Asked by: Chi Onwurah (Labour - Newcastle upon Tyne Central and West)
Question
To ask the Secretary of State for Digital, Culture, Media and Sport, whether her Department has or has had any role in a) approving and b) monitoring the new HMRC enterprise customer relationship management system.
Answered by Stephanie Peacock - Parliamentary Under-Secretary of State (Department for Digital, Culture, Media and Sport)
This is a matter for HM Revenue and Customs (HMRC), which is accountable to HM Treasury. The Enterprise Customer Relationship Management (ECRM) programme’s business case was approved internally by HMRC in March 2026 and progressed through the HM Treasury approval process in April 2026. Government Digital Service provided digital assurance on the programme and continues to engage with HMRC, including monitoring progress through programme governance.
Asked by: Chi Onwurah (Labour - Newcastle upon Tyne Central and West)
Question to the Department for Business, Innovation, Science and Trade:
To ask the Secretary of State for Business, Innovation, Science and Trade, if he will make an assessment of the likelihood of software as a service being a leading technology in 15 years time.
Answered by Chris McDonald - Minister of State (Department of Health and Social Care)
The Government does not plan to make a specific assessment of the long-term prospects of individual commercial models such as software as a service. The Department monitors developments in software and AI markets through existing horizon-scanning work, including the Government Office for Science's emerging technology programme.
Asked by: Chi Onwurah (Labour - Newcastle upon Tyne Central and West)
Question to the HM Treasury:
To ask the Chancellor of the Exchequer, if he will set out further details on the Data Centre Compact in the Budget.
Answered by Dan Tomlinson - Exchequer Secretary (Cabinet Office) (Jointly with HM Treasury)
At Budget, Government published the Data Centre Covenant which establishes five tests: lowering electricity bills, investing to improve communities, meeting environmental standards, reindustrialising Britain, and strengthening UK sovereignty. All data centres are encouraged to meet these expectations, and strategically important projects seeking enhanced government support will be required to meet them.
In return for meeting these tests, the Government will establish a new Ministerial Control Centre to consider supportive action. It will be chaired by the Minister for AI, supported by the Exchequer Secretary to the Treasury and relevant ministers from the Department for Energy Security and Net Zero and other departments. It will consider action to accelerate time to power and speed up the planning process for strategically important projects. The Department for Business, Innovation, Science and Trade are developing a framework for assessing strategically important projects. Further details will be set out in due course.
Asked by: Chi Onwurah (Labour - Newcastle upon Tyne Central and West)
Question
To ask the Secretary of State for Digital, Culture, Media and Sport, whether UK commercial fridges were affected by recent cyber attacks; and what standards, security and reporting requirements are in place to protect commercial fridges.
Answered by Ian Murray - Minister of State (Department for Digital, Culture, Media and Sport)
We are aware of a small number of UK organisations that were affected by the recent cyber attacks, although the impact in the UK remains limited. The National Cyber Security Centre (NCSC) alerted other potentially affected organisations in the UK, enabling them to take appropriate protective action, and continues to support organisations affected by the cyber activity. The Government continues to liaise with international partners and affected sectors to understand and mitigate the impact
Some of the affected devices had known vulnerabilities, and the NCSC continues to highlight the wider risks associated with enterprise and operational technology being directly exposed to the internet (Disruptive cyber activity highlights risk from internet-exposed systems and edge devices). Several organisations, including large supermarkets, were already following NCSC guidance not to expose refrigeration devices directly to the internet, reducing their exposure to this activity. Guidance on the secure deployment of operational technology is provided by the NCSC (Operational Technology), alongside clear messaging on the risks of using internet exposed technology that is inadequately protected or running out of date software.
In the budget on 28 October 2026 the Government announced we will consult next year on how to tackle insecure technology at source and consider where liability for cyber breaches should sit.
Asked by: Chi Onwurah (Labour - Newcastle upon Tyne Central and West)
Question
To ask the Secretary of State for Digital, Culture, Media and Sport, whether the vulnerability exploited in the recent cyber attack on commercial fridges is known.
Answered by Ian Murray - Minister of State (Department for Digital, Culture, Media and Sport)
We are aware of a small number of UK organisations that were affected by the recent cyber attacks, although the impact in the UK remains limited. The National Cyber Security Centre (NCSC) alerted other potentially affected organisations in the UK, enabling them to take appropriate protective action, and continues to support organisations affected by the cyber activity. The Government continues to liaise with international partners and affected sectors to understand and mitigate the impact
Some of the affected devices had known vulnerabilities, and the NCSC continues to highlight the wider risks associated with enterprise and operational technology being directly exposed to the internet (Disruptive cyber activity highlights risk from internet-exposed systems and edge devices). Several organisations, including large supermarkets, were already following NCSC guidance not to expose refrigeration devices directly to the internet, reducing their exposure to this activity. Guidance on the secure deployment of operational technology is provided by the NCSC (Operational Technology), alongside clear messaging on the risks of using internet exposed technology that is inadequately protected or running out of date software.
