Lords Grand Committee

3 septembre 2026

Peers scrutinise Clauses 15 and 16 on cyber incident and customer notification requirements, challenging wide incident definitions, burdensome 24‑hour/72‑hour reporting, and the absence of near‑miss obligations, while the Minister defends current drafting, thresholds, consultation plans and signals limited willingness to revisit timelines and follow‑up duties.

Lords Grand Committee

15:26 - 15:45

Intervenant 2

The committee will adjourn as soon as the division bells are rung and resume after 10 minutes. Grand Committee on the Cyber Security and Resilience (Network and Information Systems) Bill. In Clause 15, Amendment 17, Baroness Neville-Jones.

15:45 - 17:51

Intervenant 3

My Lords, I rise to present Amendment 17 in my name. I'm also going to take Amendment 28 with it as it's closely related.

17 is in part a probing amendment about what constitutes an incident and the circumstances in which reporting is obligatory. Neither is it, this amendment that I'm presenting doesn't affect the amendment which the government I think is going to present immediately afterwards. Now, as drafted, clause 15 gives the very strong impression that an incident "capable of having" an adverse effect on security must be reported. If this is the case, it constitutes a much wider definition of what should be reported than if it were described as an incident which is "likely to have" an adverse effect.

Indeed, I think it's a widely held view that the, and it's certainly the case in the industry, and it's a point with which, however, I agree, that the likely to have would be far too wide a definition and would lead to extensive over-reporting and quite undue and unnecessary burden on regulators. So, looking at the drafting, I ask myself the question, well, what is the point of the capable of having definition in clause 15? And I'm going to put forward a hypothesis which it will be very helpful if the minister could confirm is the correct understanding of the existing draft and does not mean, does not mean that all incidents capable of having an adverse effect on security will need to be reported.

La suite de la transcription est réservée aux clients Pro

Débloquez la transcription complète, le chat et toutes les fonctionnalités d'analyse avec Polyfact Pro.

Posez une question sur cette vidéo — j'analyse sa transcription pour vous répondre.