Kanishka Narayan
MP for Vale of Glamorgan · Labour · United Kingdom
“Let me say three things. First, it is important to be clear on the data. The estimates that we have at the moment suggest data centres account for approximately 0.2% of non-household water usage in England. Secondly, when people build data centres here, we want them to build in the light of our values and what local communities need.”
House of Commons15 October 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“We work closely with the Department for Environment, Food and Rural Affairs, the Department for Energy Security and Net Zero and Departments across Government to ensure that critical infrastructure developments are sustainable for local resource capacity.”
House of Commons15 October 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“We already have a series of areas of regulatory focus for artificial intelligence—data protection, competition policy, equality legislation and online safety. I was particularly proud that we were one of the first countries to ensure that the egregious impacts of AI chatbots on our children were mitigated.”
House of Commons15 October 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“I thank the hon. Member for raising the advances of Culham in particular. I visited the site; I take great pride in it, as a national asset when it comes to nuclear fusion and the combination of AI and energy innovation. On his point about the G20, I am proud that the Prime Minister has set out that AI will be top of the agenda.”
House of Commons15 October 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“I thank my right hon. Friend for his advocacy and leadership on this matter over the course of the last many weeks. I have mentioned already this week that I want to work with parliamentarians across the House, including him and members of his Committee, on ideas for the Cyber Security and Resilience (Network and Information Systems) Bill…”
House of Commons15 October 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“I thank my hon. Friend, whose question is one we have discussed at length. The central point is that in the last wave of technology, we built neither public trust nor British technology. In this wave of AI, we are focused on building both trust and technology so we can have sovereign control over what we are building here.”
House of Commons15 October 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
The complete record
722 held · 588 searchable for Kanishka Narayan. The searchable lines are below in date order, each linked to its source. Free to read, in full, without an account. Page 9 of 10.
This is not an official version of UK Parliament proceedings. It reproduces the published record and links to it; the official version is the one UK Parliament publishes.
“At present, however, the Government lack powers to require regulated entities to take necessary action in response. That gap could be exploited with increasing frequency and impact. The clause will remedy that, ensuring that the Government have the necessary powers to act quickly to protect our national security.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“Clause 43 grants the Secretary of State the power to direct an NIS-regulated entity to take necessary and proportionate actions in response to national security threats. The power can be used where the entity’s network and information systems have been compromised or there is a threat of such compromise. The clause sets out the sorts of action that a direction could require. A direction could, for example, require an energy provider to take action to remove a hostile actor’s presence from their networks, in response to intelligence that a hostile state actor was pre-positioned for an attack. Cyber-attacks on NIS sectors represent a serious and growing threat to the UK’s national security. High-capability actors and hostile states can mount increasingly targeted and sophisticated attacks.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“To return to the point made by my hon. Friend the Member for Milton Keynes Central about the Bill’s provisions, the Bill looks at particular risks posed by hostile states, related actors and a wide range of other actors. Network and information systems for essential services and the identity of risk sources may be one consideration for organisations and regulators as well as the NCSC. The Bill does not look at specific actors but the outcome of the risk. Of course, hostile actors are an important part of that. I am happy to write to my hon. Friend about wider initiatives outside the Bill, particularly in the public sector, which I know is an important concern for her in relation to hostile state actors. There are a range of initiatives that the Government are taking forward in that context.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“A direction could therefore require an entity not to report that national security risk for the period in which the risk was being remedied. They may ordinarily have had to report that national security risk to comply with standard reporting requirements. The clause will resolve that conflict and provide certainty to recipients of directions about what they must do to ensure that the national security risks in a direction are addressed.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“I could not judge a specific situation but, broadly speaking, that is the sort of situation, especially if it is an NIS-regulated entity, and in particular where the exercise of the power is focused on the entity’s network and information systems, that I would expect to come in scope of the powers specified here. Under clause 44, a direction can be issued only when necessary for national security. It is possible that, in some circumstances, what is needed to protect UK national security could conflict with standard regulatory duties. For example, a direction might relate to a particularly sensitive national security risk, where only those involved in addressing the risk should be aware of it. That is to minimise the risk of hostile actors becoming aware of a vulnerability.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“The clause also grants these powers to regulators, where the regulator has been directed or requested to monitor compliance on behalf of the Secretary of State. This will ensure that they can provide the Secretary of State with the most accurate information. I commend the clauses to the Committee.