Peers forced ministers to explain why they leave new technologies out of the UK's cyber security regime. The clause creating that duty names the wrong subsections, so nothing on its list can ever trigger one.
Estimated reading time: 7 minutes
In short. On 26 October 2026 the House of Lords voted 202 to 155 to insert a new clause into the Cyber Security and Resilience (Network and Information Systems) Bill, moved by the crossbench peer Lord Birt against the government's wishes [4]. It requires the Secretary of State to review the whole regime within a year and, on completing that review, to report to Parliament the reasons for not bringing within scope "any activity mentioned in subsection (4) or (5)" [3]. Subsections (4) and (5) do not mention any activity capable of being brought into scope: they cover reviewing existing regulatory thresholds and the institutional framework. The actual list of six candidate activities, from cloud services to frontier AI to political parties, sits in subsection (3)(c), which the same subsection 8 cites correctly two paragraphs earlier, at 8(a) [3]. Before the vote, the Lords' own Deputy Speaker read out three cross-referencing corrections to the amendment on the floor of the House. This one was not among them, and the Bill, now before the Commons, still contains it [4] [1]. Two documented mistakes: four stars.
The Cyber Security and Resilience (Network and Information Systems) Bill is the government's vehicle for updating the UK's 2018-era network and information systems rules, and this site has examined two of its other Lords-inserted clauses already: a foreign-powers register with no penalty for a missed deadline, and a vendor risk power switched on by an undefined trigger [7] [8]. Report stage in the Lords, on 26 October, was the first point at which peers could force a vote rather than simply debate, and they used it twice: Amendment 164, Lord Markham's foreign-powers register, passed 194 to 155, and Amendment 163, Lord Birt's regime-wide review, passed 202 to 155 [4]. Both are now sections 67 and 66 of the Bill as printed after Report [3]. The Bill cleared Third Reading in the Lords on 2 November, unchanged on this clause, and is now before the Commons, which has yet to schedule its consideration of the Lords amendments [2] [5].
The claims, tested
| The clause's own words | What the rest of the same clause actually does | Verdict |
|---|---|---|
| Section 66(8): on completing the review, the Secretary of State must report "the findings of the review on each of the matters mentioned in subsections (2) and (3)" (paragraph (a)), and separately, "the reasons for not bringing within scope any activity mentioned in subsection (4) or (5)" which is not brought within scope (paragraph (c)) [3] | Subsection (3)(c) lists six candidate activities for the review to consider bringing into scope: critical national infrastructure, digital infrastructure including cloud, software-as-a-service and content delivery networks, frontier AI systems, democratic processes, advanced manufacturing and life sciences, and sectors including education and large-scale retail distribution [3]. Subsection (4) covers whether existing essential activities are "appropriately defined and effectively regulated" and whether current thresholds leave gaps. Subsection (5) covers the institutional framework: the roles of the National Cyber Security Centre, the Information Commission and the AI Security Institute, and the obligations on persons already within scope [3] | Paragraph (a), three lines above, correctly points to the subsection that lists candidate activities. Paragraph (c) points somewhere else. No activity is "mentioned in subsection (4) or (5)", so the reasons-for-exclusion duty, read literally, has nothing to attach to |
| Peers were told the amendment would create what Lord Clement-Jones called, in debate, "a comply or explain mechanism requiring the Government to state publicly why any excluded sector was not being brought into scope" [4] | Immediately before the division, the Deputy Speaker, Baroness Morris of Bolton, told the House: "There are three cross-referencing errors in the Marshalled List," and read out corrections to subsection (9) (a reference to "(10)" should read "(8)") and subsection (10) (two references, to "(8)" and to "(10)", should read "(7)" and "(8)") [4]. The final printed text incorporates exactly those three fixes [3] | The House corrected the errors it had found. Subsection 8(c)'s cross-reference to "(4) or (5)" was not one of them, and nobody has corrected it since |
A reasons duty pointed at the wrong two subsections
Clause 66 is a genuinely ambitious piece of drafting for a backbench amendment. Subsection (1) requires the Secretary of State to review the effectiveness of the whole NIS regime within twelve months of Royal Assent. Subsections (2) and (3) set what the review must cover, including, at 3(c), the six candidate activities for expansion: cloud services, software-as-a-service and content delivery networks; frontier AI systems and "other frontier agentic technologies"; democratic processes, including election administration and political parties; advanced manufacturing and life sciences; and sectors of social importance such as education and large-scale retail distribution of essential goods [3]. Subsections (4) to (7) set out what the Secretary of State must assess, consider and consult on along the way. Subsection (8) is the accountability hinge: once the review is done, the government has to lay a report before Parliament, and that report must give reasons for any of those six candidates it chooses to leave out.
That is the mechanism Lord Markham, speaking in support of the amendment, described to the House as requiring "a mandatory interim report" and "a comply or explain mechanism requiring the Government to state publicly why any excluded sector was not being brought into scope" [4]. The text delivers half of it. Paragraph 8(a) correctly requires the report to cover "the findings of the review on each of the matters mentioned in subsections (2) and (3)", which is where the candidate activities live [3]. Paragraph 8(b) requires the report to list which activities the Secretary of State does intend to bring into scope. Paragraph 8(c), the one paragraph whose entire job is to force an explanation for activities left out, requires reasons "for not bringing within scope any activity mentioned in subsection (4) or (5)" [3]. Subsection (4) is about reassessing activities already inside the regime, not candidates for joining it. Subsection (5) is about who runs the regime, not what it covers. Neither subsection names a single activity capable of being "brought within scope". As drafted, a government report that says nothing at all about why cloud providers, frontier AI developers or political parties were left out would still satisfy paragraph 8(c), because none of them is "mentioned in subsection (4) or (5)" to begin with.
