden, and doing it 12 times most definitely is.
I feel I have said nothing original at all but have said it possibly from a unique perspective. I am rare among former chief executives who have experienced a cyber attack in that I am willing to talk about it, which is exactly why this legislation is important. But I very much hope that, as with so many tech issues, the Minister will hear that we agree more than we disagree and that we could work together to improve the Bill, as this House is often quite good at doing.
Lord Taylor of Warwick (Non-Afl)
My Lords, I thank the Minister for introducing this important Bill. Cyber security is clearly vital to the protection and prosperity of our nation. But if we fail to plan, we plan to fail, and this Bill is at the heart of the Government’s cyber security plan.
I was born and raised in a part of the world that many think of as paradise, bliss, utopia. It is called Birmingham, just off the M6 by the gasworks. I can see there is some accord in the Chamber—or maybe it should go to VAR. I was a district councillor in that region. One of the largest employers there is Jaguar Land Rover. This giant motor vehicle manufacturer is the head of a supply chain of over 4,000 companies. JLR was the victim, as we all know, of a cyber attack last year and was bailed out by this Government to the tune of a £1.5 billion loan guarantee. The Government believed they had no choice because if they had let JLR fall, thousands of workers would have lost their jobs. I have some sympathy with that rationale, but it did set a dangerous precedent. It is also worth noting, surely, that the company had not completed taking out an insurance policy against cyber attacks.
So the first point I want to make to the Minister is that there is no mention in the Bill of the role of the insurance industry. Surely the issue of essential and compulsory cyber insurance needs to be looked at; otherwise, we will have another situation where we have to bail out another huge company.
The retail chain Marks & Spencer lost 99% of its profits due to a ransomware attack which disrupted services and stole customer data last year. Harrods and the Co-op also experienced cyber breaches over recent months. Surely, then, there is a glaring weakness in the Bill in that it will have no impact on private companies such as these. Can the Minister explain why the scope of the Bill cannot be extended—not in the future but now—to include large private retailers, at least those over a certain defined size or turnover? I understand there is potential in the Bill for improving things in the future, but why not do it now?
One of the lessons of history is that we must learn lessons from history, and surely a vital lesson is to take into account the changes in the world around us. In the Bill, the Government recognise that the artificial intelligence revolution has increased the need for more effective cyber security. Yet there is still no UK AI regulation, no cyber strategy, no mention at all of quantum computing or encryption. These matters need to be discussed and looked at now, not some time in the future, when you consider how fast AI is progressing.
We also have a cyber security skills shortage, with 49% of UK companies admitting a lack of cyber foundational skills. As well as protecting the nation, in this AI age it is skills that will pay the bills and grow the economy. It is right that the Government have announced initiatives to attempt to fill vacancies in the cyber security industry, but there is no definition in the Bill of what is required to be a “skilled person” in this context. I just ask the question: why not? Why not look at it now?
We are living longer, and the demands on the public sector are growing, but there is a lack of focus in the Bill on the public sector, particularly the risk to NHS data. For example, Synnovis, which has been mentioned, is a company which provides pathology services to the NHS. A couple of years ago, a ransomware attack on Synnovis cost £32.7 million and resulted in delays to more than 11,000 appointments and even, allegedly, one death. Surely all companies, private and public, that hold personal data should demonstrate that they have effective defences against cyber attacks. I have tried to find out whether Synnovis or its suppliers would be covered by the Bill; there is some ambiguity over that, and that ambiguity at this stage is not helpful.
I welcome that the expanded scope of the Bill now includes data centres, managed service providers, electrical load controls and critical suppliers. But the Bill does not go far enough to protect the UK economy. The current structure of the Bill allows the Secretary of State, in principle, to expand the number of sectors in the scope of the regulations. But even to implement secondary legislation will require the Government to meet a number of conditions. The Minister has referred to emergency powers, but that is still a process rather than an event. Surely the principle of the Secretary of State reporting back to Parliament every five years is not good enough in this fast AI world that we are living in.
The Government also need to recognise that many companies operate across borders, including in the EU, where they have to comply with European directives on cyber security that do not apply in the UK. Over- regulation must not stifle innovation. With 12 regulators enforcing this Bill, there is a danger of regulatory duplication. This is especially so for organisations covered by more than one regulator. Where appropriate, the Government should seek to ensure that UK cyber security regulations align across each regulated sector and across borders with other jurisdictions such as the EU. For example, the Government could ensure that all regulators accept common forms of evidence demonstrating compliance.
There needs to be the adoption of a common baseline security standard, alongside ongoing evidence of security requirements across regulated sectors. This should also recognise that different sectors have their own particular needs: farming is different from fashion, which is different from football. The standard could be the National Cyber Security Centre’s cyber assessment framework. An example of co-ordinating regulators already exists in the Digital Regulation Cooperation Forum, which helps deliver a coherent approach to digital regulation.
Some 43% of all UK companies experienced a cyber breach in the past 12 months. The Department for Science, Innovation and Technology reports that cyber attacks cost the UK economy £14.7 billion a year, and the problem is increasing. For 10 years, I had the privilege of being vice-president of the British Board of Film Classification. Hollywood sometimes produces entertaining films that see the future; for example, Steven Spielberg’s movie “A.I.” was made 25 years ago—an incredible thought. There was a consistent theme in many of the more positive films that we regulated, in that good overcame evil. With a stronger version of this Bill, we can defeat the cyber monsters. In the more positive and hopeful movies we regulated, RoboCop prevailed over the Terminator and Luke Skywalker overcame Darth Vader.
Baroness Berger (Lab)
My Lords, I strongly welcome the intention of the Bill to strengthen the United Kingdom’s defences by updating our cyber security legislation as it applies to critical national infrastructure. That is good and overdue. As my noble friend Lady Gill pointed to, there is barely a week, if not a day, that passes without a significant business, hospital, local authority or supplier to government reporting a serious cyber incident. Every part of our infrastructure is vulnerable, and a legislative update to reflect that reality is one that this House should have absolutely no hesitation in supporting.
Noble Lords have already raised concerns about a number of things relating to what is or is not in the Bill, and things that perhaps need to be tweaked—how we should consider the economic impact of cyber attacks, as well as issues around insurance, reporting, workforce development and training, making AISI a statutory body and the lack of joined-up work across 12 different regulators. These are all concerns that I share.
I want to use the time I have available to add some details on the significant gap that has already been shared by others: the Bill currently makes no provision at all for artificial intelligence or, connected to that, for cyber sovereignty. This is not a hypothetical concern. Our allies have already grasped that, if their critical systems, their public services and their citizens’ data will depend increasingly on AI, relying entirely on foreign-built, foreign-hosted models is itself a national security question and diminishes those countries’ resilience. This is now the direction of travel right across Europe, and we should not assume that we can simply stand outside it.
The Netherlands has built GPT-NL, a sovereign open language model developed by a consortium led by the research institute TNO alongside SURF and the Netherlands Forensic Institute and funded by the Dutch Government. It exists explicitly so that Dutch public bodies are not routing sensitive data through services they do not control, governed by laws they did not write and using models they did not develop or test. Germany has gone further still with Soofi—Sovereign Open Source Foundation Models—a government-backed initiative bringing together German research institutions and industry to build an open foundation model of around 100 billion parameters intended to underpin domestic industry and to handle complex technical and analytical tasks. These are not vanity projects; they are deliberate decisions by Governments to secure and keep control of the systems their public services are increasingly relying on.
