# Cyber Security and Resilience Bill: MPs to consider Lords amendments on 24 November 2026 — Cyber Security and Resilience Bill

> The Commons will consider the Lords amendments to the Cyber Security and Resilience Bill (CSRB) on Tuesday 24 November 2026. MPs face 112 Lords amendments: 110 from the Government and two it opposed, on a yearly review of the NIS regime (Lords Amendment 107) and a register of foreign powers (108). Here is what is in Bill 175, what the Government has signalled, the possible outcomes and what each means for Royal Assent.

Canonical page: https://cybersecurityandresiliencebill.com/blog/cyber-security-resilience-bill-commons-lords-amendments-24-november-2026
Author: Precursor Security
Published: 2026-11-13 · Updated: 2026-11-13
Tags: Cyber Security and Resilience Bill, CSRB, consideration of Lords amendments, ping-pong, 24 November 2026, Lords Amendment 107, Lords Amendment 108, Bill 175, Royal Assent, NIS Regulations

# Cyber Security and Resilience Bill: MPs to consider Lords amendments on 24 November 2026

The House of Commons will consider the Lords amendments to the **Cyber Security and Resilience Bill (CSRB)** on **Tuesday 24 November 2026**. The Leader of the House announced the date on 12 November. MPs have 112 Lords amendments in front of them: 110 are the Government's own, and two were passed against it. The Bill is not yet law.

> **Position (13 November 2026):** Consideration of Lords amendments to the Cyber Security and Resilience (Network and Information Systems) Bill is listed as provisional Commons business for Tuesday 24 November 2026, after Lords amendments to the Armed Forces Bill. The paper MPs will work from, Bill 175, contains 112 Lords amendments. The Government's Explanatory Notes say Lords Amendments 107 (a review of the NIS regime) and 108 (a register of foreign powers) were "opposed by the Government". The Government has not yet published its motions on any of them. The Bill must complete its passage by the end of 29 April 2027.

## When will MPs consider the Lords amendments?

On Tuesday 24 November 2026. Sir Alan Campbell, the Leader of the House of Commons, gave the date in the [business statement on 12 November 2026](https://hansard.parliament.uk/commons/2026-11-12/debates/E58E6EB3-F2D4-4E7C-A8C8-029FE03D8F18/BusinessOfTheHouse):

> "Tuesday 24 November—Consideration of Lords amendments to the Armed Forces Bill, followed by consideration of Lords amendments to the Cyber Security and Resilience (Network and Information Systems) Bill."

Parliament's Bill record was updated the same day to show a sitting on 24 November, and its news note now reads: "The bill will now go back to the Commons for consideration of Lords amendments on 24 November 2026."

Three details matter for anyone planning to watch:

- **It is provisional.** The Leader announced it as "provisional business for the week commencing 23 November". Provisional business is usually confirmed in the following Thursday's statement, here 19 November, and it can move.
- **It is second in the queue.** The Commons calendar lists Health and Social Care questions from 11.30am, a ten-minute rule motion, the Armed Forces Bill and then this Bill. Statements and urgent questions would push it later.
- **No start time is fixed.** When the debate begins depends on how long the Armed Forces Bill takes.

## What is in front of MPs?

Bill 175, the Lords Amendments paper printed on 3 November 2026, lists every change the Lords made. There are 112. The [Explanatory Notes](https://publications.parliament.uk/pa/bills/cbill/59-02/0175/en/260175en.pdf) published with it split them like this:

| Lords Amendments | Tabled by | Government position in the Explanatory Notes |
|---|---|---|
| 1 to 106 and 109 to 112 (110 amendments) | The Minister | Government amendments |
| 107, a review of the effectiveness of the NIS regime | Lord Birt (Crossbench) | "opposed by the Government" |
| 108, a register of foreign powers | Viscount Camrose (Conservative) | "opposed by the Government" |

The total matches the Lords record: five amendments agreed in Grand Committee, 103 at Report Stage and four at Third Reading.

