Where the Cyber Security and Resilience Bill stands: the Commons carry-over extension and what happens next

The Cyber Security and Resilience Bill (CSRB) has passed both Houses and awaits Commons consideration of Lords amendments, for which no date has been set. On 4 November 2026 MPs agreed, without a division, to move the Bill's lapse date from the end of 11 November 2026 to the end of 29 April 2027. It is not yet law.

Update, 13 November 2026: a date has now been set. The Commons will consider the Lords amendments on Tuesday 24 November 2026. See what MPs will decide on 24 November. The rest of this article is as published on 9 November.

Position (9 November 2026): The Cyber Security and Resilience (Network and Information Systems) Bill has passed both Houses. The House of Lords completed Third Reading on 2 November 2026, and the Bill has returned to the House of Commons for consideration of Lords amendments. No date has been set for that stage yet. On 4 November 2026 the Commons agreed a carry-over extension motion. It moves the date on which the Bill would lapse from the end of 11 November 2026 to the end of 29 April 2027. The Bill has not yet received Royal Assent and is not yet law.

What did the Commons agree on 4 November 2026?

The Commons agreed a motion to extend the Bill's carry-over period. Ian Murray, Minister of State, moved it at 2.49pm. The motion read:

"That the period on the expiry of which proceedings on the Cyber Security and Resilience (Network and Information Systems) Bill shall lapse in pursuance of paragraph (13) of Standing Order No. 80A shall be extended, so that the period expires at the end of 29 April 2027 rather than at the end of 11 November 2026."

The minister told MPs that the Bill "re-entered the House after completing Third Reading in the other place on Monday 2 November", and that he expected Members to "continue this constructive dialogue in their consideration of Lords amendments".

In the short debate that followed, Victoria Collins, for the Liberal Democrats, said her party "absolutely support[s] this motion" and urged the Government to support the Lords' review amendment. Alex Ballinger (Labour, Halesowen) also supported it. The question was then put and agreed to, with no division.

Why did the Bill need a carry-over extension?

The Bill began in the 2024-26 session. The Commons agreed a carry-over motion on 6 January 2026, and the Bill was reintroduced in the 2026-27 session on 14 May 2026. A carried-over Bill does not run indefinitely: under paragraph (13) of Standing Order No. 80A its proceedings lapse at the end of a set period, which the 4 November motion records as the end of 11 November 2026 for this Bill.

Without the extension, the Bill would have lapsed seven days later, before MPs had a chance to consider the Lords amendments. The motion gives it until the end of 29 April 2027 to complete its remaining stages.

The motion did one thing: it extended the lapse date. It did not set a date for any stage of the Bill. We have found no primary source announcing when the current session will end.

What happens at consideration of Lords amendments?

The Commons will work from Bill 175 (Lords Amendments), published on 3 November 2026, which sets out every change the Lords made. For each Lords amendment, MPs can:

• agree to it, so it stays in the Bill
• disagree with it, usually with a reason, so it goes back to the Lords
• propose changes, either amendments to the Lords amendment or an amendment in its place ("in lieu")

If the Commons agrees everything, the Bill goes for Royal Assent. If it disagrees with anything, the Bill returns to the Lords, which can accept the Commons position or insist on its own. This exchange is known as "ping-pong", and it continues until both Houses agree a single text.

The Lords agreed five amendments in Grand Committee, 103 at Report Stage and four at Third Reading. Most are Government changes, many of them drafting or consequential. We track each substantive amendment, and the Commons response to it, in our Lords amendments tracker.

What were the two Government defeats?

At Report Stage on 26 October 2026 the Government lost two of three divisions. Both amendments are now in the Bill as printed after Report (HL Bill 62), and both will be before MPs.

Clause in HL Bill 62	Lords amendment	Moved by	What it would require	Lords vote
66	163	Lord Birt (Crossbench)	A review of the effectiveness of the Act and the NIS Regulations within 12 months of Royal Assent, a report to Parliament, then further reviews at intervals of no more than 12 months	Agreed, 202 to 155 (division)
67	164	Lord Markham (Conservative), for lead sponsor Viscount Camrose	Regulations, within six months of Royal Assent, setting up a register of foreign powers that the Secretary of State believes present a risk to the UK's critical network and information systems, followed by a report to Parliament	Agreed, 194 to 155 (division)

Clause 66 requires the review to consider whether further sectors should come into scope, including all critical national infrastructure, cloud, software-as-a-service and content delivery networks, frontier AI and agentic technologies, and democratic processes. It must also consider the powers of the AI Security Institute and whether incident-reporting timelines are sufficient. If a report concludes an activity should be brought into scope, ministers would have six months to lay draft regulations or explain why not.

Clause 67 says the register must include states that GCHQ has confirmed attacked, or attempted to attack, operators of essential services or critical suppliers in the UK in the preceding seven years, or that GCHQ has warned pose a risk. It allows the report to be withheld, in whole or part, on national security grounds. The statutory wording is "register of foreign powers". See our guide to the register of foreign powers.

What did the Government say about the review in the Lords?

Opposing amendment 163, the minister, Baroness Lloyd of Effra, told peers that an annual review "would create a destabilising and uncertain regulatory, business and investment environment".

