Lords Backs Cyber Reviews and Foreign-Power Risk Register

High-Level Summary

The House of Lords began with the introduction and oath-taking of Richard Lee, Lord Bishop of Durham. Oral questions covered defence-sector banking and environmental, social and governance (ESG) rules, artificial intelligence (AI) tools in schools, British Steel, tax-free shopping, and the Russian shadow fleet, followed by consideration of a Commons urgent-question answer on RAF support for Saudi Arabia. The main legislative business was Report stage of the Cyber Security and Resilience (Network and Information Systems) Bill, during which the House agreed amendments on vendor directions, incident reporting, AI-related compromises and overseas information-sharing. Divisions rejected a proposed frontier-AI reporting duty by 95 votes to 165, but approved a review of the NIS regime by 202 votes to 155 and a register of foreign powers posing cyber risks by 194 votes to 155.

Detailed Summary

Introduction of the Bishop of Durham

Richard Lee, Lord Bishop of Durham, was introduced, took the oath, was supported by the Bishops of Leicester and Hereford, and signed an undertaking to abide by the Code of Conduct. The transcript records that he “was introduced and took the oath”. No further decision or next step was stated in the transcript.

Defence-sector banking, ESG rules and access to finance

Lord Sharpe of Epsom asked what progress had been made to prevent environmental, social and governance (ESG) rules being used to deny banking services to defence companies. Lord Pitt-Watson said the Financial Conduct Authority (FCA) had confirmed that there were no sustainability requirements or FCA regulatory barriers preventing financial institutions from supporting the defence sector. He added that “no legitimate company should be excluded from financial services solely because it operates in the defence sector”, and said the FCA would write to all financial firms that day.

Peers raised concerns about start-ups and small and medium-sized enterprises, banks’ own exclusions, procurement, intellectual property and possible cultural barriers. The Minister said firms should assess risks “proportionately and consistently”. He cited the British Business Bank’s growth guarantee scheme, providing £3.5 billion a year, and a £100 million national security strategic investment fund by 2029–30. If the FCA’s action did not work, he anticipated further parliamentary questions; no further decision was recorded.

AI tools and safeguarding in schools

Baroness Berger asked whether the Government would publish a single list of AI tools meeting minimum safeguarding and data-protection standards. Baroness Smith of Malvern said the Government planned a consultation on safety certification for higher-risk products, which would lead to a published list of child-facing generative-AI tools certified against safety criteria. The proposed certification was intended to show schools “which products are certificated”.

Peers also discussed support for schools and parents, Ofsted’s role, independent assessment, screen use, children’s learning and the reception baseline assessment. The Minister said the consultation and certification framework was intended for “this autumn”. She said Ofsted would have a safeguarding role but would not hold the certification process, while the Information Commissioner’s Office would have a role in data protection. She also undertook to respond on the Government’s sovereign education benchmarks.

British Steel business plan and industrial policy

Lord Redwood asked when a business plan for British Steel would be published. Lord Leong said Alan Lovell and a new board were developing a transformation plan, with “key decisions … expected in the coming months”. He said no final investment decision on electric arc furnaces had been announced.

Peers discussed public support, procurement, tariffs, cheap imports, downstream steel users, scrap exports and the balance between clean steel-making and industrial capacity. The Minister said taxpayer support could not replace commercial viability indefinitely and that trade remedies would be used against unfair competition. He corrected the funding figure to £751 million in working capital provided since April 2025. Publication of the board’s plan remained the stated next step.

Tax-free shopping and economic impact

Baroness Meyer asked about the economic impact of withdrawing VAT tax-free shopping. Lord Pitt-Watson said the VAT retail export scheme had been withdrawn in 2021 and cited an Office for Budget Responsibility estimate that the change would “save the taxpayer £540 million”. Baroness Meyer and other Peers argued that a restored scheme could support tourism, retail, the creative industries and employment, and suggested a digital model using private refund operators.

The Minister disputed claims that withdrawal had caused significant economic harm, citing tourism receipts in the UK at 111% of 2019 levels after adjustment for inflation, compared with 107% in France, 103% in Italy and 83% in Germany. He referred to wider retail and hospitality support through business-rates changes and said any broader policy change would have to await the Budget. No commitment to restore the scheme was made.

Russian shadow fleet vessel LERUO and sanctions enforcement

Baroness Goldie asked why the Russian shadow-fleet vessel LERUO had not been intercepted and about the implications for sanctions and support for Ukraine. Lord Wood of Anfield declined to discuss the specific operational decision, saying, “I am not going to make specific comment on operational decisions or assessments”. He said interceptions were subject to legal procedures and domestic and international law. He also stated that “Since 2024 we have challenged more than 700 suspected shadow fleet vessels”, and that the Smyrtos was detained under transport-sanctions powers.

Peers discussed the effect of sanctions on Russia’s capacity to wage war, co-operation with Germany and other European allies, the Black Sea, Starlink, substandard vessels, environmental risks and possible replacement vessels. The Minister cited an estimate that Western sanctions had denied Russia access to $500 billion since February 2022. He confirmed discussions with Ukraine and allies about the Black Sea and with Baltic, northern European and Scandinavian partners about environmental risks. No operational explanation for the LERUO decision was given, and no timetable was stated for legislation on penalties for tampering with undersea cables, although the Minister described that work as a priority.

RAF support for Saudi Arabia: Commons urgent-question answer

The House considered the Government’s answer to a Commons urgent question on additional RAF support for Saudi Arabia in response to increased Houthi aggression. The answer stated that air-to-air refuelling would be extended to 90 days, RAF Typhoons would conduct defensive counter-air operations from Saudi Arabia, and an RAF A400M would support the movement of defence matériel. It also stated that “these aircraft will operate in a defensive role and will not conduct offensive strikes”.