The strategic logic is plain. A handful of foreign providers now sit upstream of much of the world’s AI capability, and a dependency that concentrated is a single point of failure that no Government should accept for their critical national infrastructure. Sovereignty over the AI that runs our critical systems cannot be an optional extra; it should be treated as part of our national cyber security and national resilience decisions. The Bill as currently presented is entirely silent on that question.
I will raise two specific areas where this absence should concern your Lordships. The first is education infrastructure, specifically exams and marking, which are increasingly stored and processed online. I understand that awarding bodies in this country are already exploring AI-assisted marking. If AI becomes embedded in that process, the accuracy of a child’s marks will depend partly on how that AI model behaves, and yet it will sit outside the Bill’s jurisdiction. We are creating a critical dependency for the life chances of every child in this country, resting on a model we may neither own nor be able to scrutinise, with no corresponding legislative safeguard. We would have all the risk of a critical dependency with none of the legal guardrails that the Bill is designed to provide.
The second area is electoral services and the data held on the electoral register. I do not think I need to labour the point about why the integrity, security and sovereignty of electoral roll datasets matter. If AI systems come to play any role in how our electoral registers are compiled, verified or protected—we should assume that they will—we must be able to answer three questions: who controls the model, where does the data go, and what happens if that dependency is disrupted or compromised? A register we cannot fully account for is a register that we all cannot fully trust. The Bill should be equipping us to answer those questions.
None of these points is an argument against the Bill; they are an argument for finishing it. As many noble Lords have already alluded to, technology is moving faster than any Bill can be introduced. There are many stats on the speed of tech evolution; the one that consumes me the most is that the maximum length of tasks that AI models can successfully complete is now doubling roughly every four months. We owe it to the public to build in adaptability from the start, rather than returning to primary legislation each time the landscape shifts.
We have here in the United Kingdom one of the largest and richest bodies of public data anywhere in the world, not least from our NHS and our public service broadcasters. As the cost of building capable AI systems continues to fall, we have a genuine opportunity to harness that data ourselves; to help clinicians reach diagnoses faster; to ease the administrative burden that weighs so heavily on our public servants; and to build public services that reflect our own standards, accountability and values, rather than simply adopting whatever the market happens to offer.
Building this capability at home is also how we ensure that the guardrails and safety measures that we believe are necessary are actually built in to bolster the opportunity for full cyber security, rather than inheriting it from systems designed to other standards and other priorities without any concern for real safety and security. This is something for which I will continue to advocate and which, I believe, will supercharge the realisation of the aims of the Bill. I therefore welcome my noble friend the Minister’s reflections on whether AI and cyber sovereignty might yet find a place in this legislation.
I look forward to the rest of this debate and to playing my part in scrutinising and enhancing this legislation.
Viscount Colville of Culross (CB)
My Lords, I, too, welcome much of the Bill. It could not be more important in a world in which warfare is not just physical but digital. It is essential as part of our national security that our Government step in to protect us from such attacks.
Most noble Lords, I think, welcome the list of bodies to be regulated in Part 2. I am very glad that data centres, large load controllers and specified management services have been brought within the scope of the Bill. After all, the Government celebrated the huge investments of AWS and DC01UK in data centres. It is important that they are now covered by the Bill as an essential part of our national security.
There has obviously been an attempt to future-proof the Bill against the fast-changing world of tech. At the beginning of Part 3, Clause 24 gives the Secretary of State enormous and flexible powers to designate what is essential activity for the economy of the United Kingdom and the day-to-day functioning of society. This flexibility is then reinforced in Clause 43 in Part 4, which gives powers to issue directions to regulated persons and to decide what should be reported and to whom it should be reported.
My fear is that the Bill does not go far enough to address the present threats, let alone the future ones. Noble Lord after noble Lord has raised concerns about the failure to mention AI in the Bill at all. I, too, was at the terrifying meeting mentioned by my noble friend Lady Kidron, which was held earlier this month, by the Institute for AI Policy and Strategy and the Centre for Long-Term Resilience. They guided us through the world of software vulnerabilities and patches. In the arms race that is the search for software vulnerabilities, it is a fight between the attacker and the defender to find the flaw first. Even then, the rollout of patches to downstream defenders can be slow and leave them open to further attacks.
Having absorbed these concerns, we were then told about automated AI attacks, in which an automated AI agent can carry out all the steps of a cyber attack on its own as an autonomous operator. AI agents no longer need skilled labour to develop an attack—expertise can be rented from AI systems—and the attacks can vary in their approach and learn from each failure so that initial defences can be breached once again.
The AI Security Institute found that, between December 2005 and December 2006, a single hacker weaponised the Claude and GPT-4.1 systems to bypass safety guardrails and develop 400 attack scripts. The breach exposed the personal data of 195 million citizens in Mexico, including their tax and electoral registers. At the very least, if data centres can be added in at a later stage in the shaping of the Bill, frontier AI models operating in this country can and should be added in as well. They need to be protected from attack by foreign agents and rivals.
I am aware that, as Ministers have often said, regulation can be an obstacle to new start-ups. If that is the case, there needs to be a threshold on the size of the frontier AI models that would need to abide by the demands of the Bill. There also needs to be in the Bill a new clause in which AI frontier providers are designated as essential models.
The noble Baroness, Lady Harding, was right: I am going to repeat what other noble Lords have said. The Bill leaves lacunae over large sectors of the economy, which I am sure most noble Lords regard as essential services. The Bill must include critical manufacturing and retail, both of which suffered devastating cyber attacks in the past few months. Many noble Lords have mentioned the huge attack on Marks & Spencer. Noble Lords only have to imagine the effect on the country if there were successful attacks on one or two of our big supermarket chains. The result would throw the national food supply chain into crisis. Surely supermarkets, which provide much of our nation’s food and other services, need to be considered very carefully for coming within the scope of the Bill.
I understand that, unlike the finance, telecom and digital sectors, the manufacturing and retail sectors do not have a regulator. Nevertheless, Clause 24 allows for flexibility in this space, so I support the calls from the noble Lord, Lord Birt, and the noble Baroness, Lady Harding, for a cross-sectoral regulator. Perhaps the Government need to set up a second tier of essential service sectors that should be preparing to be brought within the scope of the Bill. In the longer term, it might be important to ensure that they are building the highest resilience to AI-powered cyber attacks.
This work must further strengthen resilience at board level. It cannot be left to AI departments to work out resilience on their own. I suggest that the Minister makes further changes to the UK Corporate Governance Code straightaway so that more responsibility for reporting incidents is taken at board level. The Minister is in a unique position to do this, being the Digital Economy Minister and having previously been in the DBT.
My other area of concern about the Bill is the importance of co-ordinating the reporting of cyber attacks, especially AI cyber attacks, to build cyber resilience. There should be an extensive list of sectors that are brought into scope, as the EU legislation has suggested. It is terrifying that so many of the automated AI attacks are what the industry calls “misalignments”, meaning that their outcome is not what the original design of the model had intended. Not only do they create outcomes that were not the original intention of the creators of the model but those creators do not even know that these misalignments have taken place.
I know that the Government have created the Cyber Resilience Pledge for our FTSE 350 companies, which means that they will sign up to the NCSC’s early cyber attack alerts and recommend a Cyber Essentials suppliers kit. The Government have put aside £90 million for resilience centres to give advice against attacks on SMEs. However, these all depend on voluntary responses by the affected companies. The Government need to mandate a reporting requirement so that effective defences can be rolled out across the economy.
