UK cyber bill excludes personal liability for executives despite peers’ demands
Peers in the House of Lords have pressed the UK government to explain why the Cyber Security and Resilience Bill does not allow regulators to hold senior executives personally liable when compliance failures involve their consent, negligence or connivance. Baronesses Kidron and Ludford backed amendments to impose personal civil liability and formal board-level responsibility for cybersecurity, arguing this would shift organisational culture and align the bill more closely with the EU's NIS2 directive. The government rejected the amendments, insisting that substantial corporate fines and upcoming governance rules already deliver sufficient accountability.
Cybersecurity minister Baroness Lloyd of Effra pointed to maximum fines of £17 million or 4% of annual turnover, whichever is higher, and said forthcoming secondary legislation would mandate board-level governance aligned with the NCSC's Cyber Assessment Framework, though details have yet to be consulted on. Lord Clement-Jones argued executives earning large salaries running critical infrastructure should bear personal responsibility, while supporters cited existing financial-sector accountability rules as precedent. Separately, peers including Baroness Neville-Jones and Lord Clement-Jones warned that the bill's strict incident-reporting requirements—a 24-hour initial notification and 72-hour full report—risk creating an "administrative tsunami" of defensive reporting, suggesting the incident definition be narrowed from "capable of" to "likely to have" an adverse effect.
In short
- Peers want personal liability for execs over cyber failings; government disagrees
- Ministers cite £17m fines and future board governance rules as sufficient
- Separate concerns raised that reporting rules may overwhelm regulators with paperwork
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Advocates for personal liability argue that fines on the corporate balance sheet, however large, are ultimately absorbed as a cost of doing business and rarely change the behaviour of the individuals actually making risk decisions. They contend that when executives who run critical national infrastructure and draw substantial salaries know they could face personal consequences for consenting to, or negligently overlooking, security failures, boards will treat cyber resilience as a genuine governance priority rather than a compliance afterthought, much as accountability regimes in financial services have concentrated minds at senior level. Aligning with the EU's NIS2 approach, they add, would also prevent the UK from becoming a comparatively soft jurisdiction for lax cyber governance.
The case against
Those opposing personal liability argue that the bill already introduces substantial deterrents, including fines of up to £17 million or 4% of turnover, alongside forthcoming secondary legislation that will mandate board-level governance against a recognised framework, making an additional personal liability regime unnecessary and premature ahead of consultation. They caution that exposing individual executives to personal civil liability could deter capable people from taking on senior roles in critical infrastructure firms, encourage defensive box-ticking over genuine security improvement, and risk conflating the separate, equally pressing problem of the bill's tight incident-reporting deadlines, which some fear could already generate an overwhelming volume of precautionary reports. Better, on this view, to let the corporate penalties and governance rules bed in before adding a further layer of personal risk.
Explained simply
Peers in the House of Lords have been scrutinising the Cyber Security and Resilience Bill, new legislation designed to strengthen the UK's defences against cyberattacks on critical infrastructure and essential services. A key point of contention is whether the bill should let regulators pursue individual company executives, rather than just the organisation, when cybersecurity failures occur. Some peers argue this bill is the government's chance to bring UK rules closer to the EU's own cybersecurity law, known as NIS2.
Several peers, including Baronesses Kidron and Ludford and Lord Clement-Jones, want executives to face personal legal responsibility if they knowingly allowed or were negligent about security failures, similar to accountability rules already used in the financial sector. The government, represented by cybersecurity minister Baroness Lloyd of Effra, has resisted this, arguing that large fines on companies and new board-level governance rules will be enough to ensure accountability without targeting individuals directly.
The bill also sets tight deadlines for reporting cybersecurity incidents, requiring firms to make an initial notification within 24 hours and a full report within 72 hours. Some peers worry this could push organisations into over-reporting minor issues out of caution, creating unnecessary bureaucracy, and have suggested narrowing the legal definition of what counts as a reportable incident.
Cybersecurity Government Politics Technology UK World
Read the full article at the source →
Originally published by The Register as “Peers ask why UK cyber bill leaves execs off the personal liability hook”.