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“Clause 47 grants the Secretary of State the power to carry out or delegate inspections needed to assess compliance with a direction, or with a confirmation decision specifying actions to be taken in the event of non-compliance. The Secretary of State is responsible for judging whether a regulated entity is complying with a direction, and therefore needs access to relevant information that the regulated entity holds. In some cases, this may not be possible to verify without physical attendance. To ensure the effective use of time and resources, the Secretary of State will have the power to appoint a person to carry out an inspection on their behalf, or to direct the recipient of a direction to appoint an approved inspector.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“The Secretary of State would then determine how they would like to receive this information—for example, in reports or at regular intervals. Clause 46 grants information-gathering powers to the Secretary of State and to regulators that are subject to a monitoring direction or request. In order to determine whether an incident or threat meets the bar for issuing a direction, or whether a regulated entity is complying with the direction, the Secretary of State will need information from that entity and potentially other parties. The clause establishes the power for the Secretary of State to request that information. As the monitoring of compliance with the direction may be delegated to NIS regulators, the clause also equips those regulators with the power to request information needed for their monitoring functions.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“This group of clauses concerns how compliance with national security directions will be monitored. Clause 45 enables the Secretary of State to delegate the task of monitoring compliance with the direction issued under clause 43 to a NIS regulator. Regulators have valuable sectoral expertise and existing relationships with the entities they regulate. As such, it may be effective to delegate monitoring of compliance to the relevant regulator. The Secretary of State will retain the sole ability to make judgments about whether non-compliance has occurred, or if any penalty is appropriate. The regulator would be required to obtain information relating to compliance, to be shared with the Secretary of State.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“I am grateful to the hon. Gentleman for his points about proportionality and scrutiny. I want to give him assurances about that, as I did in our earlier conversation. On cross-border compliance, the hon. Gentleman rightly points out that relevant information can be requested, regardless of whether it is held the UK. I am very happy to write to him with further detail on our ongoing engagement with counterparts elsewhere. During this process, we have engaged more broadly to understand other regulatory regimes and ensure compliance with them. Question put and agreed to. Clause 45 accordingly ordered to stand part of the Bill. Clauses 46 and 47 ordered to stand part of the Bill. Clause 48 Notification of contravention Question proposed, That the clause stand part of the Bill.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“This group of clauses concerns the enforcement of directions issued by the Secretary of State. I shall speak to them in turn. Clause 48 grants the Secretary of State the power to issue a notice of contravention where they believe an entity is failing or has failed to comply with requirements relating to a direction. A regulator that has been tasked with monitoring a regulated entity’s compliance with a direction will also be able to issue a notification of contravention relating to an information notice or inspection issued by the regulator. It would not be appropriate for a regulator to judge compliance with a direction issued under clause 43 or any other requirement imposed by the Secretary of State.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“I ask the Committee to support the clauses in order to enable the effective enforcement of directions issued by the Secretary of State to protect the UK’s national security.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“Clause 52 grants the Secretary of State the power to enforce non-disclosure requirements imposed in relation to the issuing of a direction, notice of contravention or final confirmation notice. Failure to respect these requirements could harm national security, for example by exposing vulnerabilities in the UK’s essential services or the security mitigations being put in place to protect their network and information systems. As a result, it is crucial that the Secretary of State has adequate powers to enforce non-disclosure requirements. Clause 52 largely replicates the enforcement process for non-compliance with other requirements of directions issued by the Secretary of State. The maximum penalties will be £10 million or £50,000 per day.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“The notice of confirmation is the mechanism through which the Secretary of State or regulator can issue their final determination about the actions an entity needs to undertake to correct or remedy a contravention, and the penalties it will need to pay, in accordance with the provisions in clause 49. A confirmation decision can be issued only after a directed entity has had the opportunity to make representations about an earlier notice of contravention. Once it has been issued, the directed entity must comply with it, and this duty can be enforced through civil proceedings. In short, clause 50 ensures that a direction can be enforced effectively and appropriate action taken to penalise non-compliance. Clause 51 sets out how penalties will be recoverable across the nations of the UK in the event of non-payment.