UK Cyber Bill Faces Calls for Executive Liability and AI Shutdown Powers

House of Lords peers proposed amendments to the UK Cyber Security and Resilience Bill that would make senior executives personally civilly liable for serious cybersecurity failures. The government rejected the measure, citing proposed penalties of up to £17 million or 4% of annual turnover and forthcoming board-governance requirements. Peers also warned that the bill's 24-hour incident-notification and 72-hour detailed-reporting deadlines could drive defensive over-reporting, while the government said the measures are needed to modernize the NIS Regulations 2018 and enable NCSC response.

Liberal Democrat peer Lord Tim Clement-Jones also sought emergency powers for the government to deactivate dangerous AI systems and, in national-security emergencies, shut down data centers. He framed the AI “kill switch” as a last-resort control against autonomous systems compromising critical national infrastructure, including misuse by state-backed actors or ransomware groups. Industry voices supported emergency controls in principle but cautioned that the UK's dependence on foreign technology suppliers would limit their practical effectiveness without greater sovereign technology capacity and procurement reform.