UK Ministers Seek New Powers to Bar High‑Risk Tech from Critical Services

Britain is moving to tighten control over technology providers deemed unsafe for use in essential services after late amendments to the Cyber Security and Resilience Bill were introduced in Parliament. The changes would empower ministers to issue restrictions on vendors whose products or services present a heightened risk of supply‑chain compromise, a step taken as attacks on critical infrastructure grow more sophisticated.

The amendments come amid a wave of high‑profile cyber incidents that have exposed vulnerabilities in the software and hardware supply chain. Notable examples include the 2020 SolarWinds breach and the 2021 Kaseya ransomware attack, both of which demonstrated how malicious actors can infiltrate trusted vendors to gain access to downstream networks. Policymakers argue that existing safeguards are insufficient to pre‑empt such threats.

Under the proposed provisions, the government would be able to designate a supplier as “high‑risk” and prohibit its products from being used in sectors such as energy, water, transport and telecommunications. The designation could be based on factors like foreign ownership, evidence of backdoors, or a history of security lapses. Ministers would be required to publish the rationale for each restriction, and affected firms would have the opportunity to appeal the decision.

Industry groups have welcomed the focus on security but caution that a blanket ban could disrupt supply chains and increase costs. The telecommunications sector, for instance, relies on a global ecosystem of hardware and software components, many of which originate from overseas manufacturers. Critics argue that clear, transparent criteria are essential to avoid unintended consequences for businesses that comply with existing standards.

Parliamentary debate is expected to continue through the summer session, with the government seeking cross‑party support to embed the new powers into law before the next election cycle. If enacted, the measures would align the UK with other Western nations that have introduced similar restrictions, such as the United States’ recent executive orders targeting specific foreign tech firms.

Analysts say the move signals a broader shift toward “strategic security” in procurement decisions, where national risk assessments increasingly influence commercial choices. As supply‑chain attacks become a staple of state‑backed cyber campaigns, the UK’s approach could set a precedent for how democracies balance openness with the need to protect critical infrastructure from covert infiltration.