I understand the flexibility on reporting given by Clause 43, but this country is confronted with the prospect of automated AI attacks. It is essential that the widest range of reporting of these attacks is included in the Bill. There must also be a mechanism for mandating the co-ordination of reporting these attacks. The Government must ensure that information about the attacks is brought together and that advice is co-ordinated on how to build a defence against those attacks. The information is crucial for AI frontier model companies to know that their agents are creating misalignments and for downstream companies affected by the attacks to build secure defences. The essential reporting on attacks needs to be brought together by the NCSC or the AISI. The Bill then must ensure that there is a cross-cutting regulator in the longer term.
The Bill recognises that we live in an ever more dangerous digital world. The introduction of autonomous AI into the digital world will affect us all and could do so to a disastrous degree. I call on the Government to ensure that AI is in the Bill, both in the sectors in scope and in the reporting requirements for these and other sectors. Failure to do so will open our country to attacks which will devastate our economy and our society for years to come.
Lord Holmes of Richmond (Con)
My Lords, it is a pleasure to take part in this Second Reading debate and to follow my friend, the noble Viscount, Lord Colville of Culross. Though he, by his own words, repeated some of the earlier points, he was the first speaker to say “lacunae”, for which I am particularly grateful; it sounds like a technology company. I declare my technology interests as set out in the register, as advisor variously to the Crown Estate and to Simmons & Simmons LLP.
As has been noted, this Bill is significant by having “cyber” in the title. This is long overdue, much needed and critical, as the Minister said, taking a cross-sector approach to cyber. Yet the first interesting point is that the Bill does not do that. Most notably, it is extraordinary that neither food nor space are included in the Bill. Similarly, it is said to take a cross-economy approach, yet it does not. However, it is worth mentioning the two sides of that economic coin and the huge economic growth potential from our cyber industries. I echo all the points that have been made about the need for skills and education, and to enable the cyber sector to grow and deliver that economic benefit.
Reporting has been mentioned widely throughout the debate. It is unfortunate if one finds themselves in a situation such as that of my noble friend Lady Harding, with multiple agencies to have to report to. Surely it would make sense to have a single reporting point for the speed, efficiency and effectiveness of that reporting system. Similarly, there is so much opacity around many of the definitions within the Bill. I pull out “significant impact” as one of them. What does this mean? If it stays as set out, the natural and understandable response from business is to go for the low-level mass reporting to avoid regulatory intervention. Does that enable the economy and the country to be better protected in this respect? I think not.
Similarly, the 24-hour and 72-hour reporting requirements feel oddly constructed around the artificial concept of a day set out in 24 hours. When one considers the real-time velocity of these attacks, it would seem logical that something way ahead of 24 hours would be advantageous at that stage and potentially something extending beyond 72 hours to do the second bit of the reporting process. What evidence is there to support this quite arbitrary 24 hours—or, as otherwise described, a day?
Security and resilience are the concepts most central to the Bill and will be the markers of its success or otherwise. For issues around proportionality and the ability to evolve and develop, does the current structure of the Bill really optimise this? MSPs have already rightly been mentioned. The burden for them is overbearing as currently set out. Surely it would make more sense to have a concept around what is reasonable for MSPs to oversee, what can legitimately be seen as within their control and how they can evidence that.
Understandably, the multiple regulator issue has been well discussed. It is critical, because how will we have co-ordination across all those organisations? A forum is certainly not the solution, as my noble friend Lady Harding rightly set out. A lead regulator, a single regulator or something around that has to be the way to go. I would argue that the NCSC should have the loudest voice in determining what is the best model and the best structure for doing that.
I was interested in the Minister’s introduction. She talked about the criticality of cross-sector consistency. I agree entirely, but in a debate on AI on 4 June in Grand Committee, she argued that consistency was not necessarily a central principle for the Government in the regulation of AI. I believe that a true cross-sector approach to cyber makes sense in this Bill. We can add to what is currently there and make that happen, but it is surely logical, and indeed a consistent approach to consistency, that we take that approach with AI. Can the Minister say why, if this argument is good for cyber, it is not good for AI—with a cross-sector approach, as will benefit this Bill, that is principles based and outcomes focused, with inputs understood?
I have another point on consistency. When the Minister sums up, can she set out the advantages that she sees in all the divergences that the Government have taken from the EU’s NIS2? I would be interested to hear the Government’s arguments for the advantages that they are seeking to bring from that.
My noble friend Lord Arbuthnot has rightly mentioned the CMA, and I know that my friend, the noble Lord, Lord Clement-Jones, will also mention this. It is right to mention it in this Bill, even though the national security Bill is said to be the vehicle through which this will come forward. It is right to give it a run around the track in the legislative process with this Bill, because we are talking about coverage currently holding our cyber professionals back because of a 1990 statute. To give some sense of what that means, in 1990 it had been only 24 years since England had won the World Cup. It is in urgent need of reform. We need to empower and enable our great cyber security professionals to do their job.
I have a quick point on DVS. I am not sure the Minister was involved when we did the Data (Use and Access) Act, but there was rightly a lot of discussion around DVS. In some ways, parts of this Bill are the other side of that coin. Currently we have a situation that is not addressed in the Data (Use and Access) Act or in this Bill: what happens to verification services when they have an attack where synthetic data is injected directly into the data stream, in effect bypassing the camera to get verification? How does this Bill address that issue? Do Clause 12, the potential regulations under Clause 30 or the guidance under Clause 36 address this? If not, what is the Minister’s view as to how we address that critical issue around synthetics?
The success of the Bill and of cyber in the UK will rest so heavily on the shoulders of our cyber security professionals, the women and men who do so much to keep our system—and, through that, us—safe. We owe them so much. Understandably, they often do this in the shadows, in dark rooms and in the Doughnut. We give them our sincere thanks, and we must demonstrate that thanks through the amendments we bring forward to make the Bill better.
Lord Moraes (Lab)
My Lords, it is a pleasure to follow the noble Lord, Lord Holmes. The noble Baroness, Lady Harding, has inspired me, as I am so low down the list—nearly at the end—not to do that thing of saying, “Everything has already been said, but not yet by everyone”, which I was thinking of while she was speaking. I will not do that; I am going to dump my very boring speech, inspired by the noble Baroness, Lady Ludford, who reminded me of what we used to do for a living. This contextualises exactly what the Government are trying to do.
My noble friend the Minister has a very tough job—I will explain a little why I think it is so difficult—but it is a job that we said we would do. We wanted to update the NIS regulation in 2018 and, as the noble Baroness, Lady Neville-Jones, said, to move fast and have some urgency. I know why she said that: I will come on to what the intelligence services are dealing with every single day, with hacking and what the Russians are doing. She knows that, as that is part of her DNA. We have to move fast, and we have to do something. That is exactly what the Government are doing. I want to try to contextualise what they are doing, why this is a national priority and how we can be as constructive as we can in building cyber security and cyber resilience.
A number of noble Lords, including the noble Baroness, Lady Harding, mentioned the EU network and information systems directive, which is very much the context of what we are doing. The noble Baroness, Lady Northover, spoke in some detail about our alignment with it and the noble Baroness, Lady Ludford, had some critical views about where we are in terms of our alignment. This really contextualises the complexity, as well as the urgency, of what we are doing here in the UK.
Noble Lords have said this because there are really only three global regulators doing this now—in the United States, the European Union and China—and they are diverging very badly. China does its own thing. In the United States, you may remember Mark Zuckerberg coming to the EU inquiry, going to Congress and saying, “Well, we need a GDPR, obviously”, but most of the legislation in the United States on cyber is in fact state led. The FTC looks at it, but it is really not national legislation. The EU is one of the few places, whether you like it or not, which has decided that it is a global regulator and that the cyber threat and cyber resilience are very much a global issue.
