Cyber Security and Resilience (Network and Information Systems) Bill

Lord Londesborough Excerpts

2nd reading
Tuesday 14th July 2026 Lords Chamber

[Lord Londesborough (CB)]

My Lords, it is getting late, and I am told that we are now competing with the Spain v France World Cup semi-final—the winner may well face England in the final—so I will try to be brief. I speak not as a cyber expert or technologist but as a former CEO of a tech-enabled mid-sized business. I want to bring some ground-level perspectives of these oft-mentioned SMEs, one of which I currently chair.

I welcome the Bill, but like many others, I have some concerns over its scope, its impact on those apparently outside the scope but who sit within critical infrastructure supply chains, the challenges of a horizontal piece of legislation being layered over multiple sectors and their regulators, and why, as so many people have asked, there is no specific strategy for AI. All of that has been covered, and I will not repeat those points. However, I want to question why central government and local authorities will remain out of scope. The National Audit Office’s report last year found serious slow-to-fix security flaws across 58 of the 72 government systems that were reviewed. The public sector badly needs binding legal requirements, not just a voluntary action plan.

As we have heard, the UK is already the most targeted country in Europe for cyber attacks, with more than 40% of UK businesses experiencing such attacks at a cost put at almost £15 billion annually. But those numbers are almost certainly an underestimate not just because they apply to 2024 but because a whole range of cyber incidents go unreported and therefore unmeasured, especially in the world of SMEs. In fact, 96% of UK businesses that suffered a cyber attack were SMEs, not because they are targeted but because they are easier to breach. If you factored in all the incidents and took into account all the costs, including the distraction from core business, the real cost this year might well be closer to £30 billion—roughly 1% of our GDP.

Let us face it: when this Bill is enacted, it will already be out of date. That is not an argument for delay, but it is an argument for shaping legislation to allow changes and add-ons down the line as the threats change without going through the long and arduous processes of legislating through both Houses of Parliament. I suggest that we are pragmatic and that we balance the need for parliamentary scrutiny and consultation with speed and agility.

I am going to finish by focusing on the mid-market and small businesses. The Bill tells us that high impact suppliers of any size could be designated as critical suppliers. That has raised quite a few question marks. Two-thirds of medium-sized UK businesses reported a cyber breach last year alone, yet only 15% of those businesses had formally reviewed the cyber risks that their immediate suppliers posed to them. This Bill will make mid-market players take compliance, incident reporting, risk assessments and audits more seriously. Those should no longer be seen as the sole responsibility of the IT department or the CTO but become a board- level issue that CEOs need to engage with. Currently, only 27% of UK businesses have board-level cyber accountability. That needs to change.

It is confession time. I was once one of those mid-market CEOs who took too little interest at board level in the risks to our company’s infrastructure and systems, delegating them to mid-management and our offshore partners and nearly paying the price when our online platform, which contained all our customer data and 20 years of content, came under attack and was very nearly successfully hacked. Lessons were quickly learned. Will the Minister say how the Government plan to address and resource the information, communication and training challenge that this Bill will present to mid-market players?

I raise the same question for those SMEs that will get dragged into supply chain compliance issues, whatever their size, but without the specialist resources needed. In the other place, the Liberal Democrats proposed what I thought was a very sensible amendment for the establishment of a cyber security support service to help SMEs comply with their regulatory duties. This was dismissed by the Minister, who said that very few SMEs would be in scope, but nobody has put a number to this and I think this misses the point. I fear that the Government underestimate this challenge, both for mid-market and small players.

If this information, resource, communication and education piece is not properly addressed, we will not just lose links in the supplier chain but reduce the level of competition. This will be bad for business and economic growth and, indeed, for trade with our European neighbours, who are way ahead of us in this area.

Civil Service: Artificial Intelligence Productivity Gains

Lord Londesborough Excerpts

Monday 1st September 2025 Lords Chamber

[Lord Vallance of Balham (Lab)]

I thank the noble Lord for his question. I have a full Question on sovereign AI on Wednesday, when I will answer that question in more detail, but in the meantime let me say that there is not a some inbuilt bias against that; it is just that many of the large language models are, of course, from US companies, and those are the ones that are available at the moment. However, the sovereign AI unit will use that £500 million specifically to stimulate UK companies as well.

[Lord Londesborough (CB)]

My Lords—

[Lord Anderson of Ipswich (CB)]

My Lords—

[Captain of the Honourable Corps of Gentlemen-at-Arms and Chief Whip (Lord Kennedy of Southwark) (Lab Co-op)]

My Lords, we have time to hear from the Cross Benches.

[Lord Londesborough (CB)]

My Lords, while the results from the landmark Civil Service AI trial are clearly encouraging, does the Minister agree that it highlights the urgent need to train up public sector workers across all departments on the effective and appropriate use of generative AI? I suggest that such training and guidance apply in particular to us—by which I mean noble Lords on all sides of this Chamber.

[Lord Vallance of Balham (Lab)]

It was interesting to see the report from MIT last week on the use of AI across companies, which noted that 95% of companies got very little benefit and 5% got massively disproportionate benefit. One of the reasons why you get much greater benefit is training people properly and allowing there to be proper disruption of existing workflows—so I completely agree with the question. What the noble Lord is talking about is an important part of this, which is why there is a series of schemes across the Civil Service, including the senior Civil Service, both to recruit people with AI skills and to train staff.

