Cyber Security and Resilience (Network and Information Systems) Bill

Baroness Foster of Aghadrumsee Excerpts

Committee stage
Tuesday 1st September 2026 Grand Committee

[Lord Holmes of Richmond (Con)]

My Lords, it is a pleasure to support all the amendments in this group. In one set of amendments in Committee, we have more on AI than in not just the cyber Bill but across most government legislation—past, present and, tragically, probably largely future.

As has already been mentioned and was covered, widely and rightly, at Second Reading, there is a huge gaping hole at the centre of this Bill, a silence that booms around the entire Bill, and that is all things AI. It seems unfortunate that we were told at Second Reading, and probably will be today, that the Bill is not the place for AI. Well, maybe it is not, but it certainly is in that no previous opportunities have been taken. As was mentioned, there was one line in the 2024 King’s Speech: something around frontier models with AI. There have been various other nods and winks. There was a Bill potentially ready to go at the end of autumn 2024; nothing came, and still we have nothing. So now we have a cyber Bill. It would be extraordinary if the Bill did not not only consider AI but have the thread of AI running right through it. What is behind so many of the difficulties, the clear, present and real dangers that the Minister has set out? Well, it may be said to be cyber at the front end, but AI is the grunt, brute force driving so much of this, and that is what all the amendments in this group speak to.

The noble Lord, Lord Tarassenko, was right to highlight the excellent work of AISI, but again, as we have seen with previous regulators, for want of proper action when it comes to AI, and indeed other technologies, numerous Governments have just piled on more and more requirements and obligations on various regulators, as if somehow they are going to be able to manage this. This is what we are already seeing with AISI. AISI is world-renowned and rightly respected, but it is already being asked to do an increasing number of tasks without the statutory footing or the resourcing to enable it to continue to do that at world class and at the leading edge. When the Minister comes to respond, I would be very interested if she would update the Committee on how she sees the role of AISI going forward. It is in the right position and is perfectly formed for the task, but statutory underpinning and resourcing would make such a significant difference.

If the Government fail to accept these amendments, or indeed, if they so prefer, fail to bring forward amendments of their own, we will have a very narrow and specific piece of cyber legislation. It will be good in that it is the first piece of legislation to have “Cyber” in its title—good in so far as that goes—but it is unfortunate that the legislation sees not only cyber but technology through the view, which has largely washed across from the United States, that it is all about big players, as if AI were only about these LLMs, or frontier models or whatever nomenclature one chooses. “The journey of AI has been up to this point; this is the zenith and the focus should be on these large so-called AI models.” Not a bit of it—they are but one element of a far more complex constellation.

Taking a broader view would enable the Government not only to have the right thread of AI running through the Bill but to be far more UK-focused and context rich, and it would put AI in the Bill in a way which would enable adaptability and agility going forward, rather than potentially trapping ourselves with one specific view of AI or leaving ourselves at the will of all these organisations, individuals and entities that use various AI to attack us. With no or little AI, or only euphemistic nods and winks to it, throughout the Bill, I believe we need to have a rewrite of the entire Bill. This group of amendments is a very good start in that direction.

[Baroness Foster of Aghadrumsee (Non-Afl)]

My Lords, I will briefly speak to the amendments from the point of view of anti-terrorism and national security. I do so with trepidation, having listened to the wonderful speeches that have been made thus far.

I find it difficult to understand why there is an unwillingness to give the clarity that has been requested in this group of amendments, particularly on AI models. I note that the Minister, in response to the first group of amendments, said that AI could be in scope. Would it not be much clearer for all concerned if AI was specifically in scope? Ethically speaking—and this follows on from the noble Baroness, Lady Harding—I would have much preferred it if we had had a royal commission look at AI and say, “Here are the guardrails for the development of AI”, but for some unknown reason we are either unwilling or unable to do that as a nation. In its absence, Amendment 75 is very important because, from a national security point of view, we should adopt the precautionary principle. We live in very dangerous times. We have listened to experts such as Jonathan Hall KC say very clearly that we need to take it into account. I say to the Minister that it would be helpful to hear from the Government how they intend to deal with AI as it moves forward and gets bigger and bigger. Surely we should have that ethical and moral conversation about where the guardrails are.

[Baroness Freeman of Steventon (CB)]

My Lords, I will briefly add my support to the amendments in this group, particularly the “red lines” amendment and the “last resort” amendment. Nobody who has read the report on the Hugging Face incident can fail to think that we need legislation now to deal with these kinds of events. The incident showed unintended co-operation between agents that discussed among themselves whether individual actions were ethical. They were referring to their own ethical guidelines and none of the agents then flagged to their human supervisors what was going on. You can see the training and programming behind these agents: they have some ethical guidelines in there, but those guidelines are in the gift of the companies that train them. We must have more control and oversight over that sort of behaviour, because you can see its consequences. This was an unintended consequence; obviously, there could be intended consequences as well. This legislation is our only opportunity now, and we need to take it because this is not the future; it is the present.