The UK’s Cyber Security Bill Turns Executive Liability Into a Voluntary Code

UK peers used recent Cyber Security and Resilience Bill committee sessions to push for a rule that many company directors would not enjoy: personal civil liability for cyber failures at critical infrastructure firms. The government’s answer, delivered in the House of Lords Grand Committee, was to keep the stick pointed at the corporate balance sheet and leave boardroom accountability to a code companies can choose to ignore.

What the Bill Already Does

The Cyber Security and Resilience (Network and Information Systems) Bill is the UK’s first major rewrite of cyber regulation since the NIS Regulations 2018. It was introduced in the House of Commons in November 2025, cleared all Commons stages, entered the Lords on June 25, 2026, and completed its Lords second reading on July 14. Grand Committee scrutiny began on September 1 and runs across four sitting days, with the third day falling on September 7 and a final session scheduled for September 9. Royal Assent is expected by the end of 2026, though the bill’s substantive requirements will not take effect until roughly 2028, once the government finishes writing the secondary legislation that fills in most of the operational detail.

The bill extends the existing NIS framework, which currently covers operators of essential services in energy, transport, health, drinking water, and digital infrastructure, to three new categories: relevant managed service providers, data centres (regulated for the first time, following their 2024 designation as UK critical national infrastructure), and “designated critical suppliers,” a mechanism that lets regulators pull a company into the regime because of who its customers are rather than what sector it sits in. Oversight of the newly covered managed service providers and digital service providers moves to the Information Commission, the reconstituted successor to the ICO.

Reporting obligations also tighten. Regulated entities must send an initial notification within 24 hours of becoming aware of a significant incident, followed by a fuller report within 72 hours, both routed to the relevant regulator and to the National Cyber Security Centre. Penalties run on two tiers: up to £17 million or 4 percent of global annual turnover, whichever is higher, for serious contraventions, and up to £10 million or 2 percent for less serious ones, with daily penalties for continuing non-compliance.

The Personal Liability Fight

What the bill does not do, and what a group of peers spent committee time trying to change, is put any of that exposure on the individuals running a regulated organization. Baronesses Kidron and Ludford backed probing amendments that would have introduced personal civil liability for senior executives when a compliance failure involved their “consent, connivance, or deliberate or careless neglect,” a standard borrowed from established UK provisions such as the Health and Safety at Work Act. “The intention behind the amendment is to change the culture of an organization, to ensure preventative action is taken, to avoid penalties,” Baroness Kidron told the committee, adding that “culture change starts at the top.”

Lord Clement-Jones made the case in blunter terms: “If an individual is fit to draw a multimillion-pound executive salary running a critical national provider, they must be prepared to carry personal responsibility for securing it.” Peers supporting the amendments pointed to financial-sector rules that have imposed personal regulatory or criminal liability on the C-suite for years, and argued the change would bring the bill closer to the EU’s NIS2 directive.

Cybersecurity minister Baroness Lloyd of Effra declined to accept the amendment. Her defense rested on two pillars already in the bill: the corporate fines, and forthcoming secondary legislation that will mandate board-level governance requirements aligned with the National Cyber Security Centre’s Cyber Assessment Framework, covering “organisational capability, senior responsibility, and accountability for security and resilience and effective risk escalation.” The government, in other words, is committing to make boards demonstrably responsible for cyber risk, just not personally and legally liable for it.

A Voluntary Code With a Mixed Track Record

The government’s fallback for board accountability already exists, and it is voluntary. The Cyber Governance Code of Practice, published in 2025 by the Department for Science, Innovation and Technology with the National Cyber Security Centre, sets out what boards and directors should be doing to govern cyber risk, backed by a companion training program and toolkit. It was designed as a minimum bar, not a legal floor.

