Cyber Security and Resilience (Network and Information Systems) Bill

Lord Holmes of Richmond Excerpts

2nd reading
Tuesday 14th July 2026 Lords Chamber

[Lord Holmes of Richmond (Con)]

My Lords, it is a pleasure to take part in this Second Reading debate and to follow my friend, the noble Viscount, Lord Colville of Culross. Though he, by his own words, repeated some of the earlier points, he was the first speaker to say “lacunae”, for which I am particularly grateful; it sounds like a technology company. I declare my technology interests as set out in the register, as advisor variously to the Crown Estate and to Simmons & Simmons LLP.

As has been noted, this Bill is significant by having “cyber” in the title. This is long overdue, much needed and critical, as the Minister said, taking a cross-sector approach to cyber. Yet the first interesting point is that the Bill does not do that. Most notably, it is extraordinary that neither food nor space are included in the Bill. Similarly, it is said to take a cross-economy approach, yet it does not. However, it is worth mentioning the two sides of that economic coin and the huge economic growth potential from our cyber industries. I echo all the points that have been made about the need for skills and education, and to enable the cyber sector to grow and deliver that economic benefit.

Reporting has been mentioned widely throughout the debate. It is unfortunate if one finds themselves in a situation such as that of my noble friend Lady Harding, with multiple agencies to have to report to. Surely it would make sense to have a single reporting point for the speed, efficiency and effectiveness of that reporting system. Similarly, there is so much opacity around many of the definitions within the Bill. I pull out “significant impact” as one of them. What does this mean? If it stays as set out, the natural and understandable response from business is to go for the low-level mass reporting to avoid regulatory intervention. Does that enable the economy and the country to be better protected in this respect? I think not.

Similarly, the 24-hour and 72-hour reporting requirements feel oddly constructed around the artificial concept of a day set out in 24 hours. When one considers the real-time velocity of these attacks, it would seem logical that something way ahead of 24 hours would be advantageous at that stage and potentially something extending beyond 72 hours to do the second bit of the reporting process. What evidence is there to support this quite arbitrary 24 hours—or, as otherwise described, a day?

Security and resilience are the concepts most central to the Bill and will be the markers of its success or otherwise. For issues around proportionality and the ability to evolve and develop, does the current structure of the Bill really optimise this? MSPs have already rightly been mentioned. The burden for them is overbearing as currently set out. Surely it would make more sense to have a concept around what is reasonable for MSPs to oversee, what can legitimately be seen as within their control and how they can evidence that.

Understandably, the multiple regulator issue has been well discussed. It is critical, because how will we have co-ordination across all those organisations? A forum is certainly not the solution, as my noble friend Lady Harding rightly set out. A lead regulator, a single regulator or something around that has to be the way to go. I would argue that the NCSC should have the loudest voice in determining what is the best model and the best structure for doing that.

I was interested in the Minister’s introduction. She talked about the criticality of cross-sector consistency. I agree entirely, but in a debate on AI on 4 June in Grand Committee, she argued that consistency was not necessarily a central principle for the Government in the regulation of AI. I believe that a true cross-sector approach to cyber makes sense in this Bill. We can add to what is currently there and make that happen, but it is surely logical, and indeed a consistent approach to consistency, that we take that approach with AI. Can the Minister say why, if this argument is good for cyber, it is not good for AI—with a cross-sector approach, as will benefit this Bill, that is principles based and outcomes focused, with inputs understood?

I have another point on consistency. When the Minister sums up, can she set out the advantages that she sees in all the divergences that the Government have taken from the EU’s NIS2? I would be interested to hear the Government’s arguments for the advantages that they are seeking to bring from that.

My noble friend Lord Arbuthnot has rightly mentioned the CMA, and I know that my friend, the noble Lord, Lord Clement-Jones, will also mention this. It is right to mention it in this Bill, even though the national security Bill is said to be the vehicle through which this will come forward. It is right to give it a run around the track in the legislative process with this Bill, because we are talking about coverage currently holding our cyber professionals back because of a 1990 statute. To give some sense of what that means, in 1990 it had been only 24 years since England had won the World Cup. It is in urgent need of reform. We need to empower and enable our great cyber security professionals to do their job.