So the debate on 24 November is really about two amendments. The other 110 are changes ministers wrote themselves, and we would expect the Commons to agree them.

## Why do the amendment numbers keep changing?

Because the same two amendments now carry three different labels, depending on which document you are reading. We could not confirm the Commons numbering until we read Bill 175 this week. Here is the full mapping:

| What it does | Number on the Lords Report Stage list | Number in Bill 175 (what MPs will vote on) | Clause in HL Bill 62 (the latest full print) | Lords vote |
|---|---|---|---|---|
| Review of the effectiveness of the NIS regime | Amendment 163 | **Lords Amendment 107** | Clause 66 | Agreed, 202 to 155 |
| Register of foreign powers | Amendment 164 | **Lords Amendment 108** | Clause 67 | Agreed, 194 to 155 |

One more trap: Bill 175 describes where each amendment goes using the clause numbers of HL Bill 32, the Bill as first printed for the Lords. Both new clauses are shown as inserted "After Clause 58". In HL Bill 62 the same provisions are clauses 66 and 67.

When Hansard reports the debate, look for "Lords amendment 107" and "Lords amendment 108". Victoria Collins, for the Liberal Democrats, already used "Amendment 107" for the review in the Commons on 4 November.

## What would Lords Amendments 107 and 108 require?

### Lords Amendment 107: a yearly review of the whole regime

The Secretary of State would have to review the effectiveness of the Act and the NIS Regulations within 12 months of Royal Assent, report to Parliament, and repeat the exercise at intervals of no more than 12 months. The text in Bill 175 goes further than most summaries suggest. The review would have to:

- consider whether to bring in further sectors, having particular regard to all critical national infrastructure, cloud services, software-as-a-service and content delivery networks, frontier AI and agentic technologies, election administration and political parties, advanced manufacturing, life sciences, critical transport equipment, education, research organisations and large-scale retail distribution of essential goods other than food
- assess whether the thresholds that exclude micro and small enterprises "leave significant risks unaddressed"
- review "the critical vulnerabilities of technology platforms" and what obligations could be placed on technology providers
- consider the powers of the AI Security Institute to audit, set standards for and inspect frontier AI systems
- consult the National Cyber Security Centre (NCSC), the Information Commission, the regulators and the AI Security Institute

If a report concluded that an activity should be brought into scope, ministers would have six months to lay draft regulations or a statement explaining why not.

### Lords Amendment 108: a register of foreign powers

The Secretary of State would have to make regulations within six months of Royal Assent setting up a register of foreign powers believed to present a risk to the UK's critical network and information systems. It would have to include states that GCHQ has confirmed attacked, or tried to attack, operators of essential services or critical suppliers in the previous seven years, and states GCHQ has warned about. A report to Parliament on the risks and the Government's plan would follow within six months of the register being set up.

The Explanatory Notes add a point that is easy to miss: the regulations "would be subject to the made affirmative procedure". That means they would take effect when made and need Parliament's approval afterwards. See our guide to the [register of foreign powers](/guides/register-of-foreign-powers).

## What has the Government said it will do?

It has not published its motions. As at 13 November 2026, Parliament's record for the stage shows no Commons motions or amendments. But the signals all point the same way.

**On the review (107).** At Lords Report Stage on 26 October, the minister, Baroness Lloyd of Effra, said an annual review "would create a destabilising and uncertain regulatory, business and investment environment". She offered a one-off alternative, and the Government has since repeated it in writing. In a [written answer on 2 November](https://questions-statements.parliament.uk/written-questions/detail/2026-10-26/37829), Ian Murray said:

> "The Minister for Space, Cyber and Regulatory Reform announced on 26 October 2026 that the Secretary of State will lay a statement, within a year of the Bill's passage, that will assess whether further Critical National Infrastructure activities should be brought into scope of the NIS Regulations."

That answer was given a week after the Lords vote. It restates the Government's own offer, not the Lords' amendment.

**On both amendments.** The Explanatory Notes, written by the department for MPs to read before the debate, record each as "opposed by the Government".