She offered an alternative: "within 12 months of the Bill passing, the Secretary of State will lay a Statement setting out whether future CNI activities should be brought into scope of the NIS regulations", focusing on sectors not currently covered, "including, for instance, government and the food sector". Peers voted for the amendment regardless.

What are the likely outcomes?

This section is our analysis. The Government has not published its motions on the Lords amendments.

1. The Commons agrees all the Lords amendments. The Bill would then go straight to Royal Assent with clauses 66 and 67 included.
2. The Commons disagrees with clause 66 or 67, or both. Ministers opposed both in the Lords and can ask MPs to remove them. For clause 66, the minister's commitment to a 12-month Statement on scope gives the Government a ready alternative it could offer instead. The Lords would then decide whether to accept or insist.
3. The Commons offers amendments in lieu. For example, a narrower review or a reworded register. This is a common route to settling ping-pong quickly.

The 101 Government amendments made at Lords Report, including the narrower incident definition, customer updates, vendor-related directions and the AI-agent power in clause 32, are the Government's own changes. We would not expect ministers to oppose them.

One drafting point may also come up. Clauses 66 and 67 sit in Part 4, which under clause 69 of HL Bill 62 commences only when ministers make regulations, yet both clauses set deadlines that run from Royal Assent. Clause 69 was not amended to list them.

What should you watch next?

What to watch	Where it will appear	Why it matters
A date for Commons consideration of Lords amendments	The Leader of the House's weekly business statement and the Commons Order Paper	Starts the final stage
Government motions on each Lords amendment	Commons amendment paper for the Bill on bills.parliament.uk	Shows whether ministers will try to remove clauses 66 and 67
Any return to the Lords	Lords business papers and Hansard	Ping-pong begins only if the Commons disagrees
Royal Assent	Announced in both Houses; the Act then appears on legislation.gov.uk	The Bill becomes law. Most duties still need commencement regulations
The end of 29 April 2027	The new lapse date	The Bill's proceedings would lapse if not complete by then
Implementation consultation, likely now for the Department for Digital, Culture, Media and Sport (DCMS). DSIT closed on 2 November 2026, and GOV.UK now lists DCMS first on the Bill factsheets; that DCMS leads on the Bill is our reading, not something the Government has confirmed (GOV.UK DSIT record; Bill factsheets)	GOV.UK	The Government said "We intend to consult on implementation proposals in 2026"

We will update our Bill status and timeline and the secondary legislation tracker as each happens.

What does this mean for in-scope organisations?

Nothing changed in law on 4 November. The extension keeps the Bill alive; it does not alter any duty. Royal Assent is not the start date for most duties either: under clause 69, the expanded scope, incident reporting, critical suppliers and enforcement changes all commence by later regulations, and no dates have been set.

The core of the Bill has been stable since the Commons stages, so preparation against the Lords text is sensible:

• Confirm whether you are in scope. Use the scope checker and who is affected pages, especially if you are a managed service provider or data centre.
• Get 24-hour and 72-hour reporting ready. See our incident reporting guide, and note the Lords narrowed what counts as an incident.
• Plan for customer updates. The Lords text would require data centres, RDSPs and RMSPs to update notified customers.
• Size the downside. See fines and penalties.

Frequently asked questions

Has the Cyber Security and Resilience Bill become law?

No. It has passed both Houses, but the Commons must still consider the Lords amendments and both Houses must agree the text before Royal Assent. As at 9 November 2026 no date has been set for Commons consideration of Lords amendments.

What was the carry-over extension motion on 4 November 2026?

A Commons motion under Standing Order No. 80A that extended the period after which the Bill's proceedings would lapse, from the end of 11 November 2026 to the end of 29 April 2027. Ian Murray, Minister of State, moved it, and it was agreed without a division.

Does the carry-over extension mean Parliament is being prorogued?

The motion says nothing about prorogation or a new session. It only moves the Bill's lapse date. We have found no primary source announcing when the current session will end.

Which Lords amendments might the Commons reject?

The Government has not yet published its motions. The two amendments it lost in the Lords are the most likely to be contested: clause 66, a yearly review of the NIS regime (agreed 202 to 155), and clause 67, a register of foreign powers (agreed 194 to 155).

What happens if the Bill is not finished by 29 April 2027?

Under the motion, proceedings on the Bill would lapse at the end of 29 April 2027. No further extension has been proposed. The 4 November motion was itself an extension, agreed a week before the previous lapse date.

Sources

• Commons Hansard, Cyber Security and Resilience (Network and Information Systems) Bill (Carry-over Extension), 4 November 2026, HC Deb cc962 to 966 (also on TheyWorkForYou)
• UK Parliament Bills API, Bill 4035 stages (carry-over motion 4 November 2026; consideration of Lords amendments with no sitting date)
• UK Parliament Bills API, Bill 4035 record (not yet an Act)
• UK Parliament, Bill 175 2026-27 (Lords Amendments), 3 November 2026
• UK Parliament, HL Bill 62, as amended on Report, clauses 66, 67 and 69
• UK Parliament Bills API, amendments agreed at Grand Committee, Report and Third Reading
• UK Parliament, Lords divisions 3730 and 3731, 26 October 2026
• Lords Hansard, Report Stage, 26 October 2026
• GOV.UK, Summary of the Bill factsheet, updated 3 November 2026

Position as at 9 November 2026. Clause numbers are from HL Bill 62 and may change in the Act.