I have a quick point on DVS. I am not sure the Minister was involved when we did the Data (Use and Access) Act, but there was rightly a lot of discussion around DVS. In some ways, parts of this Bill are the other side of that coin. Currently we have a situation that is not addressed in the Data (Use and Access) Act or in this Bill: what happens to verification services when they have an attack where synthetic data is injected directly into the data stream, in effect bypassing the camera to get verification? How does this Bill address that issue? Do Clause 12, the potential regulations under Clause 30 or the guidance under Clause 36 address this? If not, what is the Minister’s view as to how we address that critical issue around synthetics?

The success of the Bill and of cyber in the UK will rest so heavily on the shoulders of our cyber security professionals, the women and men who do so much to keep our system—and, through that, us—safe. We owe them so much. Understandably, they often do this in the shadows, in dark rooms and in the Doughnut. We give them our sincere thanks, and we must demonstrate that thanks through the amendments we bring forward to make the Bill better.

Cyber Security and Resilience (Network and Information Systems) Bill

Lord Holmes of Richmond Excerpts

Committee stage
Tuesday 1st September 2026 Grand Committee

[Lord Clement-Jones (LD)]

My Lords, I assume that there are no Back-Bench contributions at this point, so I will speak on behalf of the Liberal Democrats to this very significant group of amendments tabled by the Minister as recently as 24 August. I thank her for her introduction today and for her brief meeting shortly after their tabling.

At the outset, from these Benches we express our strong concern about the timing and the sheer scale of the Government’s package of new amendments. To drop 65 amendments of this nature on the eve of Committee, which will completely reshape the architecture of this Bill, after its passage through the Commons, is a major challenge to effective parliamentary scrutiny. The Minister’s letter, also dated 24 August, came alongside these 65 new amendments, so we have had very little time to consider them. As far as I can see, a full Ministerial Statement did not accompany them; we had to rely on the coverage of Computer Weekly to understand the Government’s motives.

The Government have quietly established a major parallel high-risk vendor regime. Under Amendments 102 and 103, the Secretary of State—and now, crucially, under Amendment 101, the Chancellor of the Duchy of Lancaster—are granted unilateral powers to issue vendor-related directions. They can legally order an organisation to prohibit, restrict, remove, disable or modify any software, hardware or digital facility supplied by a designated high-risk vendor. Furthermore, under Amendment 105 they are given the power to establish a mandatory referral scheme, legally forcing companies to submit technology procurement contracts to the Cabinet Office for security clearance before signing.

Let us look closely at the operational mechanism in Amendment 103, which ISC2 has rightly highlighted. The proposed new clause mandates that a company appoints a “skilled person” to oversee compliance and, under subsection (5) of the proposed new clause, permits the Secretary of State to rely on a list of persons published by GCHQ. I ask the Minister: what is this list? Is it public or classified? What objective criteria will govern inclusion? How will conflicts of interest be avoided, and how will independent professional competence be assured? To create statutory compliance roles backed by secret lists is entirely unacceptable.

Under Amendment 108, the Secretary of State can make regulations bringing any specific company into the scope of the Clause 43 directions without bringing them into the NIS regulations as a whole. Under Amendment 127, the Government will insert an emergency “made affirmative” procedure allowing regulations and vendor bans to take effect immediately without prior parliamentary debate. Furthermore, under Amendment 148 the Secretary of State can prohibit a company disclosing that they have received a direction or are in consultation, backed by civil penalties of up to £10 million or £50,000 per day.

There is also a second critical implication—the backdoor regulation of advanced artificial intelligence systems. At Second Reading, the Minister assured the House that advanced AI systems and LLMs were out of scope. These amendments appear to reverse that position. Under Amendment 108, any entity providing essential goods or services can be specified. As our critical infrastructure increasingly integrates agentic AI models, such as GPT-5 or Anthropic’s Mythos, these developers become points of supply chain risk concentration. It seems that, under Amendment 102, the Government can designate AI developers as high-risk vendors and mandate pre-procurement vetting. Is that the case and, if so, why not say so?