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“It is also why the maximum penalties have been set at a significantly higher level than they have for the updated NIS enforcement regulations in clause 21. The better comparison in that context is the penalty threshold for national security powers in the Telecommunications (Security) Act 2021, which align with the provisions in clause 49. Clause 50 grants the Secretary of State and, where relevant, regulators the power to issue a final confirmation notice for non-compliance with a direction or related requirements. The clause specifies that the Secretary of State or regulator can issue a confirmation notice where they have previously notified an entity of suspected non-compliance, and where they are now satisfied that non-compliance has occurred.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“For requirements concerning the provision of information or inspections, the maximum penalty for non-compliance is set at £10 million. Clause 49 also provides for daily penalties to be issued. These are set at £100,000 a day for non-compliance with a direction and £50,000 a day for related requirements. They will continue in force until the entity has complied with the relevant requirement. A regulator that has been tasked with monitoring a regulated entity’s compliance with a direction will be able to issue penalties for non-compliance with an information notice or inspection issued by the regulator. These provisions have been designed to reflect the gravity of non-compliance with a national security direction and the necessity of ensuring that directed entities comply with the requirements that directions impose.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“The ability to issue a notice of contravention is an important procedural mechanism. It gives directed entities the opportunity to address non-compliance before penalties are imposed through a final confirmation decision, and increases the likelihood that the requirements of a direction will be met. That is vital, given the national security risks that a direction is intended to address. Clause 49 empowers the Secretary of State to determine appropriate and proportionate penalties for non-compliance with a direction. It sets an upper threshold on what the penalties can be. For non-compliance with a direction, penalties are fixed at the greater of £17 million or 10% of turnover for undertakings, subject to turnover and undertaking being defined in regulations, and £17 million for non-undertakings.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“I am reluctant to engage in the specifics of incidents without knowing the full range, but I would expect there to be an initial period of engagement to get to a position of agreement. Where the Secretary of State’s directions are not complied with in the context of a disagreement of the sort that the hon. Gentleman points out, penalties for non-compliance will be available to the Secretary of State. They will have to be justified both in the moment and subsequently, in the light of the particular provisions of the Bill. The clause sets out the circumstances in which the Secretary of State and relevant regulators can issue a notice of contravention and the details that such a notice should contain, including the steps that an entity should take to rectify or remedy an act of non-compliance and the penalties that are being considered.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“I have two points to make to the shadow Minister on defining turnover. As he will be well aware, “turnover” is a technical term that is best defined in secondary legislation, to keep up to date with accounting principles that at times vary from sector to sector. He asked for factors that might contribute to definitions. The specific determination of turnover will be set out secondary legislation, but we intend to establish a presumption that only the turnover of the regulated entity that breaches the direction will be considered for determining penalties on this point. Question put and agreed to. Clause 48 accordingly ordered to stand part of the Bill. Clauses 49 to 52 ordered to stand part of the Bill. Clause 53 Power to direct regulatory authorities Question proposed, That the clause stand part of the Bill.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“To ensure that regulated entities are able to make representations, the Secretary of State is required to consult them before a direction is varied, where practicable. This requirement does not apply if consultation would be detrimental to the interests of national security.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“This power will not extend to other Government Departments or devolved Governments, for which any actions to mitigate significant national security threats will be agreed through engagement. Given the changing nature of national security threats, there may be times at which a national security direction needs to be varied or revoked. Clause 54 introduces powers for the Secretary of State to change the content of a direction, or revoke it altogether, where it is necessary and proportionate to do so in the interests of national security. The Secretary of State will be able to vary a direction to add new requirements, or to simplify directions by removing requirements that are no longer needed.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“The current system requires regulated entities to undertake “appropriate and proportionate” measures to secure themselves against cyber-threats. Regulators issue guidance to their sectors to help them to interpret that duty. However, geopolitical or technological developments could lead to rapid, unexpected increases in the cyber-threat that quickly leave whole sectors vulnerable and create a national security risk. In such circumstances, it is essential that the Secretary of State can leverage the expertise and powers of NIS regulators to drive the implementation of enhanced security procedures and practices. For example, they may need to direct a regulator to issue an urgent advisory to its sector regarding new cyber-threats or to update guidance on what measures are “appropriate and proportionate” for them to take.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“This group concerns the power for the Secretary of State to issue directions to the NIS regulators, as well as general provisions relating to the power and the power to direct regulated entities. That includes the procedure for reviewing, varying or revoking directions, the procedure whereby Parliament can scrutinise these directions, how information concerning directions can be shared, the means by which directions can be issued and the clarifications of key terms concerning part 4 of the Bill. I shall speak to each clause in turn. Clause 53 grants the Secretary of State the power to direct NIS regulators in the exercise of their NIS functions, where it is necessary and proportionate in the interests of national security.