That does not take away from or dilute in any way some of the things that have been said, for example by the noble Lord, Lord Vaizey, about the United Kingdom’s special position as a country. We have the best intelligence services in the world, which is very relevant to this area. We have GCHQ and all that, and the technologists and companies close to this area, which are some of the best in the world. But the issue is with global regulation, and that is why it is so difficult.
The noble Baroness, Lady Ludford, made exactly the point that I was going to make, except I come to a different conclusion. She talked about the way that the two Ministers, Ian Murray and Kanishka Narayan, seem to be saying two different things. One is saying that we are taking a big hit and that real businesses and people are being hit by cyber breaches; whether or not it is 0.5% of our GDP, it is a big problem for the United Kingdom. Our other Minister said that we need the 12 regulators, to which the noble Lord, Lord Birt, referred, because they have the expertise, and that that is why it is so complicated and if we do anything else it is a huge burden on business. But I believe that both are true.
This is where the complexity of enacting good-quality cyber legislation happens. I know this because, as the noble Baroness, Lady Ludford, will testify, I chaired many of the GDPR legislative trilogues and the ePrivacy trilogues and I had to scrutinise many of the cyber conventions that are part of the EU treaties and body of law. I will cite the latest AI rapporteur—we now have another AI Act forthcoming in the EU because the older Act is out of date, the GDPR is out of data and the ePrivacy legislation is out of date. I said to the AI rapporteur, “You have the latest AI legislation”, and he said, “Yes, it’s a bit like you just jump off the cliff and build your wings on the way down”. Why somebody from Italy was quoting Ray Bradbury I do not know, but it is kind of correct. I know that the Minister has wings already—she has wings and she need not worry; she will be fine—but the point is that you have to move with such speed. The point that the noble Baroness, Lady Neville-Jones, made is that somehow you just have to move. The urgency is great.
The noble Lord, Lord Vaizey, who is not in his place, has inspired me to depart from my notes. He explained very eloquently, having been a Minister at that time, how complicated this is for our current Ministers in government. He talked about encryption and said that we knew that the companies—Microsoft, Facebook, which is now Meta, Reddit, Snap Inc, and all of them—wanted end-to-end encryption and did not want it weakened. Why? Because with strong end-to-end encryption, you deal with cyber threats. At the time, as noble Lords will remember, there were a lot of terrorism threats around, so most enforcement agencies were saying, “No, we need a backdoor to encryption”. That was the prevailing wisdom, and that argument won out. But the companies, in my view, were right. They were talking about the banking system, privacy and all the threats that we now have if we weaken encryption.
The noble Lord, Lord Vaizey, said that because the context here is that it is extremely complex to come up with good cyber security and resilience legislation. The noble Lord, Lord Birt, is so good with his communication that I almost think the OCR is a real thing. That is because he is who he is—he could persuade anyone. Of course, everyone is saying, “Let’s get rid of the 12”, but I caution about the complexity of dealing with cyber threats. I will give one last example about the daily threats we have from foreign actors—this is very different from the corporate threats, some of which come from within the United Kingdom and need a very different response, as we also saw in the European Union.
My time is up, but I just want to contextualise how tough this is going to be. Let us jump off the cliff, build the wings on the way down, get this done and do what we can in Committee, because this is a national priority. Is it perfect? Of course it is not. But we need to get moving, because the threats are very real.
Lord Londesborough (CB)
My Lords, it is getting late, and I am told that we are now competing with the Spain v France World Cup semi-final—the winner may well face England in the final—so I will try to be brief. I speak not as a cyber expert or technologist but as a former CEO of a tech-enabled mid-sized business. I want to bring some ground-level perspectives of these oft-mentioned SMEs, one of which I currently chair.
I welcome the Bill, but like many others, I have some concerns over its scope, its impact on those apparently outside the scope but who sit within critical infrastructure supply chains, the challenges of a horizontal piece of legislation being layered over multiple sectors and their regulators, and why, as so many people have asked, there is no specific strategy for AI. All of that has been covered, and I will not repeat those points. However, I want to question why central government and local authorities will remain out of scope. The National Audit Office’s report last year found serious slow-to-fix security flaws across 58 of the 72 government systems that were reviewed. The public sector badly needs binding legal requirements, not just a voluntary action plan.
As we have heard, the UK is already the most targeted country in Europe for cyber attacks, with more than 40% of UK businesses experiencing such attacks at a cost put at almost £15 billion annually. But those numbers are almost certainly an underestimate not just because they apply to 2024 but because a whole range of cyber incidents go unreported and therefore unmeasured, especially in the world of SMEs. In fact, 96% of UK businesses that suffered a cyber attack were SMEs, not because they are targeted but because they are easier to breach. If you factored in all the incidents and took into account all the costs, including the distraction from core business, the real cost this year might well be closer to £30 billion—roughly 1% of our GDP.
Let us face it: when this Bill is enacted, it will already be out of date. That is not an argument for delay, but it is an argument for shaping legislation to allow changes and add-ons down the line as the threats change without going through the long and arduous processes of legislating through both Houses of Parliament. I suggest that we are pragmatic and that we balance the need for parliamentary scrutiny and consultation with speed and agility.
I am going to finish by focusing on the mid-market and small businesses. The Bill tells us that high impact suppliers of any size could be designated as critical suppliers. That has raised quite a few question marks. Two-thirds of medium-sized UK businesses reported a cyber breach last year alone, yet only 15% of those businesses had formally reviewed the cyber risks that their immediate suppliers posed to them. This Bill will make mid-market players take compliance, incident reporting, risk assessments and audits more seriously. Those should no longer be seen as the sole responsibility of the IT department or the CTO but become a board- level issue that CEOs need to engage with. Currently, only 27% of UK businesses have board-level cyber accountability. That needs to change.
It is confession time. I was once one of those mid-market CEOs who took too little interest at board level in the risks to our company’s infrastructure and systems, delegating them to mid-management and our offshore partners and nearly paying the price when our online platform, which contained all our customer data and 20 years of content, came under attack and was very nearly successfully hacked. Lessons were quickly learned. Will the Minister say how the Government plan to address and resource the information, communication and training challenge that this Bill will present to mid-market players?
I raise the same question for those SMEs that will get dragged into supply chain compliance issues, whatever their size, but without the specialist resources needed. In the other place, the Liberal Democrats proposed what I thought was a very sensible amendment for the establishment of a cyber security support service to help SMEs comply with their regulatory duties. This was dismissed by the Minister, who said that very few SMEs would be in scope, but nobody has put a number to this and I think this misses the point. I fear that the Government underestimate this challenge, both for mid-market and small players.
If this information, resource, communication and education piece is not properly addressed, we will not just lose links in the supplier chain but reduce the level of competition. This will be bad for business and economic growth and, indeed, for trade with our European neighbours, who are way ahead of us in this area.
Lord Ashcombe (Con)
My Lords, my noble friend Lady Harding talked about speaking half way down the list, and the noble Lord, Lord Moraes, of being nearly at the end of the list. I am last, as your Lordships will be glad to hear.
I must declare my interest as an employee of Marsh Risk, an insurance brokerage company with a large cyber practice. Like many other noble Lords, I welcome the Government’s ambition to strengthen the UK’s cyber defences and, in doing so, to protect the continuity of the essential services on which the public depend.
