Cyber Security and Resilience (Network and Information Systems) Bill (Carry-over Extension)

Martin Wrigley Excerpts

Carry-over motion
Wednesday 4th November 2026 Commons Chamber

[Victoria Collins (Harpenden and Berkhamsted) (LD)]

The Liberal Democrats absolutely support this motion, but it is my democratic duty to highlight some things that I would love the Government to consider as we make this extension.

Let us look locally, nationally and internationally. In July, Hertfordshire county council raised its cyber-security risk to the maximum score on its register, 25 out of 25. That is exactly the kind of risk that this Bill should manage, yet the Bill excludes local authorities, even though they hold social care records on some of the most vulnerable people. Less than a fortnight ago, 32 Government services went offline while Departments patched critical flaws in widely used web software. That shows just how vulnerable the heart of our nation’s digital infrastructure and security is. On Sunday night, hackers attacked dozens of supermarket refrigerators and freezers in seven European countries, raising their temperatures to 50°C and spoiling millions of euros-worth of produce. That is the food we all rely on every single day, and the National Cyber Security Centre has warned:

“The UK’s cyber resilience is not yet where it should be.”

Our framework must not fall behind those of our closest neighbours. We should deepen co-operation with European Union agencies and member states. In a digital world, isolation only increases risk.

Those examples lay bare the crucial importance of the Bill and the devastating cost to businesses, consumers and our national security if we fail to get it right. The Bill cannot simply react to yesterday’s threats; we must ensure that our critical national infrastructure is prepared for the future, which means addressing over-reliance on high-risk foreign technology, and tackling the rapidly escalating threat of cyber-attacks powered by artificial intelligence, and on the internet of things, which is embedded in so much of what we use.

Digital sovereignty underpins everything else. We can no longer ignore the risks of over-reliance on American and Chinese technology, or rely on hostile, unpredictable states for our critical infrastructure. More than half of central Government organisations now run most of their systems on the cloud, and that all sits with just two companies, both American. The Government are the UK’s largest buyer of technology, but they almost never buy British. Since 2023, Palantir has won more than £420 million in public contracts across the national health service, the Met, the financial regulator, a city council and the Ministry of Defence. The latter’s £240 million contract was awarded without competition. Palantir is also an approved supplier on six public sector buying frameworks with a combined value of more than £9.7 billion—a route into Whitehall, the NHS, the police and our local councils.

[Martin Wrigley (Newton Abbot) (LD)]

Does my hon. Friend agree that it is a travesty that Palantir is not on the strategic suppliers list maintained by the Cabinet Office?

[Victoria Collins]

I thank my hon. Friend for that. There is so much that highlights that this is the wrong approach from our Government, and that we need to look not only at our suppliers, but at the importance of backing British technology. We believe that a digital sovereign strategy would change things. We need to back British innovation, reduce our dependencies and make our critical systems more secure. We need to look at each level of the tech stack and have a strategy that is right for the UK. I put that proposal to this House in June through new clause 13, which received cross-party support, but the Government and the Conservatives voted it down.

Sovereignty is not about doing this alone; it is about working globally while backing British. It is about becoming and staying world leaders in technology. It is about securing high-quality digital infrastructure that embeds us in global supply chains and makes the most of our incredible talent and skills. That would give us international leverage, not isolation. The Government say that sovereignty is covered by Departments across Whitehall, and last week’s Budget put another £60 million in the sovereign AI fund, but a venture fund and a patchwork of departmental reports are not a strategy.

The new powers on high-risk vendors in clause 44 allow the Government to react once a risky supplier is already in our system, but a strategy needs to be proactive. It needs to build British capability so that we never get to that point. Even industry is calling for a strategy, so I urge the Government to bring forward their own amendments on digital sovereignty.

Secondly, amendment 107, which passed in the Lords—a Cross-Bench amendment that Liberal Democrat peers supported—requires a review within a year of Royal Assent, and every year after that, of whether the regime is working, which sectors it covers, the supply chains, the regulators and the AI Security Institute. Given the fast pace of change in cyber-security, we urge the Government to support the amendment and to look at expanding the scope to local government, which holds our electoral rolls and our social records, and to retail, because a country that cannot feed itself is not resilient. We welcome the Government’s commitment in the other place to reviewing whether all critical national infrastructure sectors should be covered by this legislation and the Network and Information Systems Regulations 2018.

This week’s NCSC review warns that AI-powered malware is highly likely to be used in ransomware attacks on our critical infrastructure by 2028, yet there is still no clarity on who oversees AI in our cyber-defences: a single regulator, the AI Security Institute, or another body that is exactly right for the task. Our constituents and businesses need that clarity, because where there is trust in the regulatory environment, there is investment. People need to trust the technology; that is both pro-business and pro-society.

The Government need a plan for who does what, and they need it sooner rather than later. As Europe calls for a leaders’ summit on AI, I call again on the Government to convene a global AI summit, and to look towards an international AI safety agency, headquartered in the UK and modelled on the International Atomic Energy Agency, with a global treaty on pausing the development of super-intelligent AI.

Finally, none of this works unless those who are expected to deliver it can work. Small and medium-sized enterprises make up 99.8% of UK businesses and are often the most vulnerable link in the cyber-supply chains. This week’s discount on Cyber Essentials certification is welcome—the Liberal Democrats called for that—but it is time-limited; it ends in March, and the certificate must be renewed every year. Even the NCSC calls it only a starting point. SMEs need real support from a cyber-security support service when they are hit, to give them clear guidance.

On Second Reading, I compared this Bill to a house with stronger fences and a better alarm, but with its back door left wide open. The past few days alone have shown us why closing that door matters. I urge the Government to consider our amendments, for the communities and councils who rely on critical infrastructure, for the businesses integrated into every supply chain, and for every family who expect the services that they rely on to be there when they need them. We support the carry-over motion.