In the budget on 28 October 2026 the Government announced we will consult next year on how to tackle insecure technology at source and consider where liability for cyber breaches should sit.
Asked by: Chi Onwurah (Labour - Newcastle upon Tyne Central and West)
Question to the HM Treasury:
To ask the Chancellor of the Exchequer, whether the ECRM business case takes account of levels of software costs over the next 15 years.
Answered by James Murray - Financial Secretary to the Treasury and Paymaster General
The ECRM business case includes estimated costs for the Software as a Service platform as part of its whole lifecycle costs for up to 15 years. These costs remain indicative and will be refined as the programme progresses. Expenditure will be committed incrementally, with future investment decisions subject to ongoing value for money assessments, assurance and business case approvals.
Asked by: Chi Onwurah (Labour - Newcastle upon Tyne Central and West)
Question to the Home Office:
To ask the Secretary of State for the Home Department, with reference to her answer to me during the Statement to the House on 2nd November on earned settlement, whether early career researchers and postdocs will be considered as part of the education sector for the purposes of settlement.
Answered by Jo White - Parliamentary Under-Secretary (Home Office)
On 2 November 2026, the Home Secretary announced the Government’s final approach to earned settlement, following a 12-week public consultation which received more than 200,000 responses. The new framework will ensure that the time it takes to qualify for settlement reflects an individual’s character, contribution, integration and residence.
The Government recognises the important contribution made by early career researchers and postdoctoral researchers to the UK’s science and research base. Under the final model, the five-year pathway for public service workers in health and education will apply to specified occupations in healthcare and education, in line with the approach taken by the Migration Advisory Committee. Eligibility will therefore depend on the occupation in which an individual is employed, rather than employment in the education sector alone. The qualifying occupations are listed in Annex C of the government’s response to the consultation, which is available here: A Fairer Pathway to Settlement: Government response to the consultation.
We remain committed to publishing economic and equality impact assessments ahead of implementation. We will also publish further guidance setting out additional technical and operational detail, informed by continued engagement with affected groups and stakeholders.
Asked by: Chi Onwurah (Labour - Newcastle upon Tyne Central and West)
Question to the HM Treasury:
To ask the Chancellor of the Exchequer, whether his Department considered a) using AI and b) developing sovereign capability as part of its development of its Enterprise Customer Relationship Management Programme (ECRM): Summary Business Case.
Answered by James Murray - Financial Secretary to the Treasury and Paymaster General
I would refer the Honourable member to the published summary business case and Accounting Officer Assessment for the Enterprise Customer Relationship Management programme. These set out the options considered and the recommended option for a flexible, scalable and future AI-enabled solution.
Sovereignty was built into the ECRM procurement requirements from the outset, alongside robust requirements for security, resilience, data protection and control of HMRC data, ensuring the solution meets HMRC’s requirements for protecting sensitive taxpayer information and maintaining appropriate operational control.
Asked by: Chi Onwurah (Labour - Newcastle upon Tyne Central and West)
Question to the HM Treasury:
To ask the Chancellor of the Exchequer, whether his Department has or has had any role in a) approving and b) monitoring the new HMRC enterprise customer relationship management system.
Answered by Emma Reynolds - Chief Secretary to the Treasury
HMRC’s Enterprise Customer Relationship Management (ECRM) Programme business case was approved by HM Treasury in April 2026, supported by Cabinet Office and Government Digital Service functional assurance, in line with usual process.
ECRM forms part of the Government Major Projects Portfolio and remains subject to external oversight. An independent March 2026 review provided an Amber delivery confidence assessment.
Asked by: Chi Onwurah (Labour - Newcastle upon Tyne Central and West)
Question to the HM Treasury:
To ask the Chancellor of the Exchequer, what other departments will be impacted by the Department's funding for its Enterprise Customer Relationship Management Programme system.
Answered by Emma Reynolds - Chief Secretary to the Treasury
The 2025 Spending Review settlement provides HMRC with the investment to modernise its customer management capabilities and to deliver its transformation plan. Funding for the ECRM Programme is being met from HMRC's settlement and does not change the Spending Review settlements of other government departments. HMRC will continue to share learning and insights from this programme with other government departments.