**At Third Reading.** On 2 November Lord Clement-Jones told the Lords: "The decision now rests squarely with the Government whether to engage in parliamentary ping-pong or accept this amendment as a sensible and constructive way forward." Baroness Lloyd replied that she had noted points on the substance of the Bill, "which I am sure we will return to". Viscount Camrose spoke of "as and when it comes back to your Lordships' House".

*Our reading:* the Government is most likely to ask MPs to disagree with both amendments, and to offer the 12-month Statement as its answer to 107. That is analysis, not an announcement. The motions will settle it.

## Which changes are almost certainly staying?

The 110 Government amendments. Whatever happens to 107 and 108, these are the ministers' own text, and they include most of what changed for regulated organisations in the Lords. The descriptions below are taken from the Government's Explanatory Notes.

| Lords Amendments | What changes | Who should care |
|---|---|---|
| 6 | The definition of "incident" returns to an event with "an actual adverse effect". The wider "capable of having" wording is removed | Everyone with a reporting duty |
| 7, 8, 14, 15 | Significance tests can refer to all types of data, not just users' data, and must weigh impact on users, the economy and the day-to-day functioning of society | Operators of essential services, digital and managed service providers |
| 9 to 13, 31 | Data centres no longer report incidents that "could have had" a significant impact. The test moves from continuity of service to "operation or security", so serious incidents count even if the service stays up | [Data centres](/whos-affected/data-centres) |
| 16 to 18 | A new duty to keep notified customers updated after the first notification | Data centres, relevant digital service providers and [managed service providers](/whos-affected/managed-service-providers) |
| 25 to 28, 109 to 111 | The customer-update duty becomes enforceable, and failing to comply with an enforcement notice attracts the higher maximum penalty | Anyone exposed to [fines and penalties](/fines-and-penalties) |
| 21 to 24 | Regulators may share information abroad only with persons in the Five Eyes countries, the European Economic Area and Switzerland, unless the list is changed by regulations | Organisations concerned about where incident data goes |
| 29 | Integrated Care Boards are treated as carrying on an essential activity for Part 3 | [NHS organisations](/whos-affected/nhs-organisations) |
| 3, 4 | The load control threshold applies only to load control for system balancing | [Large load controllers](/whos-affected/large-load-controllers) |
| 33 to 39, 45 to 47 | A power to make regulations giving the Secretary of State functions where a compromise may be down to "loss of oversight or control" of an AI agent, subject to consultation and the draft affirmative procedure | Deployers of AI agents. See our [agentic AI analysis](/blog/cyber-security-resilience-bill-agentic-ai-resilience-measures) |
| 48 to 51, 95, 96 | Vendor-related directions, a possible mandatory referral scheme, published notices and an annual report to Parliament | Buyers and suppliers of technology. See [vendor direction powers](/guides/vendor-direction-powers) |
| 42, 43 | The statutory report on the legislation is due within three years of Royal Assent and every three years after, down from five | Anyone tracking future change |
| 41 | The power to change the procedure for issuing codes of practice is removed, as the Delegated Powers and Regulatory Reform Committee recommended | Anyone relying on codes of practice |

If you are preparing against the Lords text, this table is the stable part. Our [Lords amendments tracker](/guides/what-parliament-changed) follows each one.

## How will the debate work on the day?

For each Lords amendment, the Commons can agree, disagree, amend it, or offer an amendment in its place ("in lieu"). Ministers table a motion for each choice, and those motions appear on the Commons amendment paper before the debate.

Two procedural points are specific to this Bill:

- **No time limit has been set yet.** The programme order MPs agreed on 6 January 2026 covered the earlier Commons stages and said only that "Any other proceedings on the Bill may be programmed." Ministers can table a further programme motion to cap the debate. None had been published as at 13 November.
- **It shares the day.** With the Armed Forces Bill first, we would not expect a long debate. That is our reading. Government amendments like these are typically debated together, not one by one.

If the Commons disagrees with an amendment without offering an alternative, it appoints a small committee to draw up its reasons, and the Bill goes back to the Lords with them.

