Cyber Security and Resilience Bill: What the Lords Changed and What Boards Should Do Now

The Cyber Security and Resilience (Network and Information Systems) Bill is the biggest rewrite of UK cyber security regulation since the NIS Regulations of 2018. It brings managed service providers and data centres into regulation, imposes a 24-hour incident notification duty and gives regulators and ministers new powers. On 26 October 2026 the House of Lords finished its Report Stage by defeating the Government twice and extracting a significant concession on incident reporting.

This guide explains what the Bill does, what changed in the Lords, what happens next and what boards, IT leaders and suppliers should be doing while the final text is settled. It is written for organisations that will be regulated directly and for the far larger number that will feel the Bill through their customers' contracts.

What the Bill Is and Why It Exists

The NIS Regulations 2018 implemented the EU's first NIS Directive in the UK. They cover operators of essential services in energy, transport, water, health and digital infrastructure, together with a narrow set of digital service providers. Since then the EU has replaced its regime with NIS2, attacks on UK services have grown in scale and frequency, and the Government has concluded that the 2018 rules leave out the organisations that attackers now target most: the managed service providers that run IT and security for thousands of businesses and public bodies, and the data centres that host them.

The Bill was introduced in the House of Commons on 12 November 2025, carried over into the new parliamentary session and reintroduced on 14 May 2026, completed its Commons stages on 16 June 2026, and had its Second Reading in the Lords on 14 July. Grand Committee ran from 1 September, and Report Stage, the first point at which the whole House of Lords can vote on amendments, took place on 26 October 2026. According to Hill Dickinson's summary of the Bill as it stood before Report Stage, its main provisions are these.

Wider scope. Managed service providers, data centres and large load controllers join the existing operators of essential services in energy, water, transport, health and digital infrastructure. Regulators can also designate critical suppliers whose disruption would have systemic effects on essential services.

Two-stage incident reporting. Regulated organisations must make an initial notification of a significant incident to their regulator and the National Cyber Security Centre within 24 hours of becoming aware of it, followed by a fuller report within 72 hours.

Stronger regulators and ministers. Regulators gain enhanced oversight, enforcement and information-sharing powers. The Government gains the ability to update the regime through secondary legislation, to direct regulators and regulated entities on national security grounds, and to issue a statutory Code of Practice.

What the Lords Changed on 26 October 2026

The official Lords Votes record shows two divisions that the Government lost. Lord Birt's Amendment 163, inserting a new clause after clause 58 requiring a review of the effectiveness of the NIS regime, was agreed by 202 votes to 155. Viscount Camrose's Amendment 164, inserting a new clause titled "Register of foreign powers for the purposes of Part 4", was agreed by 194 votes to 155.

A statutory review that keeps widening the net

According to VinciWorks' account of the debate, the review clause requires the Government to assess the legislation and the wider NIS regime within 12 months of Royal Assent and then annually. The review must consider whether sectors such as cloud services, frontier AI, democratic processes and advanced manufacturing should be brought into scope, and whether the AI Security Institute should be given statutory powers to audit, inspect or recommend restrictions on frontier AI systems. The minister, Baroness Lloyd of Effra, offered a narrower alternative of a review of critical national infrastructure sectors within 12 months plus a post-implementation review within three years, but peers kept the broader version.

A register of hostile foreign powers

The second amendment requires the Government to establish and maintain a register of foreign states that pose cyber threats to the UK, drawing on GCHQ intelligence about state-sponsored attacks on critical infrastructure, and to assess the risks and report its plans to address them. The Government argued that a country-based list could create false certainty and that threats should be assessed individually, but lost the vote.

AI incidents: one amendment rejected, another accepted

Baroness Harding's Amendment 41 would have placed a duty on frontier AI model developers to report incidents involving unauthorised access to, or interference with, critical systems. VinciWorks reports that peers rejected it by 165 votes to 95. In its place the House accepted Government amendments covering incidents that involve loss of control of an AI agent on an essential-service network, and ministers committed to consult on secondary legislation covering agentic AI risks, including technical safeguards, incident records and notifications.

The incident reporting concession

The most practical change of the day came without a vote. The Government accepted that the original definition of a reportable incident was too broad because it could have captured incidents that merely could have had a significant adverse impact. Peers had warned that this would flood regulators and the NCSC with low-level events and failed attempts. Lord Clement-Jones welcomed the change with the line "Reporting is not resilience." The amended definition covers incidents that have actually adversely affected the operation or security of network and information systems.

