The House of Lords defeated the Government on the Cyber Security and Resilience Bill on 26 October 2026, voting 202-155 to require a statutory review of whether the AI Safety Institute (AISI) should have pre-deployment audit powers over frontier AI systems. This is the first time the Government has lost a division on the Bill during its Lords passage.
Report Stage day one also saw the Government's own Amendment 70 agreed without division, adding new AI-agent direction powers to the Bill. A third AI-related amendment - developer incident reporting - was defeated. Third Reading is expected on 2 November 2026.
Status (28 October 2026): Report Stage day one is complete. The Government lost a division on Amendment 163 (AISI review, 202-155). Amendment 70 (AI-agent powers) agreed. Amendment 41 (developer reporting) defeated. Third Reading expected 2 November 2026.
Key takeaways
- First Government defeat on the Bill in the Lords: peers voted 202-155 to agree Amendment 163, requiring a review of whether AISI should get pre-deployment audit powers over frontier AI.
- New AI-agent direction powers now in the Bill: Amendment 70 gives the Secretary of State powers where an incident involves loss of control of an AI agent - including appointing inspectors, entering premises and imposing financial penalties.
- Developer incident reporting rejected: Amendment 41 was defeated 95-165.
- AI services "likely in scope": the minister confirmed during debate that commercial AI services delivered as software or platforms are "likely to be in scope" of the NIS regime, and that a non-UK model developer could be designated a critical supplier.
- Vendor direction powers still outstanding: the Government's 60+ amendments on vendor-related direction powers were not on the day-one marshalled list.
- Third Reading expected 2 November 2026.
Full amendment results
Five amendments were debated on day one. Three were put to the House; two were not moved.
| Amendment |
Subject |
Sponsor |
Result |
| 163 |
Review within 12 months of Royal Assent of whether AISI should have pre-deployment audit powers over frontier AI systems |
Lord Tarassenko (cross-bench) |
Agreed, 202-155 (Government defeated) |
| 70 |
AI-agent direction powers for the Secretary of State where a compromise involves loss of control of an AI agent |
Baroness Lloyd of Effra (Government) |
Agreed without division |
| 41 |
Developer incident reporting duty |
Baroness Harding |
Defeated, 95-165 |
| 66 |
AISI pre-deployment review of frontier AI products on essential-service networks (28-day review window) |
Lord Tarassenko |
Not moved |
| 79 |
AISI powers to set standards, inspect and require remedial action |
Lord Clement-Jones |
Not moved |
What the Government defeat on Amendment 163 means
Amendment 163 does not give AISI audit powers directly. It requires the Secretary of State to carry out a review, within 12 months of the Cyber Security and Resilience Act receiving Royal Assent, of whether AISI should be given statutory power to audit frontier AI systems before they are deployed on essential-service networks. The Government must then report its findings to Parliament.
The minister, Baroness Lloyd of Effra, argued against the amendment during debate. She said that giving AISI a regulatory function would undermine the voluntary access it currently has to frontier models. In her view, model developers engage with AISI precisely because the relationship is non-statutory, and making it compulsory would risk that cooperation.
The Lords disagreed. The 202-155 margin - a majority of 47 - is comfortable. Cross-bench peers provided the swing votes, led by Lord Tarassenko, who first raised the "AI-shaped hole in the Bill" during Committee Stage.
What this means in practice:
- For the Government: it must now plan and resource the AISI review, including consultation with the AI industry, regulators and AISI itself. This is binding once Royal Assent is given (unless the Commons removes or replaces the amendment during ping-pong).
- For AI companies: the review could recommend statutory pre-deployment audit requirements. Even if it does not, the fact that Parliament has mandated the question puts the issue on a legislative track.
- For organisations in scope: no immediate change to your obligations. But if the review leads to AISI audit powers, frontier AI products deployed on your networks could face a pre-deployment review before you can use them.
What Amendment 70 adds: AI-agent direction powers
Amendment 70 was tabled by the Government itself and agreed without division. It adds a new provision to the Bill.
Where a cyber incident involves loss of control of an AI agent operating on an essential-service network, regulations may give the Secretary of State functions including:
- Appointing inspectors to investigate the incident
- Entering premises and running tests
- Requiring information, including information held outside the UK
- Imposing financial penalties
This is the first explicit mention of AI agents in the Bill's text. The minister also made two significant statements during debate:
- Commercial AI services delivered as software or platforms are "likely to be in scope" of the NIS regime.