The Bill’s direction of travel is right: widening the scope of the existing regulatory framework to reflect modern supply chains, strengthening oversight and improving the flow of information to regulators and the National Cyber Security Centre so that we can build a clearer national picture of threats and vulnerabilities. However, I will press the Minister on two areas where the Bill, as drafted, risks leaving practical gaps: first, the role of cyber insurance in building national resilience; and secondly, whether the proposed incident reporting timelines will, in practice, help resilience or inadvertently hinder it.
On insurance, my argument is straightforward. Regulation, technical standards and guidance are essential, but they are not, on their own, a resilience strategy. Resilience also means the ability to recover quickly: to fund remediation, to access specialist incident response capability at speed, and to keep vital services running while systems are rebuilt. My noble friend Lord Arbuthnot referred to cyber insurance. On its own it is not a silver bullet, but it is one of the few tools that can mobilise financial and operational support within hours. Time is of the essence to limit further damage, as we have seen in a number of recent incidents.
The noble Baroness, Lady Paul, discussed how insurance can incentivise behaviour. I very much agree with that and a lot of what she said. I will take the process a little further. In the cyber insurance market, the best policies do more than pay claims. They typically provide 24/7 emergency hotlines, pre-vetted panels of incident response firms, forensic expertise, legal and communications support, extortion specialists and business interruption expertise, all of which can be decisive in reducing harm, shortening outages and supporting faster restoration of services. Some insurers even pay loss or claims expenses directly to the party owed—for example, breach counsel and forensic vendors—saving their clients from having to pay large incident response costs out of pocket. For many small and medium-sized organisations, it is often the only affordable way to access that depth of capability. This support can potentially prevent the Government having to step in, as they had to offer to do in the Jaguar Land Rover incident.
Yet cyber insurance can play that stabilising role only if organisations are encouraged to take it up as part of a wider risk management approach. Indeed, my noble friend Lord Vaizey talked about it being mandatory. At the very least, we need to create greater awareness of the benefits that cyber insurance can bring to businesses. Personally, I tend to prefer a carrot rather than a stick approach.
My first question to the Minister is: what incentives are the Government considering to encourage greater uptake of cyber insurance, particularly among smaller operators and critical suppliers who may sit outside the largest corporate balance sheets but whose disruption can cascade through supply chains? Has she considered introducing a moratorium on insurance premium tax of, say, three years for companies that take out cyber policies for the first time, as a way to incentivise uptake? Incentives are not just about premiums. They are also about information and confidence, ensuring that organisations understand what insurance does and does not cover, encouraging consistent baseline controls so that insurers can price risk responsibly, and supporting appropriate data sharing so that lessons from incidents can improve both national defences and underwriting insight. In short, the objective should be a virtuous circle: better cyber security, greater insurability, more uptake and stronger national resilience.
I turn to incident reporting, as discussed by the noble Lord, Lord Ravensdale, and my noble friend Lord Holmes. The policy intent to ensure that regulators and the NCSC receive timely warning of significant events is understandable. Many noble Lords have mentioned this in principle. But in a major cyber incident, the earliest hours and days are dominated by triage, containing the threat, protecting services, preserving evidence and restoring critical functionality. Those involved in the response work around the clock to keep the businesses running. In that context, the requirement for rapid reporting can create real operational tension.
As I understand it, the approach envisages a two-stage process: an initial notification shortly after the organisation becomes aware of a significant incident, followed by a fuller report within a tight timeframe. My concern is not with the concept of early warning; rather, it is that the requirement to produce a comprehensive report within 72 hours risks driving premature, incomplete or speculative reporting, and it can pull scarce technical leadership away from response and recovery at precisely the moment it is most needed.
That is why I intend to table an amendment to adjust the reporting time so that the full report is due within 30 days, with an expectation that the affected entity provides an initial notification promptly and submits updates as material facts become clear. This would preserve the Government’s need for awareness and situational insight, but it would also recognise the practical realities of incident response. Organisations often cannot state with confidence the root cause, scope of compromise or data impact within 72 hours, particularly where third-party suppliers and complex networks are involved. Can the Minister confirm whether the Government have considered an approach of this kind—one that distinguishes clearly between early warning and a detailed, evidence-based report? Requiring a detailed report too early can reduce the quality of the information that authorities receive, increase the risk of later correction, meaning rework and additional expense for all concerned, and potentially undermine trust and transparency.
I support the Bill’s overall aims, but if we are serious about resilience we must think not only about prevention but about recovery and continuity. Cyber insurance, properly understood and appropriately incentivised, can be one of the mechanisms that turns a cyber event from a national disruption into a managed incident. Finally, on reporting, we should insist on a regime that delivers timely awareness without undermining operational response.
Lord Clement-Jones (LD)
My Lords, first, I declare an interest as an adviser to DLA Piper on AI policy and regulation. I should also say that we as a law firm were subject to a ransomware attack by NotPetya back in 2017. It was not a pleasant experience.
I thank the Minister for her introduction and earlier engagement on the Bill and thank all noble Lords who spoke today in such an expert fashion. On these Benches, like many other noble Lords, we support the fundamental objectives of this legislation to modernise our outdated cyber security framework. But what has been remarkable today is the consensus across the Benches that the Bill is not nearly ambitious enough. Indeed, as my noble friends Lady Northover and Lady Ludford, the noble Lord, Lord Vaizey, and the noble Baronesses, Lady Neville-Jones and Lady Harding, have said, this could be a missed opportunity to align much more closely with the EU framework.
I would prefer not to be jumping off a cliff, with or without wings, with all due deference to the noble Lord, Lord Moraes, and I do not think that we are really living up to the motto of the city of Newcastle either. As the noble Lord, Lord Arbuthnot, said: where are the principles? The noble Earl, Lord Effingham, said: where is the strategy? The noble Baroness, Lady Kidron, asked where the plan of action was. There is quite a bit missing from the Bill, and I shall take noble Lords through some of those areas.
As many noble Lords have illustrated, the threat landscape has deteriorated sharply. The National Cyber Security Centre has managed 204 nationally significant incidents in a single year, double the year before. Yet, as the noble Lord, Lord Birt, pointed out, the Bill will apply directly to only a tiny minority of organisations; meanwhile, 43% of UK businesses have experienced a cyber breach in the last 12 months. One of the most glaring omissions is the almost entire exclusion of the public sector, as the noble Baroness, Lady Alexander, and the noble Lord, Lord Londesborough, pointed out. Central government, public administrations and local authorities are almost entirely exempt from the Bill’s direct statutory duties.
How can we claim national resilience when the state itself is exempt? We have seen the data of 270,000 military personnel compromised in the Ministry of Defence hack, and the devastating attack on the British Library, which destroyed irreplaceable data. Local authorities hold vast repositories of citizen data, from electoral registries to social care records. The ransomware attack on Redcar and Cleveland cost £10 million, the one on Hackney £12 million.
As my noble friends Lady Northover and Lady Ludford, the noble Lords, Lord Birt and Lord Vaizey, the noble Baroness, Lady Kidron, and the noble Viscount, Lord Colville, all said, we must make cyber security a boardroom issue. It was very good to hear from the noble Baroness, Lady Harding, with her lived experience of cyber attack, yet only 27% of businesses now have a board member explicitly responsible for cyber risk, down from 38% three years ago. The noble Lord, Lord Vaizey, was correct. Unlike the EU’s NIS2, the Bill fails to mandate executive responsibility. I support the noble Lord, Lord Birt, in saying that we must now extend corporate financial audits to report on how an organisation and its suppliers manage cyber security using existing governance codes.
