Cyber Security and Resilience Bill Clears the Lords

The Cyber Security and Resilience Bill (CSRB) has completed its passage through the House of Lords. Peers finished Third Reading on 2 November 2026, the final Lords stage, and the amended Bill now returns to the House of Commons for consideration of Lords amendments. This is the last substantive parliamentary step before Royal Assent, and it is where the two defeats the Government suffered at Report Stage will be fought over.

Position (3 November 2026): The Lords have completed all their stages. The Bill now sits with the Commons, which must decide whether to accept the two amendments peers made at Report Stage. Royal Assent remains expected between late 2026 and spring 2027. A Commons sitting date for considering the Lords amendments has not yet been announced.

If your organisation is likely to fall in scope - a managed service provider, a data centre operator, a cloud provider or a critical supplier - the direction of travel is now clear. The Bill is close to becoming law, and the practical question is no longer whether it passes but when the duties switch on.

What happened: the Bill has completed its House of Lords stages

The Bill was introduced to the Commons on 12 November 2025 as Bill 329, cleared all its Commons stages, and passed to the Lords on 17 June 2026. Since then the Lords have taken it through Second Reading (14 July 2026), Committee Stage (1, 3 and 7 September 2026, after which it was reprinted as HL Bill 49), Report Stage (26 October 2026) and now Third Reading (2 November 2026).

Third Reading in the Lords is a largely formal stage - it tidies the text rather than reopening policy - so the headline is not the debate itself but the milestone it marks: the Lords have had their say in full. Because peers amended the Bill during its passage, it cannot go straight to Royal Assent. It has to go back to the Commons. You can follow the stage-by-stage record on our Bill status and timeline page and read the current text on our view the Bill page.

What "consideration of Lords amendments" (ping-pong) actually means

When one House changes a Bill the other House sent it, the Bill returns to the originating House so MPs can agree, reject or alter those changes. For the CSRB that means the Commons will now vote on the amendments the Lords inserted. If the Commons disagrees, the Bill can pass back and forth between the two Houses - the process commonly called "ping-pong" - until they settle on a single agreed text. Only then can it receive Royal Assent.

In practice, the Government has a Commons majority, so it can ask MPs to overturn Lords amendments it dislikes. The Lords usually, though not always, give way once the elected House has insisted. The realistic range of outcomes is therefore: the Commons accepts the Lords changes; the Commons removes or waters them down and the Lords accept that; or a short round of ping-pong produces a compromise. Any of these can happen quickly once the Commons schedules the stage.

The two Lords amendments the Commons must now decide

At Report Stage on 26 October 2026 the Government was defeated twice - the first defeats on this Bill in the Lords. Both defeated amendments are now in the text the Commons has to consider:

• A statutory review of the whole NIS regime. Peers agreed, by 202 votes to 155, an amendment requiring a review within 12 months of Royal Assent of the effectiveness of the whole NIS regime, including which sectors should be in scope and the AI Security Institute's powers over frontier AI systems. It mandates a review and a report to Parliament rather than granting the powers directly.
• A register of hostile foreign powers. Peers agreed, by 194 votes to 155 on the Lords division record, a new clause requiring the Government to maintain a register of state actors that pose a cyber-security threat to the UK.

The Government opposed the foreign-powers register during the debate, arguing that a country-based list could create false certainty, so this is the amendment most likely to be challenged in the Commons. For the full division results, the amendments that were agreed without a vote and those that fell, see our detailed write-up of the Lords Report Stage results.

How the Cyber Security and Resilience Bill reaches Royal Assent from here

Once the Commons and Lords agree the text, the Bill receives Royal Assent and becomes the Cyber Security and Resilience Act. Royal Assent is still expected between late 2026 and spring 2027.

Royal Assent is not the day the duties bite, though. The Bill commences in phases. A handful of framework provisions take effect on the day the Act is passed, and some follow two months later, but the substantive obligations - expanded scope, incident reporting, enforcement and supplier duties - commence on dates the Secretary of State appoints by regulations. The Government has said it will consult during 2026 on the detailed implementation requirements, and most operational duties are expected to land towards 2028. The structure of that phasing is set out on our what the Bill changes page.

That gap between Royal Assent and commencement is the preparation window. It is deliberately generous, but it is not a reason to wait: registration deadlines run from commencement (typically three months), and building a defensible security and reporting posture takes longer than a compliance checkbox.

What in-scope organisations should do now

With the Bill this close to law, the sensible posture is to prepare against the current text rather than hold out for the final wording. The amendments still in play do not change the core duties that will affect most organisations. Concretely:

• Confirm whether you are in scope. The Bill brings managed service providers, data centres and critical suppliers into the regime for the first time, alongside existing operators of essential services and digital service providers. If you are unsure, our scope checker and who is affected pages walk through the thresholds.
• Get incident reporting ready. The Bill introduces a two-stage duty: an initial notification within 24 hours and a full report within 72 hours, both measured from when you become aware. Our incident reporting guide explains what that means operationally and why the 72 hours is not an extra three days.
• Work your supply chain now. Critical-supplier designation and supply-chain security duties are among the hardest to retrofit. Start mapping dependencies and updating contract clauses, because these changes tend to arrive before the headline duties commence.
• Size the downside. Maximum penalties reach the greater of £17 million and 4% of global turnover for the most serious failures. Our fines and penalties page sets out the tiers. If you are benchmarking against the EU regime, the NIS2 vs CSRB comparison shows where the UK approach diverges.

The practical takeaway: the Cyber Security and Resilience Bill has cleared the Lords and is in its closing stage. The Commons decision on the Lords amendments may adjust the detail at the margins, but the framework - broader scope, faster reporting, stronger enforcement - is settled. Organisations that use the run-up to Royal Assent to get their reporting, governance and supplier controls in order will be ready when the duties commence; those that wait will be compressing years of work into a three-month registration window. To scope your own readiness, start with our what is the Bill overview or take the readiness assessment.

Position as at 3 November 2026. Lords Third Reading completion (2 November 2026) and the return of the Bill to the Commons for consideration of Lords amendments are drawn from UK Parliament's news bulletin on the Bill's Lords stages ("Lords completes examination of Cyber Security and Resilience Bill") and the Bill's stage history on bills.parliament.uk/bills/4035; direct fetching of parliament.uk was not available at the time of writing, so the Hansard transcript for 2 November has not been independently inspected and no Commons sitting date has yet been published. The Report Stage division results (NIS regime review agreed 202-155; register of foreign powers agreed 194-155 on the Lords division record) are carried over from our Report Stage coverage, which was checked against Hansard and parliamentary-monitoring reporting. Royal Assent timing, phased commencement and penalty figures are drawn from the Bill as printed (HL Bill 49) and the Government's published implementation plans.