Three corrections read out before the vote. A fourth was not.
This is not a case of quietly spotting a typo nobody else noticed. Immediately before the division on Amendment 163, Lord Clement-Jones, one of its four named supporters, told the House: "I wonder whether the Deputy Speaker has the details of some of the typos in the amendment so that we do not vote on something that will have to be changed at Third Reading" [4]. The Deputy Speaker, Baroness Morris of Bolton, answered him directly: "There are three cross-referencing errors in the Marshalled List. In the proposed new clause in this amendment, in subsection (9), the cross-reference to subsection (10) should instead read subsection (8). In subsection (10), the second cross-reference to subsection (8) should instead read subsection (7), and in subsection (10), the cross-reference to subsection (10) should instead read subsection (8)" [4]. The House then divided and passed the amendment, corrected, 202 to 155.
Checking the final text against that correction shows it was properly carried through: subsection (9) now reads "where a report under subsection (8) concludes", and subsection (10) now reads "in accordance with subsections (1) to (7)" and "the matters mentioned in subsection (8)", exactly as the Deputy Speaker specified [3]. Nobody, in the debate transcript, raised subsection 8(c)'s reference to "(4) or (5)". The Third Reading marshalled list, published four days later, confirms the clause was not touched again: the only amendments tabled for that stage concerned clauses 2, 24, 36 and 42, none of them clause 66 [5]. The clause passed the Lords with the three flagged errors fixed and the fourth, unflagged one still in place.
A regulator renamed since this bill was introduced
A smaller inconsistency sits in the same clause. Subsection 3(d) lists the bodies whose roles the review must examine and names "the Information Commissioner" [3]. Subsections 5(a) and 7(b), covering the same regulator a few lines later, both say "the Information Commission" instead [3]. The two are not interchangeable drafting conventions. The Data (Use and Access) Act 2025 abolished the office of Information Commissioner and transferred its functions to a new board-led body, the Information Commission, under commencement regulations that took effect on 30 September 2026, four weeks before the Lords voted on this amendment [6]. The same Act provides that references to the old office in UK law are to be read as references to the new one [9], which likely saves subsection 3(d) from any real legal gap. It does not explain why a clause drafted and voted on after the renaming uses the old title in one place and the new one in two others.
Two documented mistakes, four stars. (1) Section 66(8)(c) requires the government's report to give reasons for not bringing within scope "any activity mentioned in subsection (4) or (5)", but neither subsection names a candidate activity; the actual list sits in subsection (3)(c), which paragraph 8(a) of the same subsection cites correctly two lines above. As drafted, the reasons-for-exclusion duty the clause's own supporters described to the Lords as a "comply or explain mechanism" has no activity it can attach to. (2) The clause refers to the data protection regulator as "the Information Commissioner" in subsection (3)(d) and "the Information Commission" in subsections (5)(a) and (7)(b), four weeks after the office of Information Commissioner was abolished by law.
Credit where due
The errors that were caught were caught properly, and in public. Lord Clement-Jones raised the possibility of typos from the floor before the vote, not after; the Deputy Speaker read out three specific corrections rather than letting the House vote on an uncorrected text; and the final print shows all three fixes were carried through accurately [4] [3]. That is the parliamentary process working as it should, under time pressure, on a four-peer, cross-party amendment assembled without the drafting resources of a government bill team. The substance of the review itself is also serious rather than cosmetic: subsection (3)(d) is right to flag that eighteen separate regulators share responsibility for this regime, and the amendment's sponsors used the debate to press a specific, answerable question about whether the AI Security Institute should gain formal audit powers over frontier systems, not just to gesture at AI in general terms [3] [4].
Verdict
Four stars, from two documented mistakes. The government itself opposed this amendment and lost the vote 202 to 155, so there is no reason to expect ministers to volunteer a fix for a defect that currently works in their favour: a reasons-for-exclusion duty that, read literally, excuses them from explaining anything. The Bill is now with the Commons, which has not yet set a date to consider the Lords' amendments. Until it does, or until the drafting is tidied up at a later stage, section 66(8)(c) commits the government to justify leaving out nothing at all.
Sources
- Cyber Security and Resilience (Network and Information Systems) Bill, UK Parliament Bills API, bill record, current stage Consideration of Lords amendments.
- Bill stages, UK Parliament Bills API, including Third Reading on 2 November 2026 and Consideration of Lords amendments with no sitting date yet scheduled.
- HL Bill 62 (as amended on Report), full bill text, UK Parliament Bills API, 26 October 2026.
- Cyber Security and Resilience (Network and Information Systems) Bill, Report stage, House of Lords, Hansard, 26 October 2026.
- HL Bill 62-I, Marshalled list of amendments to be moved on Third Reading, UK Parliament Bills API, 30 October 2026.
- The Data (Use and Access) Act 2025 (Commencement No. 9 and Transitional and Saving Provisions) Regulations 2026, legislation.gov.uk, bringing sections 118 and 119 into force 30 September 2026.
- A register of hostile cyber states was forced into the government's bill by an opposition vote in the Lords. The clause that creates it has no penalty if a minister simply misses its deadline., trackedchanges.co.uk, 2 November 2026.
- A new power in Britain's cyber security bill lets ministers force energy, water and NHS suppliers to report vendor risks. It stays voluntary until the risk profile changes, a test the government never defines or dates., trackedchanges.co.uk, 4 November 2026.
- The Information Commission, Information Commissioner's Office, summary of Data (Use and Access) Act 2025 changes.