Cyber Security and Resilience (Network and Information Systems) Bill

Debate between Lord Holmes of Richmond and Baroness Harding of Winscombe

Committee stage
Tuesday 1st September 2026 Grand Committee

[Baroness Harding of Winscombe (Con)]

My Lords, I support Amendment 75 from the noble Baroness, Lady Kidron, and Amendment 84 in the name of the noble Lord, Lord Clement-Jones, both of which I have added my name to, but I also support all the amendments in the name of the noble Lord, Lord Tarassenko, that I was not smart enough to get my name to last week.

This group of amendments demonstrates not just the AI-shaped hole in the Bill but the complete absence of an AI Bill. It worries me that in one group, of a Tuesday afternoon, no more than 25 Peers are discussing such really big and important issues. We are really letting our country down and not building on the strengths that the noble Lord, Lord Tarassenko, set out that we have in this space by not debating this properly.

The Governor of the Bank of England also sent an open letter at the weekend, from the G20 Finance Ministers’ meeting:

“Recent developments have also highlighted to me that many jurisdictions do not have the protocols in place to manage the development, release, and deployment of advanced frontier AI models, heightening risks for the financial sector and beyond”.


He was speaking as the chair of the Financial Stability Board, the global financial stability regulator. He continued:

“Taking appropriate steps to support safe and responsible model release and deployment on a global basis should in my view be a priority and would benefit all sectors of the economy”.


We should not try to shoehorn this into a cyber security Bill but we have no other choice, which is why I have added my name to these two substantial amendments. I think that both the “red line” amendment, Amendment 75, and the “last resort” amendment, Amendment 84, provide two fundamental elements of regulating AI. I expect that we will hear that it is not appropriate to do it yet, to which the question is, “When?”

In the physical world, we know that just because you can do something, it does not mean that you should. We do not allow people to design new automatic weapons and carry them around on the streets, but it really worries me that, in the AI space, we are quite happy to let people launch things and then have a cyber security Bill to deal with the consequences after the event, whereas it seems entirely logical and just basic common sense to establish what should not be allowed, which is what Amendment 75 aims to do. And if someone launches something that is causing considerable harm, we need to be able to stop it, which is what Amendment 84 would do.

The amendments from the noble Lord, Lord Tarassenko, are great amendments because they are not creating a new regulator; they would give one that is not yet an official regulator but is doing outstanding global work the legal footing and legitimacy to build on that. I view all these, individually, as very substantive improvements in our nascent approach to AI regulation, and I fear that we and our successors will look back in sorrow at our inability to grasp this particular nettle now, because I do not know who else is going to. I think we actually have an opportunity in this country to do it, and it is set out in the scope of these amendments.

[Lord Holmes of Richmond (Con)]

My Lords, it is a pleasure to support all the amendments in this group. In one set of amendments in Committee, we have more on AI than in not just the cyber Bill but across most government legislation—past, present and, tragically, probably largely future.

As has already been mentioned and was covered, widely and rightly, at Second Reading, there is a huge gaping hole at the centre of this Bill, a silence that booms around the entire Bill, and that is all things AI. It seems unfortunate that we were told at Second Reading, and probably will be today, that the Bill is not the place for AI. Well, maybe it is not, but it certainly is in that no previous opportunities have been taken. As was mentioned, there was one line in the 2024 King’s Speech: something around frontier models with AI. There have been various other nods and winks. There was a Bill potentially ready to go at the end of autumn 2024; nothing came, and still we have nothing. So now we have a cyber Bill. It would be extraordinary if the Bill did not not only consider AI but have the thread of AI running right through it. What is behind so many of the difficulties, the clear, present and real dangers that the Minister has set out? Well, it may be said to be cyber at the front end, but AI is the grunt, brute force driving so much of this, and that is what all the amendments in this group speak to.

The noble Lord, Lord Tarassenko, was right to highlight the excellent work of AISI, but again, as we have seen with previous regulators, for want of proper action when it comes to AI, and indeed other technologies, numerous Governments have just piled on more and more requirements and obligations on various regulators, as if somehow they are going to be able to manage this. This is what we are already seeing with AISI. AISI is world-renowned and rightly respected, but it is already being asked to do an increasing number of tasks without the statutory footing or the resourcing to enable it to continue to do that at world class and at the leading edge. When the Minister comes to respond, I would be very interested if she would update the Committee on how she sees the role of AISI going forward. It is in the right position and is perfectly formed for the task, but statutory underpinning and resourcing would make such a significant difference.