The Government will no doubt resist the transparent, legally bounded emergency shutdown power proposed by Amendment 84, with its High Court backstops and seven-day parliamentary reporting, yet here the Government demand sweeping, secretive executive powers to ban software, veto procurement and gag businesses with zero judicial checks. These Benches cannot give these 65 government amendments a free pass. I remind the Minister that, in Grand Committee, unanimity is required for amendments to carry. We insist that the Government come back on Report with strict guardrails and clear limits on executive market intervention without parliamentary consent before these new powers can be exercised.

Quite apart from that, both the Constitution Committee and the Delegated Powers and Regulatory Reform Committee had something to say about the existing powers in the Bill, but neither committee has had a chance to look at these amendments. I am sure that they will have comments to make in due course.

[Lord Holmes of Richmond (Con)]

My Lords, I apologise for not speaking before the Liberal Front Bench, but the great news for everybody in Grand Committee is that I am not the Conservative Front Bench. That is good to know. I declare my relevant technology interests as adviser to the Crown Estate and to Simmons & Simmons LLP.

I have just a few questions for the Minister, most of which revolve around what was known when the Bill was in the Commons and what has become known since it was in your Lordships’ House at Second Reading that have required this raft of amendments to come forward over August. The Minister, in her opening, described defective by design; this is an interesting principle, which could have broad applicability, but, as the noble Lord, Lord Clement-Jones, said, we were clearly told at Second Reading that AI and all therein were not in the scope of this Bill. Does this raft of government amendments change that fundamentally? Is it a nod or hint to it? Is this a large, fundamental change in the Government’s policy approach to large language models and enhanced AI, as covered by this raft of proposed amendments?

Is the Minister’s view that changes to the machinery of government will not be complete and clear by the time the Bill completes its passage through your Lordships’ House, hence the need for the reference to the Secretary of State or the Chancellor of the Duchy of Lancaster? Is there a broader issue on that point, worth the Committee considering, on how the shuffling of departmental deckchairs ahead of the Summer Recess is going down? How long will this take to be settled? Could the Minister update the Grand Committee on what is happening with clarity on where every last element of science, innovation and technology policy now rests? Do they all have a clear, identified home and ministerial responsibility?

In later groups we will come on to talk about AI and the deafening silence on AI—until this raft of amendments. Perhaps the Minister would like to comment, in responding, on whether the Government have had a significant change of direction on these technologies, as illustrated by these amendments, or whether they have not. Thus, what will the Government’s response be when these issues are discussed in later groups, compared to the response that they gave at Second Reading?

--- Later in debate ---

[Baroness Harding of Winscombe (Con)]

My Lords, I support Amendment 75 from the noble Baroness, Lady Kidron, and Amendment 84 in the name of the noble Lord, Lord Clement-Jones, both of which I have added my name to, but I also support all the amendments in the name of the noble Lord, Lord Tarassenko, that I was not smart enough to get my name to last week.

This group of amendments demonstrates not just the AI-shaped hole in the Bill but the complete absence of an AI Bill. It worries me that in one group, of a Tuesday afternoon, no more than 25 Peers are discussing such really big and important issues. We are really letting our country down and not building on the strengths that the noble Lord, Lord Tarassenko, set out that we have in this space by not debating this properly.

The Governor of the Bank of England also sent an open letter at the weekend, from the G20 Finance Ministers’ meeting:

“Recent developments have also highlighted to me that many jurisdictions do not have the protocols in place to manage the development, release, and deployment of advanced frontier AI models, heightening risks for the financial sector and beyond”.


He was speaking as the chair of the Financial Stability Board, the global financial stability regulator. He continued:

“Taking appropriate steps to support safe and responsible model release and deployment on a global basis should in my view be a priority and would benefit all sectors of the economy”.