The urgency here is multiplied by the rapid rise of agentic artificial intelligence. The noble Baroness, Lady Alexander, described this as “an AI-shaped hole”, and the noble Baronesses, Lady Kidron and Lady Harding, and the noble Viscount, Lord Colville, all pointed to this omission.
Anthropic recently withheld wide release of its Mythos model because it could autonomously find and exploit software vulnerabilities across every major operating system. The UK’s own AI Security Institute, as we have heard, found Mythos substantially more capable at cyber offence than any model previously assessed, and warned that frontier AI capability is doubling every four months. Of course, that will be further amplified by quantum computing, as mentioned by the noble Lord, Lord Ravensdale.
The EU’s AI Act already imposes binding cyber security and incident reporting duties on the handful of frontier model providers that it judges to pose systemic risk. California and New York do the same for the largest developers. This Bill, by contrast, does not mention AI systems at all, as many noble Lords have pointed out. Last month, the cyber security agencies of the Five Eyes alliance, including our own National Cyber Security Centre, issued a joint statement warning that frontier AI is shrinking the gap between vulnerability discovery and exploitation from months to a matter of days, and this can no longer be treated as a technical issue rather than a leadership responsibility.
Meanwhile, our own defenders have a skills crisis. The noble Lords, Lord Birt, Lord Arbuthnot and Lord Vaizey, and the noble Baroness, Lady Alexander, all raised the skills issue. ISC2 warns that 88% of UK cyber professionals have experienced a breach in the last 12 months as a direct result of skills shortages, yet Clause 43 references “a skilled person”, as pointed out by the noble Lord, Lord Taylor of Warwick, who must liaise with the Secretary of State during national security directions, without defining what “a skilled person” is.
Who will actually enforce the rules? The Bill distributes duties, as we have heard today, across 12 separate sectoral regulators, many of which, such as Ofwat, already struggle to regulate their own domains. This fragmented approach guarantees duplication and gaps. Again, I agree with the noble Lord, Lord Birt, and, indeed, the Joint Committee on the National Security Strategy: the UK needs a single expert or lead regulator —as mentioned by the noble Baronesses, Lady Alexander and Lady Harding, the noble Lords, Lord Vaizey and Lord Holmes, and the noble Viscount, Lord Colville—to oversee both public and private sectors. Failing that, the Government should at least adopt the EU’s Digital Omnibus model of a single report-once portal. I share the ambitions of the noble Baroness, Lady Paul, and those of the noble Lord, Lord Holmes, in this respect.
We must, as the noble Baroness, Lady Neville-Jones, said, fix the Bill’s definitions—also mentioned by the noble Lord, Lord Ravensdale. For instance, techUK warns that the current definition of a managed service provider is dangerously broad, risking capture of any basic IT support in the country.
The Bank of England’s own data shows that just three US giants control 73% of the cloud computing services supporting UK financial firms. A number of noble Lords raised the issue of cyber sovereignty. The Trump Administration blocked European and UK firms from accessing Mythos. If a foreign ally can pull the plug on a critical cyber security tool overnight, how can this Government claim true national resilience? That is why, as many noble Lords today have said, we need a comprehensive digital sovereignty strategy. My noble friend Lady Ludford called this “servitude” and the noble Baroness, Lady Berger, talked about critical defence. We need to assess our foreign policy dependencies and support domestic UK providers. I welcome what was said by the noble Baronesses, Lady Kidron, Lady Bennett and Lady Berger, in that respect.
The Bill is silent on cyber-enabled fraud, which costs our economy billions of pounds every year and exploits precisely the same weaknesses this Bill is meant to fix. The noble Lord, Lord Arbuthnot, mentioned a related threat which is emerging, as Thales has tracked that automated bot traffic has overtaken human traffic online for the first time. As suggested by the NMA, we need the Secretary of State, under this Bill, to assess the cyber security risks that anonymous bot traffic poses to UK websites.
If we expect businesses to defend themselves, we cannot handicap our own cyber professionals. I welcome what has been said by a number of noble Lords, including the noble Earl, Lord Effingham, the noble Lords, Lord Arbuthnot and Lord Holmes, and my noble friend Lady Ludford, on the question of the Computer Misuse Act, which badly needs amending.
Finally, in the face of autonomous AI threats, the Government need an ultimate backstop. We support proposals from ControlAI to introduce strictly constrained last resort powers, allowing the Secretary of State to direct the shutdown of data centres or AI systems in a catastrophic emergency. The cost of inaction vastly outweighs that compliance burden. The noble Baroness, Lady Gill, graphically described the situation at Jaguar Land Rover, which lost around £500 million in a single attack. But currently JLR sits entirely outside the scope of the Bill, as does the retail sector, as a number of noble Lords have pointed out. The noble Baroness, Lady Paul, indicated that that was true of the insurance sector too.
The Bill is a necessary foundation. In Committee, we will push hard for amendments to reflect the changes that are needed. In this way, we can ensure that our national cyber defences are genuinely whole of society and fit for the age of AI. We are going to have a very well-informed Committee; I hope the Minister is looking forward to it.
Viscount Camrose (Con)
My Lords, I am grateful to all noble Lords who have contributed to the debate and, of course, to the Minister for her introduction. It has been a really thoughtful, compelling and persuasive debate. It is clear that, on all sides of the House, there is a shared recognition of the scale of the threat that this legislation seeks to address and the importance of doing so effectively.
As my noble friend Lord Effingham said, we on these Benches support the objectives of the Bill. Indeed, much of what is in it has its origins in work begun by the previous Government, following the 2022 consultation, and we applaud the continuity. We do not intend to try to make the perfect the enemy of the good, although I wholly endorse the cyber insurance argument set out by the noble Baroness, Lady Paul of Shepherd’s Bush, my noble friend Lord Ashcombe and others.
Listening to the debate has only reinforced for me the central question with which we began: where is the strategy? Ministers have described the Bill as one part of a wider programme, yet the national cyber action plan that was promised before the end of last year, and then promised again for this summer, remains unpublished. I observe as an aside that, as with the defence investment plan, we are in danger of creating the perception, which we must avoid, that there is a pattern of delay and avoidance when it comes to defending ourselves. Noble Lords across the House have, in their own ways, returned again and again to that same point.
I started off the debate diligently writing down everybody who called for a change to the scope but that turned out to be everybody, which makes our task today far harder. I absolutely accept that this is a Bill designed to have a narrow scope, but we have no way to understand the broader context in which that narrow scope sits. It is like trying to judge an orchestra but being allowed to hear only the woodwind section.
It is inevitable that we will have questions, concerns and suggestions that go beyond the narrow scope and intent of the Bill. How will SMEs learn to protect themselves better? Many people have raised that. A great many noble Lords—again, almost everybody—mentioned AI, but what response overall is envisaged to the threats of emerging technologies of which as yet we know little, such as new AI models at the frontier, quantum cracking and so on? How will we reduce the number of vacancies for cyber roles? By the way, it is not a new problem, by any means, that there are too many vacancies for cyber roles. We were wrestling with it when we were in government. It is an intractable problem that we need to find better ways to address.
