Are directors personally liable under the Cyber Security and Resilience Bill?
On the text we can check, no. The Cyber Security and Resilience Bill (CSRB) as brought from the Commons directs penalties at the regulated organisation, not directors personally. Peers have pushed for personal liability, so check the final Act. Directors already have duties under other laws, including the Companies Act.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
What the Bill says
The Cyber Security and Resilience Bill (CSRB), as brought from the Commons (HL Bill 32), directs its penalties at the regulated organisation. We found no personal fine or criminal offence for directors in that text. The maximum penalties are the greater of £17 million and 4% of turnover for serious failures, and the greater of £10 million and 2% for administrative ones.
Directors do appear in the Bill in other ways:
- Registration: a corporate relevant managed service provider must give the Information Commission the names of its directors, and the same applies to digital service providers.
- Service of notices: under Part 4, a notice to a company can be given to an officer, defined to include a director, manager or secretary.
Neither of these creates personal liability.
What was proposed in Parliament
The issue has been argued at more than one stage in the Lords.
| Stage | What happened |
|---|---|
| Lords Committee, September 2026 | Baronesses Kidron and Ludford backed probing amendments for personal civil liability for senior executives. Peers raised consent, connivance and neglect. The minister, Baroness Lloyd of Effra, did not support them, pointing to the size of the fines and to future board-level governance requirements |
| Lords Report, 26 October 2026 | One commentary describes a tabled amendment from Baroness Morgan of Cotes that would make boards approve the cyber risk approach and name a responsible member, with a senior individual liable alongside the firm for consent, connivance or wilful neglect |
Parliament reports three divisions at Report Stage. They concerned a review of the NIS scheme, a register of foreign powers and frontier AI incident reporting, not this amendment. We have not been able to confirm from the Hansard record what happened to it, so check the final text before relying on this position. The Bill's final wording could still change before Royal Assent.
Where directors can already be exposed
The Bill isn't the only source of risk. These apply regardless of what happens to it.
Companies Act 2006. Section 174 requires a director to exercise reasonable care, skill and diligence, judged by what can reasonably be expected of someone in that role and by the director's own knowledge and experience. Section 172 requires directors to promote the company's success, having regard to matters including long-term consequences. A serious failure to oversee cyber risk could raise questions under these duties, though each case depends on its facts.
Data protection law. Section 198 of the Data Protection Act 2018 can make directors liable for certain offences under that Act where committed with their consent or connivance, or attributable to their neglect. This doesn't cover every breach. It applies to specified offences.
Financial services. Senior managers in regulated financial firms have their own accountability regime, enforced by the FCA and PRA.
Claims. Companies can bring claims against directors for breach of duty, and shareholders can do so in limited circumstances through a derivative claim.
Sector or contract rules. Check your regulator's rules and customer contracts, as they can create extra responsibilities for named individuals.
What the board's record should show
A regulator's penalties fall on the company, but a board still wants to be able to show it acted carefully. Practical steps:
- Name an owner. The Cyber Assessment Framework (CAF) expects a board-level individual with overall accountability.
- Minute the discussion. Record the risk information you saw, what you challenged and what you decided, not just that "cyber was discussed".
- Follow the Code. The Cyber Governance Code of Practice gives you a recognised structure.
- Get regular reports. The Code asks for formal reporting at least quarterly.
- Take part in an exercise. Directors should know their role in the first 24 hours, and who decides whether something is reportable.
- Check your insurance. Ask your broker how directors' and officers' cover and cyber cover respond. Policies vary, and we can't generalise.
- Ask for independent input where the board lacks expertise. Section 174 takes into account the knowledge a director has, and relying on no one is hard to defend.
Fines and individuals
A fine on the company can still be a personal matter for directors. It's a loss the board will have to explain to shareholders, and regulators consider factors such as remediation steps and past compliance when setting a penalty. Good governance won't guarantee a lower fine, but poor governance is hard to explain afterwards.
Take advice from a qualified lawyer about your own position, particularly after an incident.
Sources
- The Bill as brought from the Commons, HL Bill 32 (PDF)
- The Register: peers ask why the Bill leaves executives off the personal liability hook, 7 September 2026
- Yeandel: Report Stage commentary
- UK Parliament: Lords third reading notice
- legislation.gov.uk: Companies Act 2006, section 174
- legislation.gov.uk: Companies Act 2006, section 172
- legislation.gov.uk: Data Protection Act 2018, section 198
- NCSC: Cyber Assessment Framework v4.0 (PDF)
Frequently asked questions
The text as brought from the Commons directs penalties at the regulated organisation, and we found no personal fine for directors in it. Lords amendments may affect the final text, so check the Act.
Three Report Stage divisions were reported on other matters. An amendment on board oversight and senior individual liability was described as tabled, but we have not confirmed its outcome from Hansard.
Under the Companies Act 2006, directors must exercise reasonable care, skill and diligence, and promote the success of the company. Other regimes can apply, including data protection law and financial services rules.
Corporate RMSPs and RDSPs must give the Information Commission their directors’ names when registering. That is an information duty and does not itself create personal liability.