## What are the possible outcomes, and what does each mean for Royal Assent?

| Outcome on 24 November | What happens next | Effect on timing |
|---|---|---|
| The Commons agrees all 112 amendments | Both Houses have agreed one text. The Bill goes for Royal Assent | Fastest route. Royal Assent could follow within days or weeks, but no date is set |
| The Commons disagrees with 107, 108 or both | The Bill returns to the Lords, which can accept the Commons position or insist | At least one more stage in the Lords. No date is set |
| The Commons offers an amendment in lieu | The Lords considers the alternative | Often how ping-pong ends. One more Lords stage |

Whichever happens, the hard deadline is the end of 29 April 2027, the lapse date MPs set in the [4 November carry-over extension](/blog/cyber-security-resilience-bill-carry-over-extension-commons-lords-amendments). From 24 November that leaves 156 days.

## What starts if the Bill gets Royal Assent?

Royal Assent is not the start date for most duties. The expanded scope, incident reporting, critical supplier and enforcement changes commence by later regulations, and no dates have been set. But several clocks would start running on the day:

| Clock | Deadline | Depends on |
|---|---|---|
| Updated impact assessments | "published at Royal Assent", say the Explanatory Notes, which add that the vendor direction amendments "may carry financial impacts" | Royal Assent |
| Statement on bringing further critical national infrastructure into scope | Within a year of the Bill's passage | The Government's own commitment |
| First review of the NIS regime | Within 12 months, then at least every 12 months | Lords Amendment 107 surviving |
| Register of foreign powers | Regulations within six months, report within a further six | Lords Amendment 108 surviving |
| Report on the network and information systems legislation | Within three years, then every three years | Lords Amendment 42 (Government) |

The duties themselves will arrive through secondary legislation. In a [written answer on 6 November](https://questions-statements.parliament.uk/written-questions/detail/2026-10-28/38842), the Government said it "proposes to use powers in the Bill to introduce mandatory Security and Resilience Requirements (SRR) in secondary legislation", aligned with the NCSC's [Cyber Assessment Framework](/cyber-assessment-framework), and that the proposals "will also be subject to consultation and parliamentary scrutiny before coming into force". We track these in the [secondary legislation tracker](/guides/secondary-legislation-tracker).

## Which department now runs the Bill?

The Department for Digital, Culture, Media and Sport (DCMS). In our last update we said that was our reading, not something the Government had confirmed. The documents now support it:

- The Explanatory Notes on the Lords amendments state they "have been prepared by the Department for Digital, Culture, Media and Sport".
- Written questions on the Bill answered on 2 and 6 November were answered for DCMS by Ian Murray, the Minister of State who also moved the carry-over extension.
- Baroness Lloyd of Effra, who took the Bill through the Lords, appears in Hansard for 2 November as Parliamentary Under-Secretary of State at both the Department for Business, Innovation, Science and Trade and DCMS.

One related development from this week: in a [written answer on 12 November](https://questions-statements.parliament.uk/written-questions/detail/2026-11-02/HL4822), Baroness Lloyd confirmed that the £40 million National Agentic Security Unit announced in the Budget on 28 October 2026 "is currently being established by the National Cyber Security Centre (NCSC) and the Department for Digital, Culture, Media and Sport" and "will be housed within the NCSC". That is the operational counterpart to the AI-agent power in Lords Amendment 33.

## What should in-scope organisations do before 24 November?

Nothing changes in law on 24 November. The debate decides the fate of two amendments that place duties on ministers, not on regulated organisations. The practical work is the same as before:

- **Treat the 110 Government amendments as settled.** Build your incident triage around the "actual adverse effect" definition and the 24-hour and 72-hour timings in our [incident reporting](/incident-reporting) guide.
- **Plan for customer updates.** If you are a data centre, digital service provider or managed service provider, you would have to keep notified customers updated, and that duty is enforceable.
- **Confirm your position.** Use the [scope checker](/scope-checker) and [who is affected](/whos-affected).
- **Watch 107 if you are just outside scope.** Small firms, software-as-a-service providers, universities, manufacturers and retailers are named in the review. If it survives, the question of bringing them in would return every year.