How will we address the growing prevalence and effectiveness of weaponised disinformation that does so much harm to our society every day, right now? More fundamentally, what are our strengths and weaknesses relative to those of our assailants and our allies? Let me express the hope—I will return to this point—that, during the Bill’s passage, and ideally before Committee, we have the national cyber action plan to answer these and no doubt many other questions. This could make the passage of the Bill considerably easier for all of us, in particular for the Minister, and indeed help bring about the wish of my noble friend Lady Neville-Jones that we get through the Bill quickly in order to get these measures on to the statute book as soon as possible.
Even the National Cyber Security Centre itself has publicly called on government to set out a clearer strategic policy agenda. If GCHQ’s own technical authority feels moved to say so, that ought to give the Minister and the Government pause.
In the other place, my honourable friend Dr Ben Spencer made precisely this point, warning that the National Audit Office had found
“inconsistent, and in some cases glacial, progress”,—[Official Report, Commons, 6/1/26; col. 223.]
in cyber resilience, and that the Bill risked becoming “yet another missed opportunity”. My honourable friend Julia Lopez for her part reminded the Commons that, if the pandemic had accelerated the adoption of digital technology, artificial intelligence would embed it further still. Yet, as she noted, and as noble Lords, including my noble friend Lord Arbuthnot, have echoed this evening—in fact, as everybody has said this evening—the Bill is silent on AI. It is silent on the Computer Misuse Act. These omissions go to the heart of whether this legislation will still be fit for purpose in five years’ time, given how disappointingly rarely Parliament revisits this ground.
On the question of regulatory burden, I was also struck by how many noble Lords share our concern for smaller businesses. I hope that the Minister agrees that this is not a party-political point. It was raised by members of the party opposite in the other place too, who rightly noted that SMEs are disproportionately targeted by cyber crime, yet are the least equipped to absorb new compliance obligations. In fact, techUK, as the noble Lord, Lord Clement-Jones, pointed out, has warned that leaving so much of the detail of this regime to secondary legislation, as well as using some of the rather woolly language that was commented on by the noble Lord, Lord Ravensdale, risks creating exactly the kinds of legal uncertainty and cost that fall hardest on smallest firms.
Again, I am trying to make not a political point—we urgently need this Bill—but a practical point. Indeed, my noble friend Lady Harding’s account of attempting to communicate while managing the crisis caused by an attack was absolutely salutary and I hope the Minister will take note of it.
So, as we move towards Committee after the Summer Recess—I think Committee promises to be a very productive activity—I hope the Minister will reflect carefully on the questions raised today and, in her closing, perhaps answer the following questions. First, will the Government commit to a firm date for publishing the strategy within which this legislation is meant to sit? Secondly, how will the effectiveness or otherwise of the Bill’s measures be assessed, and how will that assessment be reported to Parliament—we hope not every five years? Thirdly, what assessment has been made of the cumulative reporting burden facing businesses of all sizes already subject to data protection and sector-specific obligations? Fourthly, what confidence can the Minister offer the House that the 12 regulators tasked with enforcing this regime, which we have heard a great deal about, will have and will continue to have the resources and expertise to do so effectively?
In Committee, we on these Benches will continue to press the Government on precisely these questions because, as with any regulation, it must be built on a foundation of strategic clarity rather than being asked to substitute for it. I look forward to the Minister’s response.
Baroness Lloyd of Effra (Lab)
I thank noble Lords for their insightful and wide-ranging content, and I am pleased to hear the broad support for the Bill. I also thank the Minister in the other place and the parliamentarians who engaged with your Lordships and others ahead of the Bill’s introduction. The dialogue has been shaped by pragmatism and a genuine interest in protecting our people and businesses. Should I not be able to respond in the allocated time to all the very many specific points that were raised today, I will make sure that I review Hansard carefully and reply to noble Lords accordingly, placing copies in the Library.
The noble Viscount, Lord Camrose, raised an excellent point about the scope of the Bill and the many other government actions and activities to equip our businesses to tackle cyber threats. I agree that the national cyber action plan is the right place to set out exactly how this is all put together, but today I cannot provide noble Lords a date for the publication of the national cyber action plan.
As other noble Lords did, I started writing down the names of all the noble Lords who raised the question of scope—and I too decided that it was probably better to say “everybody”. This is a very pertinent question. Cyber security and resilience are a shared responsibility. The Government and the NCSC provide a range of tools for all parts of the economy, and it is for all organisations to make use of those to enhance their protections. We have invited all businesses, charities and other organisations to sign the Cyber Resilience Pledge and take the three tangible actions that can help boost their resilience to cyber attacks. For many organisations, this will be a significant step in their defences, and regulation will not be necessary nor proportionate.
Under the Bill, we have chosen to regulate where disruption to services—hospitals, drinking water, and cloud service providers—would mean that people and businesses are left with little or no easy alternatives. The significant steps we are taking in the Bill are reflective of the digital nature of our economy today and the risks we encounter. I recognise and share the sentiment of exploring other parts of the economy that would benefit from being under these regulations in the future, and I assure the House that I have asked my officials to work with other government departments to consider what additional services could be brought into scope in future. At the same time, this work needs to be undertaken with thorough consideration for a range of factors, such as the threats posed to such services by hostile actors and the potential impact they could have on the wider economy, as well as the overall value of the sector. We need to take into account the important points that noble Lords have made about proportionate regulation. I confirm to the noble Baroness, Lady Neville-Jones, that, were we to extend these regulations to further sectors, that would follow consultation.
The noble Baronesses, Lady Northover, Lady Neville-Jones and Lady Ludford, and the noble Lords, Lord Londesborough and Lord Clement-Jones, raised an important point about the government cyber action plan. It is crucial that our Government and public sector are covered. The government cyber action plan, which was published in January, will transform cyber security and resilience across government and the entire public sector by 2030. It will enable us to achieve the same outcomes that we want to achieve for services regulated under the Bill: clear and robust requirements, better incident reporting, and stronger accountability and transparency. The plan sets out accountability structures to ensure that cyber risks at all levels of government are actively owned and effectively managed. I assure your Lordships that we will continue to work with Parliament to ensure proper oversight of the plan’s implementation.
The extension to local government is also covered under the overarching strategy of the Government’s cyber action plan. I say to my noble friend Lady Alexander of Cleveden that MHCLG is taking action to strengthen local authorities’ cyber resilience, backed by £20 million of cyber grant funding and technical support, because it is incredibly important that local authorities are prepared and enhance their cyber action.
On the question about the food and retail sector, raised by the noble Lords, Lord Holmes of Richmond and Lord Taylor of Warwick, and the noble Baronesses, Lady Northover, Lady Ludford and Lady Harding of Winscombe, probably among others, it is very important that the sector enhances its cyber resilience. The food sector is unusual among critical sectors because of its high levels of diversity. There are approximately 20,000 small and medium-sized food manufacturers in the UK alone, and many more farms, distribution services, retailers and other types of businesses that form the UK’s food supply chain. Given the lack of a single point of failure, we think there are more proportionate levers to pull than bringing food into the scope of the NIS regime.
The question of AI was raised by the noble Earl, Lord Effingham, the noble Viscount, Lord Colville of Culross, the noble Baroness, Lady Kidron, and my noble friend Lady Berger. The Government are committed to protecting our national security against the risks posed by advanced AI models, and our AI Security Institute is world leading and one of a small group of organisations with access to Anthropic’s Claude Mythos model before its release. As for addressing the risks of cyber attacks facilitated by AI, it is true that AI capabilities are moving very fast, but strong cyber fundamentals still work. Our advice, and that of the NCSC, is to ensure that organisations get the basics right and that they are managing risks at board level. There is extensive guidance on this from the Government and from the NCSC.