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“Clause 53 accordingly ordered to stand part of the Bill. Clauses 54 to 56 ordered to stand part of the Bill. Clause 57 Means of giving directions and notices Amendments made: 23, in clause 57, page 83, line 8, at end insert— “(za) an email address provided to a regulatory authority as an address for contacting that person,” This amendment would ensure that a direction or notice can be given to a person using an email address which has been provided to a regulatory authority as a contact email address. Amendment 24, in clause 57, page 83, line 11, leave out “there is no such published address” and insert— “no email address has been so provided or published”.— ( Kanishka Narayan.) This amendment is consequential on Amendment 23. Clause 57, as amended, ordered to stand part of the Bill. Clause 58 ordered to stand part of the Bill.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“On the shadow Minister’s first point, I repeat what I said earlier and, of course, acknowledge his concern. I assure him that, while a direction can only be issued out of necessity for national security, it does not follow that public knowledge of that direction or its contents would compromise national security. I would expect a pretty extensive scope of such directions and, therefore, an appropriate channel of scrutiny in Parliament. On his question of protocols to ensure information shared is not just proportionate in general, but specific to the purpose of national security specified, I am happy to give him the assurance that the Bill contains it and that, in the process of working out implementation, we will make sure that regulators are focused on developing those protocols. Question put and agreed to.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“A political party is a governing political party of a foreign government if persons holding political or official posts in the foreign government or part of the foreign government— (i) hold those posts as a result of, or in the course of, their membership of the party, or (ii) in exercising the functions of those posts, are subject to the direction or control of, or significantly influenced by, the party.” This new clause would require the Government to maintain a register of state actors posing a threat to UK cyber security for the purposes of exercising the Secretary of State’s powers under Part 4 of the Act, which enable the giving of directions in the interests of national security. — (Dr Spencer.) Brought up, and read the First time.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“(4) In this section, “foreign power" means– (a) the sovereign or other head of a foreign state in their public capacity; (b) a foreign government, or part of a foreign government; (c) an agency or authority of a foreign government, or of part of a foreign government; (d) an authority responsible for administering the affairs of an area within a foreign country or territory, or persons exercising the functions of such an authority; or (e) a political party which is a governing political party of a foreign government.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“(2) Foreign powers designated by the Secretary of State under subsection (1) must include states – (a) which have been confirmed by GCHQ as having— (i) perpetrated, or attempted to perpetrate, a cyber-attack in the UK in the preceding seven years, (ii) targeted, or intended to target, that attack at the network or information systems of one or more operators of an essential service or critical suppliers, or (iii) carried out, or intended to carry out, that attack through a state department, agency or affiliate group, (b) which GCHQ has warned pose a risk to the security or resilience of the network or information systems of one or more operators of an essential service or critical suppliers. (3) Regulations under this section are subject to the affirmative resolution procedure.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“New Clause 2 Register of foreign powers for the purposes of Part 4 “(1) For the purposes of informing action taken under Part 4 of this Act, the Secretary of State must, by regulations, establish and maintain a register of foreign powers that the Secretary of State believes present a risk to the United Kingdom’s critical network and information systems within six months of the passing of this Act.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“All remaining measures will be brought into force via regulations, allowing the Secretary of State to sequence implementation in a way that is practical and proportionate, allowing for transitional arrangements and business adjustments. That also allows sufficient time for the implementing regulations to be made and scrutinised, and is required to make operational and implement the new, stronger framework. Clause 61 clarifies that the Bill can be referred to as the Cyber Security and Resilience (Network and Information Systems) Act 2026 once passed. Question put and agreed to. Clause 59 accordingly ordered to stand part of the Bill. Clauses 60 and 61 ordered to stand part of the Bill.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“I will speak to clauses 59, 60 and 61 in turn. Clause 59 clarifies that the Bill’s provisions apply to England and Wales, Scotland and Northern Ireland. That is consistent with the Network and Information Systems Regulations 2018. Effective implementation is key to a successful regime. Clause 60 outlines the phased commencement timings of the provisions, ensuring that they commence at an appropriate time. Some of the provisions will commence upon Royal Assent, or two months after Royal Assent, allowing the Government to begin implementing the regime without delay. That includes powers for the Secretary of State to lay important secondary legislation required to operationalise some measures in the Bill upon Royal Assent, and the power to publish a statement of strategic priorities at month two.”