- A non-UK model developer could potentially be designated as a critical supplier under the Bill.
Both statements go further than anything the Government has said previously about AI and the Bill.
What was not on day one
The Government's package of vendor-related direction powers - over 60 amendments debated at Committee on 1 September but not moved - was not on the day-one marshalled list. These are the amendments that would let the Secretary of State direct in-scope organisations to restrict, remove or modify goods, services or facilities from a vendor that poses a national security risk.
The absence is notable. The minister said at Committee that she would engage peers on the package "ahead of Report." The powers may appear on a further Report day if one is scheduled, or at Third Reading. Our analysis of the vendor direction powers explains how the package would work.
Amendments 66 and 79 - both proposing direct AISI powers rather than a review - were not moved. Lord Tarassenko and Lord Clement-Jones appear to have judged that the review requirement in Amendment 163 was the achievable outcome.
What happens next
| Step |
Expected timing |
| Lords Third Reading |
2 November 2026 |
| Commons consideration of Lords amendments |
After Third Reading |
| Royal Assent |
Late 2026 to spring 2027 |
| AISI review (if Amendment 163 survives) |
Within 12 months of Royal Assent |
| Commencement of most duties |
Phased, via secondary legislation |
| Full implementation |
~2028 |
Third Reading is the final Lords stage. Only minor and technical amendments are normally agreed at Third Reading - it is not usually an occasion for substantive policy changes. If the Bill passes Third Reading as amended, it returns to the House of Commons. MPs must then decide whether to accept or reject each Lords amendment. If they reject any, the Bill enters "ping-pong" between the two Houses until agreement is reached.
The Government defeat on Amendment 163 is the key variable. The Government could ask the Commons to remove it, which would send the Bill back to the Lords with that single disagreement. Whether the Lords would insist depends on the political weight of the issue at that point.
What organisations should do now
-
No duties change today. Report Stage commences no obligations. Your compliance timeline remains the same: Royal Assent expected between late 2026 and spring 2027, with most duties arriving later through secondary legislation and full implementation expected around 2028.
-
Track the AI-agent powers. Amendment 70 is now in the Bill. If you operate essential services that use or plan to use AI agents, you should understand that the Secretary of State may gain statutory powers to intervene where an incident involves loss of control of an AI agent on your network.
-
Watch the AISI review. If Amendment 163 survives Third Reading and ping-pong, the Government will have 12 months from Royal Assent to review whether AISI should get pre-deployment audit powers. Organisations deploying frontier AI on essential-service networks should factor this into procurement and deployment planning.
-
Prepare for vendor direction powers. These are still expected. Whether they arrive at Third Reading, in a further Report day or via a Government amendment in the Commons, the intent is clear. Map which suppliers support your critical systems now. Our post on new powers to block risky suppliers explains the package.
-
Continue aligning to the Cyber Assessment Framework. The CAF remains the expected baseline for regulatory assessment under the Bill.
For a complete overview of the Bill, see what it is, who is affected, what it changes and the full timeline.
Frequently asked questions
Was the Government defeated on the Cyber Security and Resilience Bill?
Yes. On 26 October 2026, the House of Lords voted 202-155 to agree Amendment 163, which requires a review of whether AISI should have pre-deployment audit powers over frontier AI systems. This was the first Government defeat on the Bill in the Lords.
What are the new AI-agent direction powers in the Cyber Security and Resilience Bill?
Amendment 70, agreed without division, gives the Secretary of State new powers where a cyber incident involves loss of control of an AI agent on an essential-service network. These include appointing inspectors, entering premises, running tests, requiring information held outside the UK, and imposing financial penalties.
When is Third Reading for the Cyber Security and Resilience Bill?
Third Reading is expected on 2 November 2026. This is the final Lords stage before the Bill returns to the Commons for consideration of Lords amendments.
What does the Government defeat on Amendment 163 mean in practice?
It requires the Secretary of State to carry out a review within 12 months of Royal Assent on whether AISI should have statutory power to audit frontier AI systems before deployment on essential-service networks. It does not give AISI those powers directly - it mandates the review and a report to Parliament.
Sources
Position as at 28 October 2026. Amendment outcomes (163 agreed 202-155, 70 agreed without division, 41 defeated 95-165, 66 and 79 not moved) were confirmed against the Resultsense parliamentary monitoring report of 27 October 2026, which cites Hansard. Third Reading is expected on 2 November 2026. For the latest parliamentary position, see bills.parliament.uk/bills/4035.