## How can you follow the debate?

| What | Where | When |
|---|---|---|
| Confirmation of the date | The Leader of the House's business statement | Thursday 19 November |
| Government motions on each Lords amendment | The Bill's [publications page](https://bills.parliament.uk/bills/4035/publications) | Before the debate. Not published as at 13 November |
| The debate | [parliamentlive.tv](https://parliamentlive.tv/Commons), Commons chamber | Tuesday 24 November, after the Armed Forces Bill |
| The transcript | [Commons Hansard](https://hansard.parliament.uk/commons) | The following morning |
| What it means | Our [Bill status and timeline](/timeline) | Updated after the debate |

## Frequently asked questions

### When is the Cyber Security and Resilience Bill back in the Commons?

On Tuesday 24 November 2026. The Leader of the House announced it on 12 November 2026 as provisional business, after consideration of Lords amendments to the Armed Forces Bill. No start time is fixed.

### Is the Cyber Security and Resilience Bill law yet?

No. It has passed both Houses once, but the Commons and Lords must agree a single text before Royal Assent. The Commons considers the Lords amendments on 24 November 2026. The Bill lapses if it has not passed by the end of 29 April 2027.

### How many Lords amendments are there?

112, printed in Bill 175 on 3 November 2026. The Government tabled 110 of them (1 to 106 and 109 to 112). Lords Amendment 107, from Lord Birt, and Lords Amendment 108, from Viscount Camrose, were passed against the Government.

### What are Lords Amendments 107 and 108?

Lords Amendment 107 requires a review of the effectiveness of the NIS regime within 12 months of Royal Assent and at least every 12 months after. Lords Amendment 108 requires a register of foreign powers that present a risk to the UK's critical network and information systems. They were amendments 163 and 164 at Lords Report Stage, and are clauses 66 and 67 of HL Bill 62.

### Will the Government overturn the Lords amendments?

It has not said. Its Explanatory Notes describe both as "opposed by the Government", and a written answer on 2 November 2026 restated its alternative to the review: a Statement within a year on bringing further critical national infrastructure into scope. The Government's motions, not yet published as at 13 November, will show its position.

### When will the Cyber Security and Resilience Bill get Royal Assent?

No date is set. If MPs agree all the Lords amendments on 24 November, Royal Assent could follow soon after. If they disagree with any, the Bill returns to the Lords first. Most duties would still start later, through commencement regulations.

### Does anything change for businesses on 24 November?

No. The debate does not bring any duty into force. Lords Amendments 107 and 108 place obligations on the Secretary of State, not on regulated organisations.

