For the most advanced AI systems, our world-leading AI Security Institute is a centre of UK expertise, advancing our scientific understanding of their capabilities and the associated risks. AISI has already run a large study on backdoor data poisoning, and conducted the largest AI agent red-teaming study to date, identifying tens of thousands of vulnerabilities across sectors including finance, healthcare and customer support. AISI continues to work hand in hand with developers and with the National Cyber Security Centre to make AI protections stronger.

The government has already published a Code of Practice to set the baseline security requirements for AI models and systems, alongside working with the European Telecommunications Standards Institute (ETSI) to create a global standard (EN 304 223) that builds on the Code.

This standard is relevant to all organisations and sets out requirements for developers and deployers of AI alongside data custodians. To support organisations, we have contributed to the publication of an implementation guide (TR 104 128) and we are now working to produce a conformity assessment in ETSI (TS 104 216). The government has also recently completed some pilot training workshops with various professions, including small businesses and published the Cyber Security Breaches Survey 2025-2026 which examined adoption and security approaches by UK organisations to AI. The findings are being used to determine if additional guidance is needed. SMEs should consider this standard when adopting AI-enabled tools and services.

The F-35B is an operationally deployable combat aircraft. Capability is enhanced through regular, incremental software releases delivered through the global F-35 programme, rather than a single combat capable release.

The Member for Kingswinford and South Staffordshire will be aware that the Government is planning an independent strategic review into the use of non-corporate communications channels. This will consider any non-corporate means of communication.

I thank my hon. Friend for raising that issue—it is an important angle on a problem of which we are all aware, but in a slightly different context, given some of the modern features that are available on the devices in our pockets. I will look into it further and pick it up with him in due course.

Particularly for people with a very low body mass index or an eating disorder, the use of app-based fitness classes for hours of ultra-high-intensity exercise every day can lead to addiction. When I wrote to one brand to ask about implementing access limitation tools in its app, it was dismissive. Will the Secretary of State consider reviewing whether such tools could be mandated to support those with eating disorders?

The UK supports the open, responsible, secure and resilient development of technologies globally and the Government takes the security of its data and digital systems very seriously. The Cabinet Office sets the framework for government procurement. All procurement is required to comply with applicable government security frameworks and is subject to robust risk assessments. The National Cyber Security Centre provides expert guidance to support secure procurement and the management of cyber risks from third party suppliers.

UK Biobank is a charity and operationally independent of government. The Government has been working closely with UK Biobank in its response to the data breach which it reported to the Government on 20 April 2026. Measures taken so far have included the suspension of access to their research analysis platform, revocation of access permissions from the institutions involved, rapid removal of the listings from the e-commerce platform, self‑referral to the Information Commissioners Office, and urgent work to introduce technical barriers to prevent download of participant‑level data.

The Ministry of Defence keeps its approach to digital technology, including the selection and use of operating systems on its devices, under continual review and regularly assesses developments in the wider international environment.

Decisions on platforms are based on operational requirements, security, resilience and value for money, and are subject to robust governance and assurance processes.

Defence makes decisions based on its own requirements, while taking account of relevant international developments where appropriate. All technology choices within Defence must comply with strict security and device management policies, ensuring systems can be managed effectively at an enterprise level and meet mandated cyber security standards.

The Competition and Markets Authority (CMA) is currently conducting a Strategic Market Status investigation into Microsoft’s business software ecosystem. As part of this investigation, the CMA is considering a range of issues, including software bundling practices, interoperability, licensing arrangements, and their potential impacts on competition, including for small and medium-sized enterprises.

The Government has not made a separate assessment of these impacts. It is for the CMA, as the UK’s independent competition authority, to assess the evidence and determine whether any interventions are necessary.

The Government is committed to promoting a competitive and innovative digital economy, which is why we prioritised the commencement of the CMA’s new powers in digital markets last year.

The CMA operates independently of Government, and decisions on the scope of its investigations rest solely with the CMA.