Baroness Goldie questioned the distinction from earlier offensive action. Other Peers asked about parliamentary scrutiny, rules of engagement, cost-sharing, co-operation with the United States, the proscription of the Houthis and the relationship with other regional defence partners. Baroness Antrobus said, “The RAF presence is designed to prevent drones and missile attacks”. She said partners receiving UK assistance were expected to comply with international law, could not provide details of the rules of engagement, and would write on costs. No further parliamentary decision was recorded.

Cyber Security and Resilience Bill: national-security vendor directions

At Report stage, Baroness Lloyd of Effra moved amendments creating a framework for directions concerning vendors whose goods, services or facilities could create national-security risks. She said the Government had removed the emergency “made affirmative” procedure, so that “both Houses must approve any regulations made under these powers before they take effect”. The framework also provides for consultation, voluntary referrals, statutory tests of necessity and proportionality, publication of notices and annual reporting.

Lord Clement-Jones welcomed the removal of the emergency procedure but sought evidential tests, notice, judicial authorisation and review rights, describing the power as “an extraordinary power”. The Minister rejected prior court authorisation, saying that operators, and in most cases vendors, would be able to challenge directions through judicial review in the High Court. She also opposed a fixed register of hostile states, arguing that a country list could create “false certainty”. Amendment 1 and Amendments 91–94 were agreed, as were later amendments establishing related publication and reporting arrangements.

Cyber Security and Resilience Bill: scope, implementation and incident reporting

Peers debated the Bill’s scope and implementation, including managed service providers, small and medium-sized enterprises, quantum computing, board accountability, cyber skills, data retention and information-sharing and analysis centres. The Government said that consultancies, training providers, software-licensing agents and basic help desks were not expected to meet both criteria for an in-scope managed service, and said that critical suppliers would be considered through consultation in 2027. It also said that future security and resilience requirements would cover data security, risk management, board governance and incident response, and that guidance on post-quantum cryptography would be published shortly.

On incident reporting, the Government amended the Bill so that an incident had to have an “actual adverse impact”, removed mandatory near-miss reporting by data-centre operators, committed to developing a voluntary near-miss mechanism, and required certain providers to update affected customers during ongoing incidents. Baroness Harding sought a mandatory 28-day final report and a statutory voluntary-reporting regime; Baroness Neville-Jones sought factors for assessing the significance of data-centre incidents. The Minister rejected the mandatory 28-day report but said the proposed data-centre factors would be reflected in consultation. Amendments 6, 8, 12–15, 17, 30, 35 and 40 were agreed; Amendment 16 and several other amendments were not moved.

Cyber Security and Resilience Bill: AI risks and frontier-model reporting

Baroness Harding proposed Amendment 41, which would have required developers of frontier AI models to report unauthorised access to or interference with regulated systems within 24 hours, followed by fuller reports within 72 hours and 14 days. Supporters argued that affected organisations should not bear the only reporting burden and that developers could hold information needed to understand incidents. Baroness Harding described the proposed duty as applying where an AI agent accessed “UK essential services and/or their data”.

The Government argued that the NIS regime should place reporting duties on regulated entities rather than frontier-AI developers, and that comprehensive frontier-AI regulation was outside the Bill’s purpose. Amendment 70 was agreed; it enables future regulations to confer investigatory and enforcement functions on the Secretary of State in cases involving “loss of oversight or control of an AI agent”. Amendment 41 was pressed to a division and rejected: “Ayes 95, Noes 165”.

Cyber Security and Resilience Bill: overseas information-sharing

The Government amended the Bill to restrict overseas disclosure of information by NIS enforcement authorities to Australia, Canada, New Zealand, the United States, Switzerland and countries in the European Economic Area. Baroness Lloyd of Effra said the amendments responded to concerns about sharing information with countries where fair-trial protections might not be guaranteed, while “maintaining these gateways” for international cyber-security co-operation.

Lord Alton of Liverpool and Baroness Ludford welcomed the changes and linked the issue to transnational repression and the possible misuse of technical data by hostile authorities. Amendments 45–48 were agreed.

Cyber Security and Resilience Bill: strategic reviews and foreign-power register

Peers argued for a wider review of the cyber-regulatory framework, the sectors within scope, technology-provider obligations, professional capacity and the role of the AI Security Institute. The Government opposed the proposed recurring comprehensive review as potentially destabilising, but committed that, “within 12 months of the Bill passing”, the Secretary of State would lay a Statement on whether additional critical national infrastructure activities should be brought within scope. The proposed review was to focus, among other areas, on sectors such as government and food. Amendment 77 was withdrawn.

Lord Birt pressed Amendment 163, requiring a review of the effectiveness of the NIS regime and a report to Parliament. It was agreed on division: “Ayes 202, Noes 155”. Lord Markham then pressed Amendment 164, requiring a register of foreign powers considered to pose risks to UK critical network and information systems. It was agreed by “Ayes 194, Noes 155”. Amendment 61 on a digital-sovereignty strategy was withdrawn, while other strategic amendments were not moved. The Government said the national cyber action plan would be published “shortly”.

Other Cyber Security and Resilience Bill decisions

The House agreed further technical and consequential amendments on charges, financial penalties, enforcement notices, definitions, consultation and the application of directions to additional persons providing essential goods or services. It also agreed publication and annual-reporting provisions for vendor-related directions.

Amendment 82 shortened the statutory reporting cycle from five to three years, while Amendment 85 replaced the power to amend the report provision with a power to specify additional matters and requirements by regulations. The House adjourned at “7.52 pm”.