We should not try to shoehorn this into a cyber security Bill but we have no other choice, which is why I have added my name to these two substantial amendments. I think that both the “red line” amendment, Amendment 75, and the “last resort” amendment, Amendment 84, provide two fundamental elements of regulating AI. I expect that we will hear that it is not appropriate to do it yet, to which the question is, “When?”

In the physical world, we know that just because you can do something, it does not mean that you should. We do not allow people to design new automatic weapons and carry them around on the streets, but it really worries me that, in the AI space, we are quite happy to let people launch things and then have a cyber security Bill to deal with the consequences after the event, whereas it seems entirely logical and just basic common sense to establish what should not be allowed, which is what Amendment 75 aims to do. And if someone launches something that is causing considerable harm, we need to be able to stop it, which is what Amendment 84 would do.

The amendments from the noble Lord, Lord Tarassenko, are great amendments because they are not creating a new regulator; they would give one that is not yet an official regulator but is doing outstanding global work the legal footing and legitimacy to build on that. I view all these, individually, as very substantive improvements in our nascent approach to AI regulation, and I fear that we and our successors will look back in sorrow at our inability to grasp this particular nettle now, because I do not know who else is going to. I think we actually have an opportunity in this country to do it, and it is set out in the scope of these amendments.

[Lord Holmes of Richmond (Con)]

My Lords, it is a pleasure to support all the amendments in this group. In one set of amendments in Committee, we have more on AI than in not just the cyber Bill but across most government legislation—past, present and, tragically, probably largely future.

As has already been mentioned and was covered, widely and rightly, at Second Reading, there is a huge gaping hole at the centre of this Bill, a silence that booms around the entire Bill, and that is all things AI. It seems unfortunate that we were told at Second Reading, and probably will be today, that the Bill is not the place for AI. Well, maybe it is not, but it certainly is in that no previous opportunities have been taken. As was mentioned, there was one line in the 2024 King’s Speech: something around frontier models with AI. There have been various other nods and winks. There was a Bill potentially ready to go at the end of autumn 2024; nothing came, and still we have nothing. So now we have a cyber Bill. It would be extraordinary if the Bill did not not only consider AI but have the thread of AI running right through it. What is behind so many of the difficulties, the clear, present and real dangers that the Minister has set out? Well, it may be said to be cyber at the front end, but AI is the grunt, brute force driving so much of this, and that is what all the amendments in this group speak to.

The noble Lord, Lord Tarassenko, was right to highlight the excellent work of AISI, but again, as we have seen with previous regulators, for want of proper action when it comes to AI, and indeed other technologies, numerous Governments have just piled on more and more requirements and obligations on various regulators, as if somehow they are going to be able to manage this. This is what we are already seeing with AISI. AISI is world-renowned and rightly respected, but it is already being asked to do an increasing number of tasks without the statutory footing or the resourcing to enable it to continue to do that at world class and at the leading edge. When the Minister comes to respond, I would be very interested if she would update the Committee on how she sees the role of AISI going forward. It is in the right position and is perfectly formed for the task, but statutory underpinning and resourcing would make such a significant difference.

If the Government fail to accept these amendments, or indeed, if they so prefer, fail to bring forward amendments of their own, we will have a very narrow and specific piece of cyber legislation. It will be good in that it is the first piece of legislation to have “Cyber” in its title—good in so far as that goes—but it is unfortunate that the legislation sees not only cyber but technology through the view, which has largely washed across from the United States, that it is all about big players, as if AI were only about these LLMs, or frontier models or whatever nomenclature one chooses. “The journey of AI has been up to this point; this is the zenith and the focus should be on these large so-called AI models.” Not a bit of it—they are but one element of a far more complex constellation.

Taking a broader view would enable the Government not only to have the right thread of AI running through the Bill but to be far more UK-focused and context rich, and it would put AI in the Bill in a way which would enable adaptability and agility going forward, rather than potentially trapping ourselves with one specific view of AI or leaving ourselves at the will of all these organisations, individuals and entities that use various AI to attack us. With no or little AI, or only euphemistic nods and winks to it, throughout the Bill, I believe we need to have a rewrite of the entire Bill. This group of amendments is a very good start in that direction.

