Cyber Security and Resilience (Network and Information Systems) Bill

3rd reading
Monday 2nd November 2026 Lords Chamber

Third Reading

Northern Ireland, Scottish and Welsh legislative consent granted. Relevant documents: 3rd Report from the Constitution Committee, 7th and 11th Reports from the Delegated Powers and Regulatory Reform Committee.

15:35

Moved by

[Baroness Smith of Basildon]

That the Bill be now read a third time.

[The Lord Privy Seal (Baroness Smith of Basildon) (Lab)]

My Lords, I have it in command from His Majesty the King to acquaint the House that his Majesty, having been informed of the purport of the Cyber Security and Resilience (Network and Information Systems) Bill, has consented to place his interests, so far as they are affected by the Bill, at the disposal of Parliament for the purposes of the Bill.

Bill read a third time.

Clause 2: Overview of Act

Amendment 1

Moved by

[Baroness Lloyd of Effra]

1: Clause 2, page 1, line 10, leave out “centres” and insert “centre services”
Member’s explanatory statement
This amendment would improve the drafting by aligning the language in this provision with the language used elsewhere in the Bill.

[The Parliamentary Under-Secretary of State, Department for Business, Innovation, Science and Trade and Department for Digital, Culture, Media and Sport (Baroness Lloyd of Effra) (Lab)]

The amendments in this group seek to tighten the drafting for consistency and clarity, first, by amending Clause 2 to refer to “data centre services” rather than “data centres”; and, secondly, by amending Clauses 24, 36 and 42 to refer to Clause 30(5) when defining “regulated person”.

Amendment 1 agreed.

Clause 24: Key definitions in Part 3

Amendment 2

Moved by

[Baroness Lloyd of Effra]

2: Clause 24, page 53, line 39, at end insert “and (5)”
Member’s explanatory statement
This amendment and my amendments to Clauses 36 and 42 would add clarity by signposting Clause 30(5) which provides for persons to be treated as specified for the purposes of Clause 30(2). Such persons are included in the definition of “regulated person” in Chapters 3 and 4 of Part 3.

Amendment 2 agreed.

Clause 36: Supplementary provision and interpretation

Amendment 3

Moved by

[Baroness Lloyd of Effra]

3: Clause 36, page 65, line 13, at end insert “(and see also section 30(5))”
Member’s explanatory statement
See the explanatory statement to my amendment to Clause 24.

Amendment 3 agreed.

Clause 42: Regulations under section 24 or Chapter 3

Amendment 4

Moved by

[Baroness Lloyd of Effra]

4: Clause 42, page 68, line 26, after “section 30(2)” insert “(and see also section 30(5))”
Member’s explanatory statement
See the explanatory statement to my amendment to Clause 24.

Amendment 4 agreed.

15:37

Motion

Moved by

[Baroness Lloyd of Effra]

That the Bill do now pass.

[Lord Clement-Jones (LD)]

My Lords, as we reach Third Reading and the Bill goes back to the Commons, we need to take account of where the Bill now stands and the choices before us. With the successful passage of Amendment 163 on Report, this House has insisted on a vital regime-wide effectiveness review to address critical gaps in our cyber defences. The decision now rests squarely with the Government whether to engage in parliamentary ping-pong or accept this amendment as a sensible and constructive way forward.

Throughout our scrutiny, we must acknowledge the positive steps that the Government have made, including introducing provisions on high-risk vendors and strengthening incident reporting thresholds. As the Government’s own announcements last month on AI loss of control demonstrate, Ministers are finally waking up to the risks we have highlighted, but threats are moving too fast for half measures or delayed reviews.

I gather that we cannot now indulge in thanking colleagues on these and other Benches and outside organisations. All I can say is that you know who you are and I am grateful. I urge the House to support the “do now pass” Motion.

[Lord Alton of Liverpool (CB)]

My Lords, I will speak in support of what the noble Lord, Lord Clement-Jones, said to the House about the amendment that will now go to another place to be discussed during ping-pong. I simply ask the Minister—who, in the general context of the Bill, has been so helpful in so many respects—to look at the report published today by the Business, Innovation, Science and Trade Committee of another place, under the chairmanship of her right honourable friend Liam Byrne MP. It points particularly to the role of hostile states in this country, notably the People’s Republic of China. It bears very much on the amendment that your Lordships passed only last week, and I hope the Minister will take the trouble to have a look at it before we get into further discussion on the amendment.

[Baroness Neville-Jones (Con)]

My Lords, I thank the Minister for the good sense and clarity that she brought to the issue of the trigger for reportable incidents, which lies at the heart of this security and resilience Bill. We were not able to close the gap between us on the issue of factor lists for some operators, although we narrowed it, I think. I hope that, in the light of her acceptance of the relevance of some of the factors listed in my amendment, she will be able to make this an early issue for secondary legislation. The industry is extremely anxious to be well prepared, and it will be helpful if this issue, which is an important part of being prepared for the regulatory regime, can be dealt with at an early stage.

[Viscount Camrose (Con)]

My Lords, I thank the Minister for bringing forward today’s amendments, to which we had no objection as they are technical amendments. In this new spirit of brief “do now pass” debates, I will not raise any substantive points, except to join others in thanking the Minister for her collaborative, consultative, and very open and thorough approach throughout the passage of the Bill thus far. As and when it comes back to your Lordships’ House, we look forward to continuing the debate in the same spirit. Meanwhile, I thank the Minister and all noble Lords who participated so well in the Bill’s productive passage so far.

[Baroness Lloyd of Effra (Lab)]

My Lords, I did not intend to make a substantive contribution, as the Government Front Bench intends to proceed in line with the Companion guidance, recently reinforced by this House through the first report from the Procedure Committee, that the “do now pass” Motion is usually moved formally. I have noted the points made by the noble Lords, Lord Alton and Lord Clement-Jones, the noble Baroness, Lady Neville-Jones, and the noble Viscount, Lord Camrose, relating to the substance of the Bill, which I am sure we will return to. I am very grateful for the engagement on the Bill, which will increase the UK’s defences against cyber attacks, better protecting the services that the public rely on to go about their normal lives.

15:42

Bill passed and returned to the Commons with amendments.