Official Report: Minutes of Evidence

The Chairperson (Mr O'Toole): We have with us Paul Grocott and Hugh Tohill. First, guys, apologies for keeping you waiting for a little bit. You are both senior and busy officials, so, apologies. We have you here to talk about a legislative consent memorandum (LCM) that we have talked about in the past: you gave us an initial briefing, but we are now coming closer to its being debated at a plenary sitting. Hansard is going to report the session. This was scheduled as an update briefing ahead of the plenary debate, as I said, which is going to come in the next few weeks, although we do not know when exactly. It is not in the Order Paper yet, but it will be coming soon.

Paul or Hugh, will you give us an opening statement? If members wish to ask a question, they should indicate. Thanks again for coming, and apologies for the delay.

Mr Paul Grocott (Department of Finance): No problem at all. I will be very brief because I am conscious that, as you mentioned, Chair, there is a lot of background to this.

Thank you again for the opportunity to come to the Committee. I will give a very brief recap of the Bill and then an update of what has happened since I was last here. The previous briefing was on 17 June and provided an overview of the Bill and an update on the 22 clauses that the British Government put forward as requiring legislative consent. Collectively, they introduce enhanced regulatory provisions covering critical suppliers, statutory guidance, information-gathering powers, appeals, penalties and information-sharing arrangements. Hopefully, you will recall that, in addition, we advised that there were six further clauses that required legislative consent, which were put forward by the Department because it was our assessment that they would materially affect our function as the competent authority for the region.

Since our last briefing, the Department for Science, Innovation and Technology (DSIT) has been incorporated into the Department for Digital, Culture, Media and Sport (DCMS), as part of the machinery of government changes in Whitehall. Therefore, DCMS is now taking the legislation forward in Parliament, and the Bill has advanced through the legislative process, which includes —.

The Chairperson (Mr O'Toole): Does the disruption from the machinery of government changes present practical problems for you guys?

Mr Grocott: No.

Dr Aiken: How many people is it?

The Chairperson (Mr O'Toole): It is the same officials, but they are just working for a different Department. [Inaudible.]

Mr Grocott: That is true.

The Bill has moved through to the House of Lords. DCMS tabled amendments to the Bill at Committee Stage in the Lords. Chair, you mentioned the Minister's letter that provided an update on that.

I will give members a brief overview of that. Amendments that were accepted by the Lords were largely technical in nature. There is a definition of "load control". An activity undertaken for "system-balancing purposes" was slightly amended: that is clause 6. There was the requirement for managed service providers to consider any data associated with the service, had it been compromised, rather than the narrow definition of only data relating to users of that particular service. Those amendments were accepted. DCMS put forward other amendments to strengthen the management of risks arising from vendors supplying operators of essential services, but those amendments were not moved.

We analysed all the amendments, both those accepted and those not moved. Our assessment was that they did not engage devolved competence, it would not require a further legislative consent motion and no additional LCM action is required.

We understand that the Lords Report Stage has just been confirmed for Monday 26 October. As you mentioned, Chair, while the date of the Assembly debate has not been determined, there is a process to get that scheduled that still facilitates the Assembly providing its position to Parliament before the completion of the Bill.

Hugh and I are happy to take questions from members.

The Chairperson (Mr O'Toole): Thank you, both.

This question may touch on the Bill, generally, rather than the specifically devolved component of it, so I am slightly straying beyond the purposes of the LCM; apologies for that. Since we first discussed the Bill, there has been a lot more discussion about AI and its potential risks. For some people, one of those risks is ecological; for others, it is literally "super-intelligence", as the president now calls it; and there are potential security risks. Is there anything in the Bill about giving the Government — in this case, the UK Government — the power to deal with those risks? I ask that to address it for the record because it is a subject of public interest at the minute.

Mr Grocott: The purpose of the Bill — to go back, as you mentioned, to the intent — is to widen its scope, in the first instance. It gives more power to individual regulators to intervene and to have information sharing that is more directly relevant to us. The third pillar or element is the flexibility: it provides the Secretary of State with the power to intervene in areas that emerge. That is the adaptability and flexibility of the system, and it will do that through secondary legislation.