The CMA launched its investigation into Microsoft’s business software ecosystem on 14 May 2026. The CMA has invited views on the details of this investigation until 4 June 2026. The proposed scope includes the integrated use of AI tools in business software to help ensure that UK businesses and public sector organisations can choose the tools that deliver the greatest productivity gains. The CMA will consider responses to its consultation and confirm its position in due course.

This Government is committed to promoting a competitive and innovative digital economy, which is why we prioritised the commencement of the CMA’s new powers in digital markets last year.

The CMA launched its Strategic Market Status designation investigation into Microsoft’s business software ecosystem on the 14 May 2026, this investigation must be completed within 9 months. An indicative timetable of this investigation is published on the CMA’s website. The CMA operates independently of Government, and decisions on which firms to investigate, and how these investigations are conducted rest solely with the CMA.

DSIT has not formally reviewed the SPA24 Memorandum of Understanding with Microsoft. This agreement does not represent a commitment to spend, but instead provides eligible public sector organisations with access to discounted pricing. Decisions on whether to purchase goods and services are made by individual organisations in line with procurement regulations.

The Government Commercial Agency (GCA), formerly Crown Commercial Service (CCS), manages SPA24 with Microsoft to ensure that it continues to deliver against its objectives.

The government has worked closely with the software industry to ensure the availability of a broad range of MTD-compatible products to suit different needs and budgets.

This includes free products supporting those with the simplest affairs, low-cost bridging software for those who prefer to continue using spreadsheets and more sophisticated products that integrate with other business software.

Currently, there are more than 20 free products (excluding free trials) covering a range of different scenarios including bookkeeping, quarterly updates and end-of-year submissions.

HMRC is not providing its own MTD solution because commercial software providers are able to provide a broad range of products to meet the differing needs of businesses and landlords, in a way that HMRC is not.

In line with our commitment in the 10-Year Health Plan, we are continuing to develop a dedicated ‘My Vaccines’ tool in the NHS App. This will provide people with their and their children’s personal vaccination history and eligibility as well as the ability to book services and to receive reminder notifications in one place. In December 2025, we commenced a private beta of My Vaccines for the RSV vaccination programme which includes over 300,000 users. Moving forward, the ambition is for ‘My Vaccines’ users to have access to information for all NHS vaccinations, including children’s vaccination programmes. Vaccination records are or will only be shown in the NHS App when they are recorded in the general practice (GP) record and the GP has enabled both detailed record sharing and proxy access.

School Aged Immunisation Service (SAIS) providers are the data controllers for SAIS vaccination records. Therefore, neither the Department nor NHS England currently assess the adequacy of SAIS vaccination records that flow to the GP record, and therefore potentially into the NHS App. With the expansion of the Manage a Vaccination In School (MAVIS) digital tool across SAIS providers, we are improving the accuracy and quality of SAIS vaccination records. For ‘My Vaccines’ in the NHS App, NHS England has received zero complaints and 110 enquiries. From those we have had two reported issues regarding missing or incomplete vaccination records. Vaccination Digital Services did not hold information centrally prior to the development of My Vaccines.

For school-age immunisation providers using the MAVIS system, all vaccinations are automatically sent to GP records overnight, including human papilloma virus (HPV), MenACWY protecting against meningococcal strains, Td/IPV protecting against tetanus, diphtheria and polio, school-age flu, and catch-up doses to protect against measles, mumps and rubella. For providers not using MAVIS, HPV and school-age flu vaccinations are sent to GP records via NHS England. The service level agreement for reporting to GPs is 48 hours for both school aged flu and HPV.

As My Vaccines is only at private beta stage for the RSV vaccination programme as described above, the proportion of school-age vaccinations visible in the NHS App will be limited for the time being until My Vaccines is rolled out more fully.

