Cyber Security and Resilience (Network and Information Systems) Bill (Carry-over Extension)

Ian Murray Excerpts

Carry-over motion
Wednesday 4th November 2026 Commons Chamber

[The Minister for Creative Industries, Media and Online Safety (Ian Murray)]

I beg to move,

That the period on the expiry of which proceedings on the Cyber Security and Resilience (Network and Information Systems) Bill shall lapse in pursuance of paragraph (13) of Standing Order No. 80A shall be extended, so that the period expires at the end of 29 April 2027 rather than at the end of 11 November 2026.

The UK is subject to daily and unrelenting cyber-attacks, as cyber-criminals and state-linked actors blackmail businesses, steal data and threaten our very way of life. As our lives become increasingly digital, the threat comes not only from hostile actors, but from weaknesses in the resilience of our systems. We must defend against both and focus our attention where it matters most.

Although all businesses should secure themselves against cyber-attack using the National Cyber Security Centre’s free toolkits, it is right that we do not over-regulate every business. That is why the Bill is targeted at our most essential and critical services, relating to drinking water, health, transport, energy and the digital services that keep our economy running. If these services were disrupted, we would have nowhere else to turn. The Bill safeguards those services and, in turn, protects the individuals and businesses that rely on them. That is the priority of this Government.

We will not hesitate to take action when hostile actors seek to do us harm. The Bill delivers a step change in national security and equips the Government with the powers to act decisively on threat intelligence. This Government have gone further still; we have tabled amendments to introduce a new vendor risk management framework, which will assist businesses in reviewing their supply chains and working with the Government to mitigate those risks, and it will, if necessary, enable Government to step in and instruct organisations to take action.

This week, the Bill re-entered the House after completing Third Reading in the other place on Monday 2 November. I pay tribute to the Minister, the noble Baroness Lloyd, as well as Members of this House and the other place for engaging so constructively throughout the Bill’s passage. In many instances, the contributions have refined the Bill and made it more robust. I know that hon. Members will continue this constructive dialogue in their consideration of Lords amendments, and will pass a Bill that is fit to deal with the cyber-threats that we face now and in future.

[Madam Deputy Speaker (Ms Nusrat Ghani)]

I call the Liberal Democrat spokesperson.

--- Later in debate ---

[Ian Murray]

I welcome the comments made by the Liberal Democrat spokesperson on this incredibly serious issue and look forward to her bringing them back when we actually have the debate, beyond this carry-over motion. I hope she will support the carry-over motion so she can make her speech again.

My hon. Friend the Member for Halesowen (Alex Ballinger) mentioned JLR and other high profile issues of a serious nature. That allows me to briefly give a big message to all businesses in the country that cyber-security is also their responsibility—it should be in every boardroom, at the top of every agenda, to ensure we are not having those incidents. As my hon. Friend, said prevention is better than cure. The National Cyber Security Centre has all the free tools available, so I encourage every single business—micro, small, medium and large—to use those tools to ensure they are as secure as they possibly can be. Of course, we cannot stop all cyber-attacks being successful, but we can minimise the risk as much as possible and make sure that it is everyone’s responsibility.

[David Chadwick (Brecon, Radnor and Cwm Tawe) (LD)]

During the evidence collection process, lots of experts from the cyber-security sector called for board accountability to be reintroduced into the Bill, as it is in similar legislation in the European Union. Will he give us his thoughts on why that has not been included?

[Ian Murray]

The Liberal Democrat spokesperson mentioned the same European Union regulations. We need to do what is in the best interests of businesses in the United Kingdom. The message is pretty clear that all businesses must have cyber-security at the top of their agenda—it should be in every boardroom and we keep encouraging them to do so.

[Chris Vince (Harlow) (Lab/Co-op)]

Madam Deputy Speaker, you missed out on me making a very long speech, so you are very lucky. Will the Minister briefly touch on what liability there will be for frontier model providers, such as OpenAI, who breach their duties, for example I am thinking of the Hugging Face incident in July 2026?

[Ian Murray]

My hon. Friend from Harlow—I am surprised he did not mention Harlow in his contribution, so I thought I had better put it on the record or otherwise he will be struck out—makes a good point. However, we can also see that AI provides a good solution to this problem. Because of the PHP incidents in the past few weeks, we have identified that there were holes in that particular system and then those holes were patched and plugged, so while AI is a big cyber-security problem, it is also a big part of the solution. This Bill is here to give us better cyber-security and better resilience across all our economy.

Question put and agreed to.