Update: UK Cyber Security and Resilience Bill

UPDATE OCTOBER 2026

UK Cyber Security and Resilience Bill: what’s changed and what organisations should watch

The Cyber Security and Resilience Bill has completed its House of Lords committee stage, but it is still working its way through Parliament.

Lords examined the Bill line by line over three days, concluding on 7 September 2026. But the Bill has not yet become law.  There are yet more stages to go through…meanwhile the world of cyber changes daily…even hourly. 

Timing relating to the Bill passing into law remains uncertain. This latest Parliament’s update did not give any indication of timing…it is however indicated that Royal Assent should be granted in late 2026 or early 2027 and full compliance by 2028.

So-effectively we have 18 months – ish.

However, organisations should not leave it til the last minute – like they did with GDPR.  We should be preparing NOW. 

So, MSPS, where are you all on this? Are you ready?

What does the bill mean for the MSP sector?

The plan is for the Bill to update the UK’s existing Network and Information Systems (NIS) regulations and to improve the cyber security and resilience of essential services and extend regulatory coverage to some additional digital and supply chain providers.

The key thing for the MSP world is that the bill proposes bringing relevant managed service providers and data centres within scope.   

It will bring in new powers over technology suppliers.

One of the discussions during a major committee stage debate focused on proposed powers to direct regulated organisations to take action against technology that presents a national security risk.

Under the amendments debated, organisations would be required to prohibit, restrict, remove, disable or modify software, hardware or digital facilities associated with a designated high risk vendor. These powers could also apply to vendor supplied AI used in connection with an organisation’s network and information systems.

One of the key requirements relates to reporting and potential penalties

The Bill proposes a two stage incident reporting process: an initial notification within 24 hours of becoming aware of a reportable incident, followed by a fuller report within 72 hours.  That is quick, especially when you probably don’t know what is going on at that stage.

Oh, and The National Cyber Security Centre should be informed alongside the regulator.

Certain managed service providers, digital service providers and data centres would also need to notify customers likely to have been affected. WOW: that requires a tight communication strategy and plan.

For more serious breaches, the proposed maximum penalty is the higher of £17 million or 4% of worldwide turnover. For less serious breaches, it is the higher of £10 million or 2% of worldwide turnover.   Think GDPR.

A new AI provision

The Parliamentary Committee debated including proposals to bring AI providers directly into the regime and require reporting of AI related incidents.

The Government said the Bill addresses risks to the network and information systems used by regulated organisations, including risks from AI embedded in those systems. It argued that broader regulation of AI products and services belongs in other policy discussions. However, there is a general duty to report serious AI incidents or near misses.

What organisations can do now

While the Bill continues through Parliament, potentially affected organisations should be mapping their reliance on managed service providers, cloud and data centre services, and other critical suppliers.

They should be reviewing how they detect and escalate incidents and assessing whether their supplier arrangements would support rapid response and customer notification.

These steps can help organisations prepare, while recognising that the Bill’s provisions and implementation timetable may still change.