House of Commons10 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“Part 2 also updates the existing incident-reporting regime and includes provisions relating to the recovery of regulators’ costs, information-gathering and sharing powers, and enforcement powers. Part 3 gives new powers to the Secretary of State to specify other sectors as in scope of the regulations in future, to create new regulations relating to the security and resilience of regulated services, and to issue a code of practice and a statement of strategic priorities. It also requires the Secretary of State to report on this legislation and its implementation. Finally, part 4 gives new national security powers for the Secretary of State to issue directions. I commend the clauses to the Committee.”
House of Commons5 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“It is a pleasure to see you in the Chair, Mr Stringer. The Bill will make crucial updates that build on the NIS regulations, which are the UK’s only cross-sector cyber-security regulations. As clause 1 sets out, “NIS regulations” refers to the Network and Information Systems Regulations 2018 (S.I., 2018, No. 506). Clause 2 gives an overview of the Bill’s parts and what they include. It sets out that part 2 amends the NIS regulations by expanding the scope of the regulations to cover data centres, large load controllers and managed service providers. It also introduces powers for regulators to designate suppliers as being critical for their sector.”
House of Commons5 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“Clause 1 accordingly ordered to stand part of the Bill. Clause 2 ordered to stand part of the Bill. Clause 3 Identification of Operators of Essential Services Question proposed , That the clause stand part of the Bill.”
House of Commons5 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“On critical suppliers, which no doubt we will come on to, I thought that in response to Opposition comments at our second sitting, I set out a very clear, precise set of tests. I found no opposition to that claim, but I look forward to hearing any original thoughts on that question. On incident reporting, I was delighted that there was a witness who noticed that the extension of the definition of incident reporting, to include incidents capable of having an impact, was appropriate and exactly in the right place. On the question about the public sector’s inclusion, we are here not to prescribe and wait for a law to tell us what we ought to do in the public sector, but instead to move fast and fix things. In that spirit, the Bill focuses on essential services. Question put and agreed to.”
House of Commons5 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“I welcome some of the Opposition spokesperson’s comments. Let me briefly address his questions about definitions and public sector inclusion. It is customary for the Opposition to oppose for the sake of opposition, at times, and I am afraid that this is one of those times; I have so far set out only two clauses, which are effectively an index to the Bill. Notwithstanding that, I will address his two particular points. I was delighted that in our evidence sessions we heard from witness after witness who appreciated the flexibility of the Bill. For the Government to prescribe activities or incident thresholds in the finest detail in primary legislation is not how businesses, Government and regulators ought to engage. I hope that the Opposition will come to appreciate that in due course.”
House of Commons5 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“The amendments in clause 3 will prevent telecoms companies from being subject to duplicate regulations; they will also ensure that all essential services in the UK are protected, even if the company operating them is based outside the UK. I commend the clause to the Committee.”
House of Commons5 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“Clause 3 makes important distinctions as to which organisations can and cannot be considered operators of essential services for the purposes of the NIS regulations. It clarifies that a person—in practice, an organisation or business—can be an operator of an essential service regardless of whether that person is established in the UK, as long as they are providing essential services in the UK. That means that organisations established outside the UK can be regulated under the NIS regulations. Clause 3 also makes it clear that the NIS regulations do not apply to public electronic communications networks or to public electronic communications services. Those are telecoms operators, which are regulated separately under the Communications Act 2003.”
House of Commons5 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“On the question about cross-border compliance and making sure that we have a proportionate and effective regime, we have had a series of engagements at ministerial and official level with representatives of techUK, the industry body. The NCSC has convened a series of organisations—not least managed service providers, but others as well—and there has been a pretty extensive period of consultation on that and every other matter in the Bill. I feel satisfied that the Bill strikes a good balance in ensuring proportionality in what businesses experience. Critically, as supply chains in this context become increasingly cross-border, it is vital that bodies that may not be resident in the UK but which provide essential services here are included in the scope of the Bill. Question put and agreed to.”
House of Commons5 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“I beg to move amendment 11, in clause 4, page 3, line 5, column 3, leave out from beginning to “the” in line 6. This amendment and Amendment 12 would remove the Secretary of State for Science, Innovation and Technology as a joint regulator for the data infrastructure subsector, leaving the Office of Communications acting as the sole regulator for that subsector.”
House of Commons5 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“By adopting a single regulator for data infrastructure, the amendments will reduce administrative burden, simplify engagement, and strengthen accountability. This will ensure a clearer, more effective regulatory framework for this rapidly growing sector. Clause 4 brings qualifying data centre services into the scope of the NIS regulations, recognising both their vital role in underpinning our economy and public services, and that disruption to them can significantly impact productivity, service delivery, and revenue.”