[Baroness Foster of Aghadrumsee (Non-Afl)]

My Lords, I will briefly speak to the amendments from the point of view of anti-terrorism and national security. I do so with trepidation, having listened to the wonderful speeches that have been made thus far.

I find it difficult to understand why there is an unwillingness to give the clarity that has been requested in this group of amendments, particularly on AI models. I note that the Minister, in response to the first group of amendments, said that AI could be in scope. Would it not be much clearer for all concerned if AI was specifically in scope? Ethically speaking—and this follows on from the noble Baroness, Lady Harding—I would have much preferred it if we had had a royal commission look at AI and say, “Here are the guardrails for the development of AI”, but for some unknown reason we are either unwilling or unable to do that as a nation. In its absence, Amendment 75 is very important because, from a national security point of view, we should adopt the precautionary principle. We live in very dangerous times. We have listened to experts such as Jonathan Hall KC say very clearly that we need to take it into account. I say to the Minister that it would be helpful to hear from the Government how they intend to deal with AI as it moves forward and gets bigger and bigger. Surely we should have that ethical and moral conversation about where the guardrails are.

--- Later in debate ---

Amendment 89, to which I have added my name, is highly relevant here, seeking to establish a register of software and platform providers of essential services and to certify their products as safe for use. That is vital. This is not about advice; it is about regulation, certification and, of course, proper real-time reporting of incidents and near misses. I ask the Minister and her department to give the amendments in this group the attention they absolutely deserve.

[Lord Holmes of Richmond (Con)]

My Lords, it is a pleasure to speak to this group of amendments; I was certainly delighted to sign those in the name of the noble Lord, Lord Birt. Before turning to the specific subject matter, I say that the point he raised about JLR is germane to our broader discussions this afternoon and goes to the heart of the sense of coherence, or lack thereof, in certain key elements of the Bill.

JLR suffered a serious cyber attack yet it currently would not fall within one of the sectors covered by the Bill. Was that attack significant at a level that should be of concern to the Bill? To look at its economic impact—the definition of which my noble friend Lord Camrose has identified as being somewhat broad, to paraphrase what he said—the JLR attack impacted that quarter’s GDP numbers, thus raising the eyebrows of the markets, the ratings agencies and all international economic observers. I would suggest that the impact was more than material and certainly significant, yet it would fall outside the sectors in the Bill as currently drafted.

That goes to the point at the heart of the need for an OCR or an entity that would perform that function or role. Much of the discussion so far on this group is understandably echoic of the discussion we are having around the need for AI to be taken on by some regulator. As we are discussing the need for AI regulation and legislation, it seems only fair for me to give a nod to the AI authority in my AI regulation Private Member’s Bill—it comes with music every time I announce it, this time from a phone going off; that is multimedia.

The reality is, if the choice of the Government, be it for AI or for cyber, is not to have a single centralised regulator, then the consequences are clear and profound. In no sense is there any chance of clarity, consistency and coherence for businesses and sectors right across our economy and society. When you come to cyber, you should not have to consider whether it is or is not in a sector within the Bill. Is that specific regulator in that sector tooled up or do they have any experience, knowledge or ability to lead when it comes to all the challenges of cyber?

Let us take one obvious example, just for the case of efficiency, effectiveness and economic good management. Say that there is a search out, a recruitment, for a particular cyber professional and it turns out that Ofgem and the FCA are both in the final throes of getting that person. The FCA ends up getting that cyber professional; that is good for the FCA and good for financial services, but less good for Ofgem. How is that in any sense good for the broader economy and society, the UK as a whole, when it comes to protection from and an effective coherent approach to the cyber risks and how we guard against them?

The case for a unifying regulator when it comes to cyber is equal to that for AI. It would enable clarity, consistency and coherence of approach and would be that centre of expertise. There would be horizontal impact across all sectors and it would be delivered effectively and efficiently. That cannot simply be the case just for individual regulators; no matter how well intended or up for it they may be, they simply could not deliver that. Even if one sector did, another sector would not, which would mean that, just by dint of where your business or you as an individual happen to come across a cyber challenge, it would be the luck of the draw as to whichever regulator or professionals were in that field. The case for an individual, central, clear and coherent cyber regulator is clear. I hope that the Minister agrees and I look forward to her response.