King’s Speech (4th Day)

Lord Londesborough Excerpts

Monday 22nd July 2024 Lords Chamber

[Lord Londesborough (CB)]

My Lords, this may be my last opportunity to speak in a debate on the King’s Speech, given one Bill coming our way on which I will refrain from comment tonight. I will focus on Labour’s key mission of generating the highest sustained economic growth in the G7, with

“productivity growth in every part of the country”.

I am eagerly awaiting a strategy for productivity that matches that ambitious statement. If you try googling the term “UK productivity”, the next suggested word that pops up is “problem”, followed by “puzzle”. That sums it up rather well. Put bluntly, we have developed some bad habits. We produce too little, consume too much and borrow heavily to finance our deficits, with our national debt fast approaching £3 trillion. That is very bad news for an ageing population with a shrinking workforce. The critical measure, GDP per capita, has barely moved since the financial crisis, while our labour productivity, as we have heard, remains below that of the US, France and Germany and, importantly, has been so for decades.

Stagnant productivity does not just take growth; it blunts our competitive edge overseas—witness the last five years of declining exports. In business, it generally leads to zombie companies, distress takeovers or, worse, bankruptcy. My own experience of productivity stems from 30 years as an entrepreneur in the information space and 10 years advising and investing in start-ups and scale-ups. Indeed, my livelihood depended on the productivity of my staff, both here in the UK and overseas. Over those years I discovered that productivity is not just structural; it is cultural. It is crucial that in the UK we create a performance culture that runs across both public and private sector workforces. This requires leadership, smart management, astute recruitment, and relevant skills and training. Above all, it requires proper incentivisation of our workforce, rewarding performance and developing a stakeholder culture.

The UK has much to learn in this regard from the US and many countries across to Asia-Pacific, all of which are growing considerably faster than we are. I suggest that boosting productivity requires explicit targets rather than lofty mission statements. Why not be bold and set a GDP growth target of 3% per annum for the next five years? To achieve that, we would probably need to improve our worker productivity by 2% every year—not impossible if we set our minds to it and hold ourselves accountable.

I have yet to mention the classic drivers of productivity: higher levels of public and private investment, upgrading infrastructure, education, innovation and technology. All are highly relevant but mainly long-term projects, with a five to 25-year payback that requires huge levels of funding. The problem is that we have an immediate need to mind the productivity gap, and time is not on our side.

Time is not on my side either, so I will conclude by welcoming both Ministers to their new roles and asking them, as I did their predecessors, whether the Government will consider setting up a productivity council on a statutory footing that is permanent and not subject to political churn. This body would inform, co-ordinate, measure and evaluate policies that impact on private and public sector productivity across all departments. Its members, critically, would have had first-hand experience not only of what drives productivity but of what it takes to stick to targeted long-term measures.

Advanced Artificial Intelligence

Lord Londesborough Excerpts

Monday 24th July 2023 Lords Chamber

[Lord Londesborough (CB)]

My Lords, first, I salute my noble friend Lord Ravensdale for securing this much-overdue debate. AI is a huge and challenging subject, so my focus today will be limited to its potential economic impact. I refer to my interests as set out in the register as an adviser and investor in start-ups and early-stage ventures.

I must confess that, like the noble Viscount, Lord Colville, I was briefly tempted to outsource my AI speech to a chatbot to see if anybody noticed. I tested two large language models; within seconds, both delivered 500-word speeches, which were credible if somewhat generic. AGI—artificial general intelligence —will soon be able to write my speeches in my personal style, having scraped Hansard, and deliver it in my voice through natural language understanding, having analysed and processed my speeches on parliamentlive.tv, and with no hesitation, repetition or deviation.

Is it an exciting or alarming prospect that your Lordships might one day be replaced by “Peerbots” with deeper knowledge, higher productivity and lower running costs? This is the prospect for perhaps as many as 5 million workers in the UK over the next 10 years. That said, the UK economy is in dire need of AI to address low productivity and growth, and critical capacity constraints, most notably our workforce. The economy model of adding millions of low-skilled jobs, or making people work longer hours, is not sustainable. We have an ageing population, a shrinking workforce, record numbers of long-term sick and a health sector in perpetual crisis with unprecedented waiting lists. We need a qualitative, not quantitative, approach to economic growth and AI could play a critical role.

The UK’s productivity has been in the doldrums for almost 20 years, with output per hour well down on the levels in Germany, France, the US and many other countries. Forecasts on the economic impact of AI vary wildly, with some forecasting 20% to 30% rises in productivity, set against the disappearance of up to 30% of jobs. It is educated guesswork at this stage. Some predict that AI will lift GDP growth by an additional, but hugely significant, 2% per annum. A word of warning: we had similar expectations with the digital revolution. If you look back over the last 25 years, we have indeed witnessed extraordinary changes both as workers and consumers: the smartphone, e-commerce, automation, video communications, contactless payments, and working from home. However, in the decade leading to the pandemic, when GDP growth averaged a modest 1.8% per annum, 1.2% of that growth came from working longer hours, 0.5% came from capital investment and just 0.1% came from innovation and better working practices.

While AI looks set to have a transformative impact on our working practices, as the digital world has done, the big question remains over the net impact on economic growth. As with the digital economy, the risk is that AI may ultimately lead to a few dominant tech giants with huge market share, and further skew the distribution of wealth.

I appreciate that this will be a global dynamic largely beyond the control of our Government, but I conclude by asking the Minister two questions. First, how will the Government nurture a multiplicity of AI players in the UK rather than a dominant few? Secondly, mindful of the recent cuts in R&D tax credits in this year’s Budget, how will SMEs be incentivised to adopt and invest in AI technology to boost their productivity and competitive edge?