## Sources

- Commons Hansard, [Business of the House, 12 November 2026](https://hansard.parliament.uk/commons/2026-11-12/debates/E58E6EB3-F2D4-4E7C-A8C8-029FE03D8F18/BusinessOfTheHouse) (Sir Alan Campbell, provisional business for the week commencing 23 November)
- UK Parliament Bills API, [Bill 4035 record](https://bills-api.parliament.uk/api/v1/Bills/4035) and [stages](https://bills-api.parliament.uk/api/v1/Bills/4035/Stages?take=60) (consideration of Lords amendments, sitting 24 November 2026; record updated 12 November 2026)
- UK Parliament, [What's On calendar for 24 November 2026](https://whatson-api.parliament.uk/calendar/events/list.json?queryParameters.startDate=2026-11-24&queryParameters.endDate=2026-11-24&queryParameters.house=Commons) (order of main chamber business)
- UK Parliament, [Bill 175 2026-27 (Lords Amendments)](https://publications.parliament.uk/pa/bills/cbill/59-02/0175/260175.pdf), 3 November 2026
- UK Parliament, [Bill 175-EN, Explanatory Notes on Lords Amendments](https://publications.parliament.uk/pa/bills/cbill/59-02/0175/en/260175en.pdf), prepared by the Department for Digital, Culture, Media and Sport, 3 November 2026
- Lords Hansard, [Third Reading, 2 November 2026](https://hansard.parliament.uk/lords/2026-11-02/debates/9A654131-98CE-48C2-86D6-65BFA9A71414/CyberSecurityAndResilience(NetworkAndInformationSystems)Bill), HL Deb cc1354 to 1356
- Lords Hansard, [Report Stage, 26 October 2026](https://hansard.parliament.uk/Lords/2026-10-26/debates/B413EFAE-E7D4-4742-986D-092884E0D8D1/CyberSecurityAndResilience(NetworkAndInformationSystems)Bill), and Lords divisions [3730](https://votes.parliament.uk/votes/lords/division/3730) and [3731](https://votes.parliament.uk/votes/lords/division/3731)
- Commons Hansard, [Second Reading and programme order, 6 January 2026](https://hansard.parliament.uk/commons/2026-01-06/debates/BB815F91-651E-4A24-AAFE-8BD7D92B2033/CyberSecurityAndResilience(NetworkAndInformationSystems)Bill)
- Commons Hansard, [Carry-over Extension, 4 November 2026](https://hansard.parliament.uk/Commons/2026-11-04/debates/0F7D1C34-C9B9-423F-91DC-7C49D72E63C9/CyberSecurityAndResilience(NetworkAndInformationSystems)Bill(Carry-OverExtension))
- UK Parliament, written questions [37829](https://questions-statements.parliament.uk/written-questions/detail/2026-10-26/37829) (answered 2 November 2026), [38842](https://questions-statements.parliament.uk/written-questions/detail/2026-10-28/38842) (answered 6 November 2026) and [HL4822](https://questions-statements.parliament.uk/written-questions/detail/2026-11-02/HL4822) (answered 12 November 2026)

*Position as at 13 November 2026. Lords Amendment numbers are from Bill 175; clause numbers are from HL Bill 62 and may change in the Act. This is general information, not legal advice.*

## Frequently asked questions

### When is the Cyber Security and Resilience Bill back in the Commons?

On Tuesday 24 November 2026. The Leader of the House announced it on 12 November 2026 as provisional business, after consideration of Lords amendments to the Armed Forces Bill. No start time is fixed.

### Is the Cyber Security and Resilience Bill law yet?

No. It has passed both Houses once, but the Commons and Lords must agree a single text before Royal Assent. The Commons considers the Lords amendments on 24 November 2026. The Bill lapses if it has not passed by the end of 29 April 2027.

### How many Lords amendments are there to the Cyber Security and Resilience Bill?

112, printed in Bill 175 on 3 November 2026. The Government tabled 110 of them (1 to 106 and 109 to 112). Lords Amendment 107, from Lord Birt, and Lords Amendment 108, from Viscount Camrose, were passed against the Government.

### What are Lords Amendments 107 and 108?

Lords Amendment 107 requires a review of the effectiveness of the NIS regime within 12 months of Royal Assent and at least every 12 months after. Lords Amendment 108 requires a register of foreign powers that present a risk to the UK's critical network and information systems. They were amendments 163 and 164 at Lords Report Stage, and are clauses 66 and 67 of HL Bill 62.

### Will the Government overturn the Lords amendments?

It has not said. Its Explanatory Notes describe both as "opposed by the Government", and a written answer on 2 November 2026 restated its alternative to the review: a Statement within a year on bringing further critical national infrastructure into scope. The Government's motions, not yet published as at 13 November 2026, will show its position.

### When will the Cyber Security and Resilience Bill get Royal Assent?

No date is set. If MPs agree all the Lords amendments on 24 November 2026, Royal Assent could follow soon after. If they disagree with any, the Bill returns to the Lords first. Most duties would still start later, through commencement regulations.

### Does anything change for businesses on 24 November 2026?

No. The debate does not bring any duty into force. Lords Amendments 107 and 108 place obligations on the Secretary of State, not on regulated organisations.