· ·

Cyber Security and Resilience Bill Passes the Lords

Peers passed the Cyber Security and Resilience Bill on 2 November. It returns to the Commons with two amendments the government opposed.

ByPeter
Palace of Westminster and Elizabeth Tower beside the River Thames under a golden evening sky
AI-generated illustration

The House of Lords passed the Cyber Security and Resilience (Network and Information Systems) Bill on 2 November, according to HansardBill). The bill now goes back to the Commons carrying two changes the government opposed: a review of how well the UK’s network security rules work, and a register of foreign powers that pose a risk to critical systems. MPs must now decide whether to accept or overturn them.

At a glance

  • Bill: a government bill sponsored by Liz Kendall in the Commons and Baroness Lloyd of Effra in the Lords (bills.parliament.uk).
  • Lords votes: at report stage on 26 October peers backed Lord Birt’s review clause 202-155 and Viscount Camrose’s foreign-powers register 194-155, both against the government.
  • Third reading: four technical government amendments agreed without a vote on 2 November; bill passed.
  • Next: the Commons considers the Lords amendments, a back-and-forth known as ping-pong.
Palace of Westminster and Elizabeth Tower beside the River Thames under a golden evening sky
AI-generated illustration

What the bill does

The bill updates the Network and Information Systems (NIS) Regulations 2018, the rules that require providers of essential services such as energy, water, transport and NHS bodies to protect their computer systems. In its summary factsheet, the government describes three main changes:

  • Wider scope: medium and large data centres, managed IT service providers and large “load controllers” (firms that manage electricity demand from devices such as electric-vehicle chargers) come under the rules. Regulators can also designate critical suppliers to essential services.
  • Faster reporting: more serious cyber incidents, including attacks that have not yet caused disruption, must be reported, with a first notice within 24 hours and a full report within 72 hours. The National Cyber Security Centre (NCSC) is told at the same time (incident reporting factsheet).
  • Stronger oversight: the Secretary of State can set priorities for the 12 regulators that enforce the rules, and penalties are restructured; the current maximum fine is £17 million.

The government cites the June 2024 attack on Synnovis, a pathology supplier to the NHS, which it says led to more than 11,000 postponed appointments and procedures.

Where it stands

  • 12 November 2025: first reading (formal introduction) in the Commons (Bills API).
  • 6 January 2026: Commons second reading, followed by committee stage in February; the bill was carried over and reintroduced on 14 May.
  • 16 June 2026: Commons report stage and third reading.
  • 14 July 2026: Lords second reading; committee stage in Grand Committee on 1, 3 and 7 September.
  • 26 October 2026: Lords report stage, with government defeats on amendment 163 (division 3730) and amendment 164 (division 3731); Baroness Harding’s frontier-AI incident reporting amendment fell 95-165.
  • 2 November 2026: third reading; bill passed and returned to the Commons with amendments.

What supporters and critics say

Closing the third reading debate, Baroness Lloyd said the bill “will increase the UK’s defences against cyber attacks, better protecting the services that the public rely on.” At report stage she argued against the register of foreign powers, telling peers that “a register can create false certainty” because threats do not come only from a fixed group of states, and that peers agreed during the Telecommunications (Security) Act debates that a country-specific approach was not appropriate.

Conservative peer Viscount Camrose, who moved the register amendment, said foreign states are responsible for three-quarters of attacks on Britain’s critical national infrastructure and that the register would close an information gap without publishing intelligence sources. Crossbencher Lord Alton of Liverpool, who co-signed it, said: “We cannot defend what we value against an adversary whom we refuse to formally identify.” On 2 November he pointed the minister to a new Commons committee report, chaired by Liam Byrne, on the role of hostile states, notably China.

For the Liberal Democrats, Lord Clement-Jones said the review won at report stage addresses “critical gaps in our cyber defences” and that “the decision now rests squarely with the Government whether to engage in parliamentary ping-pong or accept this amendment.” Conservative peer Baroness Neville-Jones welcomed the minister’s changes to the trigger for reporting incidents, but said the two sides had not closed the gap on listing factors for some operators.

Analysis: Peers on all sides praised the minister’s handling of a long, technical bill. Whether it overturns those two clauses in the Commons, offers a compromise or accepts them will decide how quickly the bill reaches Royal Assent.

What happens next

  • Carry-over: the Commons business statement lists a carry-over motion for the bill on 4 November, which would let it continue into the next session if needed.
  • Consideration of Lords amendments: MPs vote on each Lords change. If they reject one, the bill returns to the Lords, and the exchange continues until both Houses agree.
  • Royal Assent: once both Houses agree the same text, the King’s formal approval makes it an Act.

Sources

Related on Peter’s World

Recommended articles