The government’s own data on how that voluntary approach is performing is mixed enough to explain why peers are unconvinced. The 2025/2026 Cyber Security Breaches Survey, commissioned by DSIT and the Home Office, found board-level responsibility for cyber security at 31 percent of UK businesses, up from 27 percent the year before. The government’s own report calls that increase a reversal of “the longer-term downward pattern seen earlier in the decade.” Read the other way, fewer than a third of UK businesses have board-level ownership of cyber risk even after the improvement, and senior management treats cyber security as a high priority at 72 percent of businesses but only 60 percent of charities, itself a decline from 68 percent the year before. Voluntary codes and toolkits have coexisted with those numbers for more than a year.

The NIS2 Comparison Does Not Quite Hold Up

One argument made in committee is worth checking against the source material: that personal liability for senior managers would bring the UK bill in line with the EU’s NIS2 directive. It would not, at least not as a matter of EU law. Individual liability for management bodies is not a mandatory requirement under NIS2; the directive leaves enforcement design, including whether to attach personal consequences to a management body’s failure to ensure compliance, to each member state, and EU countries have implemented that discretion differently in their own transposing legislation. The UK bill already departs from NIS2 in other ways, including its own bespoke categories for managed service providers and designated critical suppliers, so the comparison is more rhetorically convenient than legally precise.

A Pattern of Deferred Detail

The personal liability amendment was not the only place the government pointed toward the future rather than the bill’s own text. Separately in committee, peers challenged the wording of the incident reporting duty itself, warning that defining a reportable incident as one “capable of” having an adverse effect, rather than “likely to have” one, would flood regulators with defensive reports. Former security minister Baroness Neville-Jones pushed for the narrower wording, and Lord Clement-Jones agreed, warning the current drafting would “unleash an administrative tsunami of defensive reporting.” Clement-Jones separately argued that the bill’s definition of a data compromise was too broad, warning it would sweep in “technical data anomalies that cause zero disruption or loss to actual customers.”

An independent line-by-line review of both committee transcripts, posted publicly after reading the roughly 67,000 words of Hansard record from the bill’s first two sitting days, counted several other instances of the same pattern: reporting thresholds for what counts as a “significant impact” left to a consultation that has not started, the specific factors that trigger a data centre incident report left undefined even though equivalent factors exist in the bill for every other regulated entity, and a Baroness Harding-backed push to align UK reporting with NIS2’s staged 14-day and one-month timelines rejected in favor of the existing 24-hour and 72-hour deadlines. AI systems are not named anywhere in a bill with “cyber” in its title, leaving their regulatory status, if any, to a vendor-direction power the government has not yet defined. The one piece of the enforcement regime that is fully drafted today, as that review points out, is the penalty.

What Happens Next

Grand Committee scrutiny concludes at the fourth sitting day on September 9, after which the bill moves to report stage in the Lords, where the personal liability question is likely to resurface as a formal amendment rather than a probing one. Even if peers succeed at report stage, the bill still needs Commons agreement to any changes before Royal Assent. And Royal Assent itself only starts the clock on a longer wait: the specific board-governance requirements the minister described in committee, the incident-reporting thresholds, and the data centre and managed-service-provider scope details all depend on secondary legislation the government has not yet consulted on, with substantive effect not expected until around 2028.

For organizations that will fall under the expanded regime, especially the newly covered managed service providers and data centre operators, the practical takeaway is not the personal liability fight itself but what it reveals: the framework is largely settled, the penalties are already fixed in the bill’s own text, and almost everything else, including exactly what a board will be measured against, is still being written.

Sources

• The Register: Peers ask why UK cyber bill leaves execs off the personal liability hook
• UK Parliament: Cyber Security and Resilience (Network and Information Systems) Bill
• ComplianceHub.Wiki: The UK’s Cyber Security and Resilience Bill Reaches Lords Committee
• National Cyber Security Centre: Cyber Assessment Framework
• GOV.UK: Cyber Security Breaches Survey 2025/2026
• Independent review of both Lords committee day transcripts (via OffSeq Threat Radar)

Related reading on sxz.io: Docker Puts EU Cyber Resilience Act Deadlines on Container Teams’ Calendar, a look at the EU’s separate product-security regulation.

Featured image: House of Lords, November 2007 by Herry Lawford, CC BY 2.0, via Wikimedia Commons; resized and converted to WebP.