As for whether AI is in scope, the Bill does not specifically bring large language models or AI companies into scope, but where organisations in scope use AI models and systems, those organisations will need to take appropriate and proportionate steps to manage the risks to these from hackers. For example, if an LLM is used as part of the day-to-day software available to staff in a hospital, and is therefore part of the network and information systems, it would be considered in scope.
On the example given by the noble Baroness, Lady Kidron, of how this would happen, the Bill grants the Secretary of State the power to direct entities if the compromise of the relevant NIS or the threat of one gives rise to a national security risk. This could, for example, require an entity to cease using and to isolate an AI model. These powers are a backstop to an effective cyber security regime, enabling the Government to act swiftly in the face of unexpected national security threats, but they are also designed to be proportionate, recognising the need for stability among regulated entities and the importance of proper accountability.
Many noble Lords reflected on the need for effective implementation and the importance of consultation and secondary legislation. There will indeed be secondary legislation and guidance and a business adjustment period for the Bill. To answer the question posed by the noble Baroness, Lady Neville-Jones, this will probably be for the period up to 2028, when we expect the duties to come into force.
On the questions about incident reporting raised by the noble Earl, Lord Effingham, the noble Lord, Lord Ravensdale, and the noble Baronesses, Lady Northover and Lady Harding of Winscombe, we have heard the clear ask from businesses to minimise the time they spend filling in different reporting templates following an attack. We understand the pressure that institutions can be under in the midst of an attack, and we want to make sure that they can prioritise the technical response. We are exploring all options and will look closely at other regimes in the UK and the new template used by EU member states for the NIS2 reporting, reflecting questions posed by noble Lords about where we are looking at the EU regime.
We do not believe that there is a risk of overreporting, but we will provide further clarity by setting out thresholds in secondary legislation following consultation. That will set out when an incident is considered to have had, or to be likely to have had, a significant impact—a question posed by the noble Lords, Lord Holmes of Richmond and Lord Ravensdale.
On the questions raised by the noble Baroness, Lady Bennett of Manor Castle, the ability to share information with like-minded countries is important if we are to make cyber security a global effort. But the Bill does not mandate information sharing across borders, and there are important safeguards around the sharing of information for the purpose of prosecuting a crime. I followed the debate on this topic in the other place, and I would be happy to meet with those interested in this topic to discuss it further.
Noble Lords raised the question of the balance between a single consistent approach and being attuned to sector-specific issues. One of the ways in which we are going to pursue consistency and provide clarity on what is expected is through the new security and resilience requirements for regulated entities, which will be set out in secondary legislation. These will set out the clear and consistent steps that regulated entities will need to take to mitigate their security risks. On the questions posed by the noble Lords, Lord Arbuthnot, Lord Birt and Lord Ravensdale, these will be high-level, outcomes-based requirements that will be consistent with the NCSC’s cyber assessment framework, including requirements on board responsibility and governance, supply chain and incident reporting and recovery, as well as requirements around testing and exercising protective security. These proposals will be technology- and sector-agnostic, and take an all-hazards approach to ensure resilience in the face of an evolving threat landscape and emerging technologies. They reflect the requirement for regulated entities to have regard to state-of-the-art technology when assessing the risks they face.
On the question posed by the noble Lord, Lord Ravensdale, and others on post-quantum cryptography, and that posed by the noble Lord, Lord Birt, on quantum, these would be considered as part of that requirement by regulated entities, but would not necessarily be singled out as a specific technology in the regulation so that we keep these regulations up to date and matched to the cyber risks that individual entities face.
In addition to how the requirements in the Bill will capture board responsibilities, we recognise that board-level governance is essential to effective cyber risk management, which is why the Cyber Resilience Pledge sets out that making cyber a board responsibility is one of the three clear tangible actions that any organisation can make to boost its resilience. The Government’s forthcoming modernising corporate reporting consultation will seek views on whether the existing risk reporting framework produces sufficient reporting on cyber risk management as an additional step that could be considered.
On the questions about the Secretary of State reporting to Parliament at least every five years, this is a minimum baseline. Additional reports can be published if deemed appropriate.
The noble Earl, Lord Effingham, and the noble Lords, Lord Londesborough and Lord Ravensdale, asked about business burden and the definition of small businesses. We believe that this legislation is targeted and proportionate, only regulating where necessary to protect the most essential services on which we rely. That is why small and micro digital service providers are exempt from the regulations, unless designated as a critical supplier. Small businesses are defined as entities that employ up to 50 people and have an annual turnover or balance sheet of less than €10 million. They are exempt from being an RDSP or an RMSP under the Bill. They can be regulated only if they are designated as critical suppliers, for which there will be a high bar for designation.
My noble friend asked how we can support small businesses. This is a very important part of our approach. The NCSC provides support through the Cyber Action Toolkit and Cyber Essentials, which also includes cyber insurance for those who get the certification. For any organisation that experiences an incident, the Government’s Cyber Incident Signposting Service helps point them towards where the issue should be reported and where appropriate support can be sought.
Questions on regulator capacity and consistency were raised by the noble Lord, Lord Vaizey, and my noble friend Lady Alexander. The framework will drive consistency across sectors through these common security requirements and through the statement of strategic priorities, which will set the objectives that regulators must seek to achieve. Sector-specific guidance from regulators will also remain key to address sectoral nuances and risks, building on a common foundation of good practice.
Many noble Lords raised the importance of building out sovereign capability in the UK, and I note that the Government are committed to pursuing that. I am sure that we will have other opportunities to talk further about tech sovereignty in the coming week in Oral Questions and the forthcoming debate on that subject.
My noble friend Lady Paul of Shepherd’s Bush and the noble Lords, Lord Ashcombe and Lord Arbuthnot, discussed cyber insurance. It can absolutely play an important role as part of a wider approach to cyber resilience, particularly in helping organisations to manage the impacts of cyber resilience and to support recovery. We do not believe that cyber insurance is a replacement for cyber security, but it is definitely part of a wider suite of cyber measures.
Many noble Lords made points about skills, which are incredibly important. We are improving industry understanding of cyber security, we are investing in cyber skills through TechFirst, and we are working with the UK Cyber Security Council to develop professional standards to bring cyber security in line with professions such as engineering and accounting. I also heartily endorse the points made by the noble Lords, Lord Ravensdale and Lord Vaizey, about the strength of the cyber security industry and sector in this country. It is not only strong within this country; it is also exporting to many other parts of the world, building on our strengths.
I note that product security, which was mentioned by many today in the sense of building in requirements, is indeed a feature of our product security and telecoms infrastructure—or PSTI—regime, which is an important complement to what is in the Bill.
Finally, the noble Lord, Lord Clement-Jones, led the charge on the Computer Misuse Act. We highlighted in the King’s Speech that a Bill focused on national security will update that Act and provide law enforcement with the updated powers and capabilities, so they can remain effective in the digital age.
I, too, look forward to Committee. This is an incredibly important Bill. I welcome the high level of engagement from across the House tonight on the practicalities and the details.
This Bill is fundamentally about national security. It will deliver stronger protections against those who want to disrupt our way of life. It will do so with growth at the forefront, focusing first on support and partnership and regulating only where it is necessary. I thank noble Lords and look forward to the Bill’s next stages.
Baroness Lloyd of Effra
That the bill be committed to a Grand Committee, and that it be an instruction to the Grand Committee that they consider the bill in the following order:
Clauses 1 to 22, Schedule 1, Clause 23, Schedule 2, Clauses 24 to 61, Title.