[Baroness Neville-Jones (Con)]

My Lords, the last two interventions seemed to raise two issues, not one. The first is the question of how many regulators and the second is their coverage. Who will they regulate? Will they regulate just, say, the public sector, or will they regulate, in effect, the whole of the economy, including retail, business, high street businesses and so on? You can argue a case for any of these approaches: you can try to do too much, and certainly you can fail and do too little.

While I can see the case for a single regulator, my worry is that large organisations like that, with monopoly powers, in the end either tend to fail, because they just do not cope, or become overweening. I do not think that we want either of those two things. I am therefore in favour of something that is more decentralised than that and has more specialised regulators involved, partly because I think the nature of the regulation probably deserves that. However, at the same time, there has to be some degree of co-ordination—in fact, a high degree of co-ordination—between the regulators. They must operate according to the same principles, applied appropriately. They must espouse the same philosophy and must be seen to be fair. Therefore, great divergence and different approaches will equally not work. There needs to be a mechanism for co-ordination, for discussion and for agreement of principles. There also needs to be a thinker there somewhere. I am therefore in favour of some bit of the system being bigger than the rest, so that it inspires a degree of good and recognised co-ordination in the system.

Cyber Security and Resilience (Network and Information Systems) Bill

Lord Holmes of Richmond Excerpts

Committee stage
Thursday 3rd September 2026 Grand Committee

It has been said a number of times already that a small cyber attack on one part of the stack can have a disproportionate impact across the whole. The regulator having just-in-time information could save the pain for many others down the line. These are sensible arrangements and I hope that the Government will look favourably on them.

[Lord Holmes of Richmond (Con)]

My Lords, it is a pleasure to support these amendments. I have signed all of them, although in doing so I almost got a serious case of electronic RSI. They have the great good fortune of being clear, precise and aligned with existing regulations in other jurisdictions. As my noble friend Lady Harding has already pointed out, many businesses will have operations in multiple jurisdictions. For something as significant as reporting, why would we not follow NIS2 in this respect?

The clarity of the amendments is their strength, even more so when compared with what is currently in the Bill in this respect. What we are trying to achieve from these changes is clear. The 24-hour initial reporting period makes sense: of course it does. As my noble friend Lady Harding pointed out, what one knows at that point is that something is happening and a report is made. In many ways, that is all that needs to be known and all that needs to be reported.

To have a situation as currently set out in the Bill, 24 then 72, means that in that period so much would need to be known to comply with the provisions set out in the Bill that it is just not realistic. This staged approach is both clear and precise. It enables what the purpose of the Bill is all about, which is to support the individual business or entity that is under attack. Crucially, as other noble Lords have said, it puts the power in the collective. As a consequence of one attack, the collective can benefit if there is a sense of commitment to this reporting schedule. That will come only if it is in this stage 4, as clearly set out by my noble friend Lady Harding.

If we want to enable businesses and other entities to really commit to this process—not just be dragged there by force of statute but have it as a means of business as usual, a real cultural change and a commitment to the positivity of this—it has to work for them. This staged process not only does that but, by aligning with NIS, stops this being yet another burden added to business: added unnecessarily and less effectively than what these amendments propose. I very much look forward to the Minister’s response.

[Lord Arbuthnot of Edrom (Con)]

My Lords, good can come out of bad events. The experience, as well as the speech, of my noble friend Lady Harding is one such good aspect. If it combines with bringing us into line with European practice, which so many businesses already have to follow, so much the better. I hope the Minister will be as sympathetic as she possibly can to my noble friend’s amendments.

