Peers in the House of Lords have pressed the UK government to explain why the Cyber Security and Resilience Bill does not allow regulators to hold senior executives personally liable when compliance failures involve their consent, negligence or connivance. Baronesses Kidron and Ludford backed amendments to impose personal civil liability and formal board-level responsibility for cybersecurity, arguing this would shift organisational culture and align the bill more closely with the EU's NIS2 directive. The government rejected the amendments, insisting that substantial corporate fines and upcoming governance rules already deliver sufficient accountability.

Cybersecurity minister Baroness Lloyd of Effra pointed to maximum fines of £17 million or 4% of annual turnover, whichever is higher, and said forthcoming secondary legislation would mandate board-level governance aligned with the NCSC's Cyber Assessment Framework, though details have yet to be consulted on. Lord Clement-Jones argued executives earning large salaries running critical infrastructure should bear personal responsibility, while supporters cited existing financial-sector accountability rules as precedent. Separately, peers including Baroness Neville-Jones and Lord Clement-Jones warned that the bill's strict incident-reporting requirements—a 24-hour initial notification and 72-hour full report—risk creating an "administrative tsunami" of defensive reporting, suggesting the incident definition be narrowed from "capable of" to "likely to have" an adverse effect.