If the Government fail to accept these amendments, or indeed, if they so prefer, fail to bring forward amendments of their own, we will have a very narrow and specific piece of cyber legislation. It will be good in that it is the first piece of legislation to have “Cyber” in its title—good in so far as that goes—but it is unfortunate that the legislation sees not only cyber but technology through the view, which has largely washed across from the United States, that it is all about big players, as if AI were only about these LLMs, or frontier models or whatever nomenclature one chooses. “The journey of AI has been up to this point; this is the zenith and the focus should be on these large so-called AI models.” Not a bit of it—they are but one element of a far more complex constellation.

Taking a broader view would enable the Government not only to have the right thread of AI running through the Bill but to be far more UK-focused and context rich, and it would put AI in the Bill in a way which would enable adaptability and agility going forward, rather than potentially trapping ourselves with one specific view of AI or leaving ourselves at the will of all these organisations, individuals and entities that use various AI to attack us. With no or little AI, or only euphemistic nods and winks to it, throughout the Bill, I believe we need to have a rewrite of the entire Bill. This group of amendments is a very good start in that direction.

Data (Use and Access) Bill [HL]

Debate between Lord Holmes of Richmond and Baroness Harding of Winscombe

Committee stage
Monday 16th December 2024 Grand Committee

[Lord Holmes of Richmond (Con)]

My Lords, it is a pleasure to follow my friend the noble Baroness, Lady Kidron, and to give full-throated support to my friend the noble Viscount, Lord Colville, on all his amendments. Given that the noble Baroness mentioned it and that another week has passed since we asked the Minister the question, will we see an AI Bill or a consultation before Santa comes or at some stage in the new year? I support all the amendments in this group and in doing so, as it is the first time I have spoken today in Committee, I declare my technology interests as set out in the register, not least as an adviser to Socially Recruited, an AI business.

I will speak particularly to my Amendment 211A. I have put down “image, likeness and personality” not because I believe that they stand as the most important rights that are being transgressed or that they are the most important rights which we should consider; I have put them down to give a specific focus on them because, right now, they are being largely cut across and ignored, so that all of our creatives find themselves with their works, but also image, likeness and personality, disappearing into these largely foundation AI models with no potential for redress.

Once parts of you such as your name, face or voice have been ingested, as the noble Lord, Lord Clement-Jones, said in the previous group, it is difficult then to have them extracted from the model. There is no sense, for example, of seeking an equitable remedy to put one back in the situation had the breach not occurred. It is almost “once in, forever in”, then works start to be created based on those factors, features and likenesses, which compete directly with the creatives. This is already particularly prevalent in the music industry.

What plans do the Government have in terms of personality rights, image and likeness? Are they content with the current situation where there is no protection for our great creatives, not least in the music industry? What does the Bill do for our creatives? I go back to the point made by the noble Baroness, Lady Kidron. How can we have all these debates on a data Bill which is silent when it comes to AI, and a product regulation Bill where AI is specifically excluded, and yet have no AI Bill on the near horizon—unless the Minister can give us some up-to-date information this afternoon? I look forward to hearing from her.

[Baroness Harding of Winscombe (Con)]

My Lords, I should first apologise for not being able to attend Second Reading or, arguably more importantly, to be in Committee last week to support the many amendments of the noble Baroness, Lady Kidron, on child protection. I read Hansard carefully and was deeply depressed to see that we were once again needing to rehearse, as she has done again today, the importance of protecting children in the digital era. It seems to be our lot that there is a group of us who keep coming back. We play the merry-go-round and sit in different places; it is a privilege to sit next to the noble Baroness, Lady Kidron, for the first time in the decade that I have been in the House. I support her Amendment 137. She has given a good exposé as to why we should think really carefully about how we protect children in this AI world. I would just like to add one point about AI itself.

We keep being told—in a good way—that AI is an underlying and general-purpose technology. That means we need to properly establish the principles with which we should protect children there. We know that technology is morally neutral; it is the human beings who do the damage. In every other underlying, breakthrough technology, we have learned that we have needed to protect the most vulnerable, whether it was electricity when it first went into factories, toys when they were first distributed on the mass market, or social media, with the age-appropriate design code. I feel that it would be a huge mistake, on the third Bill where many of us have debated this subject matter, for us not to address the fact that, as of today, this is the biggest breakthrough technology of our lifetime. We should recognise that children will need protecting, as well as having the opportunity to benefit from it.