--- Later in debate ---

[Lord Holmes of Richmond (Con)]

My Lords, I support all these amendments. They bring the customer perspective well into focus, which the Bill is currently chronically insufficient on, in my view. As the noble Baroness, Lady Harding, identified, if these amendments do not quite get to the precision of it, how will the Government bring something forward that will do the trick perfectly? This is a critically significant element which is currently not within the Bill. On an allied point, which has already been nodded to, I ask the Minister, since the Bill’s drafting seems to like “likely to”, and, in earlier additions “capable of”, why would there not be coherence through the Bill as to the type of legal construction that is being used throughout? Surely, that would not only be beneficial and more precise, but it would give greater clarity to all those who have to engage with the issues therein.

[Lord Clement-Jones (LD)]

My Lords, I, too, support these customer notification amendments tabled by the noble Baroness, Lady Harding of Winscombe. As I have said, the noble Baroness brings vital lived experience, in more ways than I thought, from the front line of corporate crisis response. When a major cyber breach occurs, vague statutory requirements to notify customers

“as soon as reasonably practicable”

lead to corporate delay. Amendment 58 would replace this with a strict statutory 24-hour notification clock, while Amendment 65 would establish explicit harm triggers and require providers to provide actionable remediation advice to affected customers. Look at what Amendments 60 and 65, in particular, would achieve across Clause 16.

Under Amendment 65, notification would be explicitly triggered whenever an incident causes or threatens severe operational disruption, substantial financial loss or material harm to downstream users. Furthermore, Amendment 71 would place a positive duty on the provider to advise customers on immediate remediation steps that they can take. In the cyber realm, time is the attacker’s greatest ally. If a hospital, bank or small supplier is informed within 24 hours that their cloud or managed service provider has been breached and given technical instructions on how to isolate their systems, they can prevent contagion before it paralyses their operations. We must ensure that customer notification is prompt and meaningful, empowering downstream businesses to isolate compromised systems before contagion spreads, so we very strongly support these amendments.

--- Later in debate ---

[Lord Birt (CB)]

I, too, support the amendment from the noble Baroness, Lady Harding, as I do all the amendments previously discussed. By definition, a near miss means a severe threat narrowly avoided that would have had substantial consequences if it had not been avoided. The interesting thing is that everyone tells me that the near-miss reporting in the aviation industry proved to be massively significant and fundamentally changed the whole approach to air safety, with very beneficial consequences. The case is very sound that it should be applied here.

[Lord Holmes of Richmond (Con)]

My Lords, I support this amendment, particularly in terms of its probing nature and what work can potentially be done between Committee and Report in this respect. It is really about the question of mandation. There should not be any question of a voluntary requirement. This is something that is not about the individual organisation, business or entity. It goes broader than that. It is about the community, the greater good and the country. The fact of a near miss says nothing about the severity of intent and the intel that can thus be gleaned to benefit at that point across the sector, the community, the country and beyond. Mandation has to be the standard for this provision.

[Lord Clement-Jones (LD)]

My Lords, I cannot possibly compete with the Shakespearean seven stages—as opposed to ages—of the noble Baroness, Lady Kidron. We support Amendment 72 in its entirety. Voluntary reporting is the bit of the amendment that we particularly like. Our national security services and sectoral competent authorities desperately need early upstream visibility of emerging threat patterns before a full-blown systemic crisis unfolds. In the cyber domain, the precursors to the catastrophic attack—the subtle network probes, the exploratory reconnaissance and near misses—often appear weeks before a critical system is actually breached.

At present, the Bill creates a bit of an all-or-nothing trap. If any entity experiences a sophisticated near miss that fails to cross the statutory threshold of an active disruptive breach, it has a powerful legal incentive to keep quiet. It fears that, if it approaches a regulator voluntarily, it will expose itself to regulatory scrutiny, compliance investigations and potential enforcement action. In our view, including a dedicated statutory framework into the NIS regulations specifically for the voluntary notification of near misses, sub-threshold anomalies and early-stage cyber threats would be a significant beneficial addition to the Bill. In effect, it would establish a safe harbour for intelligence sharing.

As the recent “Analogue 72” green paper powerfully argued, we must move away from a culture of fear and silence in this area and we must encourage continuous proactive information flows between our critical infrastructure operators and the NCSC. We strongly support this amendment.