The Chairperson (Mr O'Toole): I cannot claim expertise that is anywhere near enough. It is a subject that we are all racing to catch up on. However, for example, if we talk about kill switches and ensuring that AI guard rails, in as far as they can, exist — for example, against rogue actors using AI tools to get to critical national infrastructure — is that the kind of thing that the Bill is designed to provide more legal frameworks around?

Mr Grocott: Yes, specifically as it relates to operators of essential services, rather than as a wider discussion around AI governance, with the nature of the Bill. The amendments that DCMS brought in the Lords, protecting vendors that supply into operators of essential services, also play into that space. Albeit they were not accepted, it is an indication of the Government's position that they wanted to legislate in that space.

The Chairperson (Mr O'Toole): The Bill has been enhanced — or beefed up, in other words — in that regard.

Mr Grocott: Those amendments were not accepted in the Lords.

The Chairperson (Mr O'Toole): They were not? OK.

Mr Grocott: No, so the Bill will go back, as per the ping-pong arrangement, to the House of Commons. However, the fact that the Government brought them as amendments in the Lords, indicates that that is their intention; that is the Government policy position.

The Chairperson (Mr O'Toole): Right, but it is currently in ping-pong at the minute. It is with the —.

Mr Grocott: It is at the Report Stage in the Lords, and then it will come back for the amendments that were accepted in the Lords to be considered by the Commons, at which point, the Government may decide to reintroduce those amendments that they tried to bring in in the Lords.

Ms Forsythe: Thank you both for being here and updating us on this. As you said, it is very current and topical. It involves increasing powers, and that invokes a lot of conversation and a lot of concerns from different parties around this area. Given that the cyber world is such a live thing, is it likely that anything will change substantially between now and 26 October that will require even further provision or are you content that all the safeguards are there?

Mr Grocott: From an LCM perspective, we are content that the 22 clauses, plus the further six, that we have put forward for the Assembly to consider and provide consent on are the full and final areas. We are not expecting a further list of any changes to the report that you have commissioned or the advice that we are providing to the Minister or, indeed, the Committee.

Ms Forsythe: That is good. I asked in case there was something that you foresaw coming out of left field that would change something between now and then.

Mr Grocott: No.

Ms Forsythe: That is good. The House of Lords Report Stage has been confirmed for 26 October. Forgive me if you have addressed this before. What is the expected timeline after that? Will it be completed before the Assembly dissolves for the election?

Mr Grocott: There is a process that I am not in control of or responsible for, unfortunately. The necessary people are involved in liaising between our Department and the Assembly to schedule the debates, and, under the Sewel convention, that needs to be completed before the final reporting stage of the House.

Ms Forsythe: Thank you very much.

Dr Aiken: I hate to say the horrible thing, but my question is on the Windsor framework. EU directive 2022/2065 is on the single market for digital services, which covers this area. Is the legislation compliant with that?

Mr Grocott: Yes. That was the advice from DSIT at the time and now DCMS.

Dr Aiken: For my sins, I live in the Windsor Framework Democratic Scrutiny Committee, which I would not wish on anybody. I have just seen recent updates come through on the European acquis. To ensure that compliance, can we check the recent changes? I understand where it lies and who has the ownership of it, but we have seen quite recently that a few things have not quite passed scrutiny where HMG have not necessarily been looking at European regulations because the legislation is Northern Ireland-specific.

Mr Grocott: If it is possible, can you be specific about the —?

Dr Aiken: As soon as I get it, I can ping it across. The words "specific" and "EU regulations" do not necessarily go in the same sentence.

The Committee Clerk: If Dr Aiken gets that to us, we will send it to the Department.

Mr Grocott: We will happily check that with colleagues in DCMS.

Dr Aiken: I will check with the House of Lords Northern Ireland Scrutiny Committee. It was looking at the sides of it, so we can join all the bits together.

The Chairperson (Mr O'Toole): Members, no one else has indicated that they want to ask a question. Thank you, Paul and Hugh. Thank you for waiting longer than you had intended for what was a short evidence session. That was useful.