The House of Lords has backed two changes to the UK's Cyber Security and Resilience Bill, including a review of the regulatory system within a year of the legislation passing. Peers also supported a proposed register of foreign powers judged to pose risks to critical networks. Both changes were agreed on 26 October, but neither is an enacted requirement.
The votes came at report stage, when peers examine proposed amendments to the bill. Parliament's 27 October account of the proceedings lists third reading for 2 November. The published bill page now carries the version amended on report, dated 26 October.
The legislation concerns the networks and information systems supporting essential activities. It would amend the existing Network and Information Systems Regulations 2018, with changes covering the scope of regulation, incident reporting and government powers to issue national-security directions. Parliament identifies healthcare, drinking water and energy among the essential services the bill aims to protect.
Peers want a wider review of cyber regulation
Amendment 163, moved by Lord Birt, was agreed by 202 votes to 155. Its text would require the Secretary of State to examine the effectiveness of the legislation and the existing regulations within 12 months of the Act being passed. That clock would run from passage of the eventual Act, not from this week's Lords vote.
The proposed review goes beyond checking whether regulated organisations have filed reports. It would identify public and private organisations whose operations materially affect the economy, society or national security, and consider what cyber-resilience obligations could apply to them. It would also examine vulnerabilities in technology platforms and possible responsibilities for providers to address those weaknesses.
Sector coverage is a central part of the amendment. The review would consider critical national infrastructure, cloud services and other digital infrastructure, frontier AI systems, democratic processes and areas such as education and research. Listing these activities for examination does not itself bring every organisation in those fields into regulation.
The amendment would also require scrutiny of supply-chain risks and the thresholds that exclude micro and small enterprises. It asks whether those boundaries leave material risks outside the system. Alongside scope, the review would examine the roles and powers of the regulators and public bodies involved in cyber security.
Under the proposed reporting process, ministers would have to tell Parliament which additional activities they intended to regulate and provide a timetable. They would also have to explain decisions not to extend coverage. Further reviews would follow at intervals of no more than 12 months after the first report, creating a recurring assessment rather than a single exercise.
Register proposal passes, AI reporting amendment fails
Peers separately agreed Amendment 164, moved by Lord Markham, by 194 votes to 155. It would require a register of foreign powers that the Secretary of State believes present a risk to the UK's critical network and information systems. The proposed register would inform the use of the bill's national-security direction powers.
The amendment sets a six-month period after the Act passes for establishing the register through regulations. It provides for a review of the nature of the risks posed by each designated power and a subsequent report to Parliament on those risks and the government's response. It also allows sensitive parts of that report to be withheld on national-security grounds, with a statement to Parliament.
The official debate and division record shows a different outcome for Amendment 41. That proposal concerned incident reporting by developers of frontier AI models. It was defeated, with 95 peers voting for it and 165 against. It should not be described as a reporting duty created by the bill.
In the debate, the government argued that obligations on frontier-model developers were a different regulatory question from protecting essential services. Ministers instead outlined plans to consult on measures addressing incidents involving AI agents used by regulated entities, including preserving incident information and notifying affected organisations. Those statements describe proposed follow-on measures, not a completed consultation or rules already in force.
The next scheduled parliamentary step is third reading. For organisations monitoring potential compliance changes, the immediate result is a revised bill with two contested additions, rather than a final statutory timetable. The official bill record remains the source for its passage and current text.
Related coverage: Dalimss News previously reported the separate 12 October AI cyber-defence announcement and the UK's additional Sovereign AI investment and procurement funding.
Contains Parliamentary information licensed under the Open Parliament Licence v3.0.