In line with our commitment in the 10-Year Health Plan, we are continuing to develop a dedicated ‘My Vaccines’ tool in the NHS App. This will provide people with their and their children’s personal vaccination history and eligibility as well as the ability to book services and to receive reminder notifications in one place. In December 2025, we commenced a private beta of My Vaccines for the RSV vaccination programme which includes over 300,000 users. Moving forward, the ambition is for ‘My Vaccines’ users to have access to information for all NHS vaccinations, including children’s vaccination programmes. Vaccination records are or will only be shown in the NHS App when they are recorded in the general practice (GP) record and the GP has enabled both detailed record sharing and proxy access.

School Aged Immunisation Service (SAIS) providers are the data controllers for SAIS vaccination records. Therefore, neither the Department nor NHS England currently assess the adequacy of SAIS vaccination records that flow to the GP record, and therefore potentially into the NHS App. With the expansion of the Manage a Vaccination In School (MAVIS) digital tool across SAIS providers, we are improving the accuracy and quality of SAIS vaccination records. For ‘My Vaccines’ in the NHS App, NHS England has received zero complaints and 110 enquiries. From those we have had two reported issues regarding missing or incomplete vaccination records. Vaccination Digital Services did not hold information centrally prior to the development of My Vaccines.

For school-age immunisation providers using the MAVIS system, all vaccinations are automatically sent to GP records overnight, including human papilloma virus (HPV), MenACWY protecting against meningococcal strains, Td/IPV protecting against tetanus, diphtheria and polio, school-age flu, and catch-up doses to protect against measles, mumps and rubella. For providers not using MAVIS, HPV and school-age flu vaccinations are sent to GP records via NHS England. The service level agreement for reporting to GPs is 48 hours for both school aged flu and HPV.

As My Vaccines is only at private beta stage for the RSV vaccination programme as described above, the proportion of school-age vaccinations visible in the NHS App will be limited for the time being until My Vaccines is rolled out more fully.

In line with our commitment in the 10-Year Health Plan, we are continuing to develop a dedicated ‘My Vaccines’ tool in the NHS App. This will provide people with their and their children’s personal vaccination history and eligibility as well as the ability to book services and to receive reminder notifications in one place. In December 2025, we commenced a private beta of My Vaccines for the RSV vaccination programme which includes over 300,000 users. Moving forward, the ambition is for ‘My Vaccines’ users to have access to information for all NHS vaccinations, including children’s vaccination programmes. Vaccination records are or will only be shown in the NHS App when they are recorded in the general practice (GP) record and the GP has enabled both detailed record sharing and proxy access.

School Aged Immunisation Service (SAIS) providers are the data controllers for SAIS vaccination records. Therefore, neither the Department nor NHS England currently assess the adequacy of SAIS vaccination records that flow to the GP record, and therefore potentially into the NHS App. With the expansion of the Manage a Vaccination In School (MAVIS) digital tool across SAIS providers, we are improving the accuracy and quality of SAIS vaccination records. For ‘My Vaccines’ in the NHS App, NHS England has received zero complaints and 110 enquiries. From those we have had two reported issues regarding missing or incomplete vaccination records. Vaccination Digital Services did not hold information centrally prior to the development of My Vaccines.

For school-age immunisation providers using the MAVIS system, all vaccinations are automatically sent to GP records overnight, including human papilloma virus (HPV), MenACWY protecting against meningococcal strains, Td/IPV protecting against tetanus, diphtheria and polio, school-age flu, and catch-up doses to protect against measles, mumps and rubella. For providers not using MAVIS, HPV and school-age flu vaccinations are sent to GP records via NHS England. The service level agreement for reporting to GPs is 48 hours for both school aged flu and HPV.

As My Vaccines is only at private beta stage for the RSV vaccination programme as described above, the proportion of school-age vaccinations visible in the NHS App will be limited for the time being until My Vaccines is rolled out more fully.

My Department is working with the Northern Ireland Government on the transposition of the new Product Liability Directive, which will include working with them to consider whether guidance may potentially be helpful to businesses in understanding the new product liability framework. However, it should be noted that the Directive does not impose any additional rules on businesses governing which products may be placed on the EU or Northern Ireland markets, or the safety requirements they must meet.