House of Commons5 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“Clause 4 of the Bill amends the NIS regulations by creating a new regulated sector, data infrastructure, and designating the Secretary of State for Science, Innovation and Technology and Ofcom as joint regulators. We have received clear feedback from the data infrastructure sector expressing concerns that a dual regulator model could create unnecessary complexity and limit accountability. Amendments 11 and 12 will remove the Secretary of State for Science, Innovation and Technology as a regulator, leaving Ofcom as the sole regulator, which will streamline the regulatory model for data infrastructure and resolve the concerns raised by stakeholders. Ofcom already has proven regulatory expertise and is well placed to oversee the new data infrastructure sector effectively.”
House of Commons5 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“I thank the hon. Member for that thoughtful point. One assurance I will offer her is that the direct definition of data centres in scope here rely on capacity as a proxy for their essential independent nature, but when data centres below the capacity threshold but high on the criticality threshold are suppliers to essential services, they would be covered in part by the critical suppliers framework in the Bill. I take her point into account.”
House of Commons5 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“This will strengthen the cyber-security and resilience of data centres, align with international regulations, and introduce structured oversight, notification, and incident reporting to strengthen national security and economic stability.”
House of Commons5 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“Incidents may also pose national security and economic risks, given the concentration of sensitive and critical data. Bringing qualifying data centre services into scope of the NIS framework helps ensure these risks are managed proportionately and incidents are reported promptly. As per Government amendments 11 and 12, we propose that Ofcom is the regulator. Medium and large third party data centres and very large enterprise centres will be required to manage risks and report to Ofcom. Their thresholds have been carefully calibrated to capture data centres whose disruption could have the greatest impact, while avoiding unnecessary burdens on smaller operators.”
House of Commons5 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“In the course of engaging with firms we have considered what the timeline for reporting ought to be. It is critical that the initial notification requirement, which is a much lower requirement than the full notification requirement, at least gives the NCSC and other enforcement authorities the ability to counter national security and wider-impact risks. I believe that specification to be proportionate in the Bill, but it is of course a matter for implementation that we will keep a close eye on. An attack on a data centre can have significant impacts beyond the facility itself. As data centres underpin digital services across multiple sectors, disruption or compromise can cascade through essential services, businesses and public services.”
House of Commons5 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“Having done so, they achieved neither growth nor regulatory quality, which Opposition Members now talk about. As a consequence, it falls to us to make sure that our regulators are fit for purpose and resourced in the way they need to be. This Bill gives them the powers to secure initial and full notifications in a timely way, the powers to share information in an appropriate way and, fundamentally, the ability of cost recovery, to resource themselves in an appropriate way. Alongside that, our wider initiatives on skills in the cyber-sector and technology more broadly are fundamental to achieving our aspirations, not least through the CyberFirst programme, which I mentioned in a witness session.”
House of Commons5 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“With your permission, Mr Stringer, I will restrict my comments to clauses in question—in particular, clauses 5 and 6—and the relevant Government amendments. The shadow Minister has auditioned for roles at the Department for Business and Trade in talking about the philosophy of regulation, at the Department of Health and Social Care in talking about his medical background, and at the Treasury in talking about taxation. I will try to restrict myself to none of those and simply speak to the clauses and address three points in response to his comments. The first relates to the skills and resourcing of our regulators. On that, I welcome the shadow Minister’s prior engagement with me directly and his questions now. The last Government completely gutted our regulators.”
House of Commons5 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“At the same time, the threshold of 300 MW reflected the point at which a large load controller could pose an unacceptable risk to the electricity system and our CNI. This threshold was set very clearly in partnership with technical experts, including the National Energy System Operator. Of course, as the market grows, the potential for cyber-incidents will grow, and we will keep that under close review.”
House of Commons5 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“I will simply make the humble suggestion that in this context we have arrived at, not a full-fat compendium, as the shadow Minister described it, but a very targeted Bill, which has been the result of extensive industry engagement—indeed, some of it was carried out by the prior Government—that aligned on the sectors in question and the inclusion of critical suppliers in scope. On the shadow Minister’s question about the thresholds and definitional specificity of large load controllers in the Bill, I will of course remain very open to ensuring that the secondary powers, which are intended precisely to enable us to move flexibly as the clean power industry moves, give us the flexibility to move with it.”
House of Commons5 February 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