UK Government Rejects Personal Liability for Executives in Cyber Resilience Bill
House of Lords peers warn that corporate fines alone may fail to drive necessary culture change at the top of critical national providers.
The UK government has rejected calls to introduce personal civil liability for senior executives within the proposed Cyber Security and Resilience Bill. Members of the House of Lords challenged the legislation, arguing that without individual accountability for neglect or consent to security failures, the bill misses a critical opportunity to secure national infrastructure.
Government officials dismissed amendments that would have held C-suite leaders personally responsible, pointing instead to a robust corporate enforcement regime as the primary deterrent. Under the proposed rules, organizations face maximum fines of £17 million or 4% of their annual global turnover, whichever is higher. The government maintains that these penalties, combined with upcoming board-level governance mandates, provide sufficient accountability to ensure compliance.
The Push for Culture Change
The debate centers on whether financial penalties against a company are enough to shift how cybersecurity is perceived in the boardroom. Baroness Kidron argued that the intent behind pushing for personal liability was to force a fundamental culture change within organizations, ensuring that preventative action is prioritized to avoid penalties. She emphasized that such a shift in organizational behavior must start at the top.
Lord Clement-Jones echoed this sentiment, suggesting a direct link between executive compensation and responsibility. He stated that if an individual is fit to draw a multimillion-pound executive salary while running a critical national provider, they must be prepared to carry personal responsibility for securing that provider.
Regulatory Burden and Risks
Beyond the liability debate, the bill introduces strict new timelines for incident reporting. Regulated organizations will be required to issue an initial notification of a cyber incident within 24 hours, followed by a more comprehensive report within 72 hours.
These mandates have sparked concerns regarding the practicalities of crisis management. Lord Clement-Jones warned that such rigid requirements could trigger an "administrative tsunami" of defensive reporting, potentially overwhelming both the regulators and the companies struggling to manage an active breach.
Industry Implications
This legislative tension reflects a broader global struggle to treat cybersecurity as a primary business risk rather than a technical detail. By opting for corporate fines over personal liability, the UK government is betting that high-value financial hits will compel boards to act. However, critics argue that as long as the financial risk is borne by the company and its shareholders rather than the decision-makers, the incentive for genuine systemic reform remains limited.
What Remains
As the Cyber Security and Resilience Bill moves forward, the focus will shift to the specific board-level governance rules the government cited as a substitute for personal liability. Industry observers will be watching to see if these rules include specific duties of care or if they remain high-level guidelines. Additionally, the effectiveness of the 24- and 72-hour reporting windows will remain a point of contention as companies prepare for the increased administrative load.