Mandatory near-miss reporting for data centre operators was removed in favour of a voluntary framework that the Government has committed to develop. Separate amendments require data centre operators, digital service providers and managed service providers to keep affected customers informed after a reportable incident.

Security researchers and the Computer Misuse Act

Peers also pressed for better legal protection for security researchers who risk prosecution under the Computer Misuse Act when they investigate vulnerabilities in good faith. The Government confirmed that the Home Office is working on a new defence for accredited researchers but said it belongs in separate national security legislation rather than this Bill. No vote was held, so that reform depends on future legislation.

What Happens Next

The Lords completed Third Reading on 2 November 2026, with both amendments still in the Bill. It now returns to the Commons, where MPs will consider the Lords amendments; at the time of writing no date had been set. The Government opposed both the review clause and the foreign powers register, so either could be removed or reworded, and the two Houses may exchange the Bill more than once before they agree. Commentators now expect Royal Assent between late 2026 and spring 2027, and Precursor Security's tracker suggests most duties will take full effect through secondary legislation around 2028.

That timetable matters for planning, but it is not a reason to wait. The security requirements, the reporting arrangements and the exact list of regulated services will be set in regulations and consultations that are being shaped now. Organisations that are ready first will set the standard their suppliers are measured against, and regulators will expect the basics to be in place from day one.

What It Means for Boards

Three groups should treat the Bill as a live programme rather than a future compliance task. The first is organisations that will be regulated directly. Many managed service providers are small or mid-sized firms that have never dealt with a regulator; for them the Bill means governance, evidence and reporting discipline that larger operators built years ago. The second is the supply chain of those organisations. Notification duties, audit rights and security standards will arrive in contracts well before any regulator knocks on a supplier's door, and the Lords amendments on keeping customers informed will push those obligations further down the chain. The third is every board, because the review clause signals that Parliament wants the regime to keep widening, and the foreign powers register would give boards an official view of which states threaten which sectors.

The incident reporting concession is good news for all three. A duty to report every event that could have mattered would have buried the signal the regime exists to collect. The narrower definition means that triage decisions in the first 24 hours will turn on a question that incident responders can answer with evidence: has the operation or security of our systems actually been affected? That still demands fast, well-rehearsed assessment, and the 24-hour clock still runs from the moment of awareness.

A Practical Readiness Plan

The sensible position is to prepare for the regime the Bill describes while watching the final text. The ninety-day plan above breaks into five pieces of work.

Decide whether you are in scope, and document the reasoning. Work through the categories of operator of essential services, relevant digital service provider, managed service provider, data centre operator and critical supplier. If you provide IT, security, cloud or outsourced services to other organisations, assume you are a managed service provider until a lawyer tells you otherwise, and record the analysis so you can revisit it when the regulations are published.

Build the 24-hour and 72-hour reporting path now. The two-stage duty mirrors NIS2, the existing NIS regime and UK GDPR, so one process can serve all of them: a named decision-maker available around the clock, a one-page assessment template, pre-written notifications for the regulator, the NCSC and the ICO, and a contact tree that includes legal advisers and your insurer. Rehearse it in a tabletop exercise before the duty is live.

Map your suppliers against the critical supplier concept. List the third parties whose failure would stop you delivering your service, and check what their contracts say about security standards, incident notification timescales and your right to audit. Add those clauses to the contracts you sign today.

Close the gaps that regulators will look for first. Patching of internet-facing systems within published timescales, multi-factor authentication on all remote and privileged access, offline and tested backups, logging that would let you explain an incident within 72 hours, and a current asset inventory. None of these are new, but each one is a finding waiting to happen when a regulator asks for evidence.

Brief the board. Directors need to know that the Bill will give regulators stronger enforcement powers, that scope is likely to widen over time, and that the Government may be required to publish a list of hostile states. A short paper that sets out your scope analysis, your reporting readiness and the budget needed to close known gaps is the right output from this stage of the Bill.

How Cybergen Can Help

Cybergen helps organisations prepare for the Cyber Security and Resilience Bill alongside the European regimes many of them also face. Our NIS2 compliance service maps both frameworks to your services and suppliers and produces a gap assessment and remediation plan, our incident response service gives you a CREST-certified team on call so that the 24-hour notification is based on evidence, and our virtual CISO service turns the Bill's requirements into a programme with owners, dates and evidence.

The Cyber Security and Resilience Bill is still moving through Parliament and the final text may change. This guide reflects the position as at 6 November 2026. Check the Bill's page on bills.parliament.uk for the current stage before relying on any detail.

Frequently Asked Questions