The "cost recovery" mechanism explained
NIS regulators can already charge fees under the 2018 Regulations. The Bill would replace that narrow power with charging schemes that spread the cost of oversight across the organisations each regulator oversees. It is not yet law.
Last updated Status: not yet law. The Commons considers the Lords amendments on 24 November 2026.Sources: UK Parliament · HL Bill 62 · NIS Regulations 2018What changes: from case-by-case fees to charging schemes
The cost recovery clause would allow regulators to invoice regulated entities to cover the expenses of their supervisory activities. The 2018 Regulations already allow a fee for work done on a particular OES or RDSP (regulation 21), but exclude enforcement. Clause 17 of HL Bill 62 would replace that with periodic charging schemes (regulation 20A) and one-off charges (regulation 20C), and extend charging to managed service providers and critical suppliers.
What you could be charged for
Cost recovery turns regulatory activity into a direct line item for in-scope organisations.
Audits & inspections
Routine compliance checks and deep-dive technical audits may be chargeable, either through a charging scheme or as a one-off charge under regulation 20C.
Investigation costs
Post-incident forensics and regulatory inquiries consume significant resources. Under regulation 20C, a regulator could recover those costs from the organisation concerned.
How charging actually works.
Periodic charges under clause 17 of HL Bill 62 would run through a published charging scheme, and a regulator could not impose them until it has made one. This would replace the narrower fee power in regulation 21 of the 2018 Regulations, which already allowed some fees but not for enforcement work. Separately, regulation 20C would allow one-off charges, by invoice, for costs a regulator incurs in relation to a specific regulated person.
A charge is only payable if four conditions are met
Under regulation 20A(1), a NIS enforcement authority may impose a charge only where:
- the authority has made a charging scheme and that scheme has effect;
- the charge relates to a period specified in that scheme (a "chargeable period");
- you were regulated by that authority during all or part of the chargeable period; and
- the charge is imposed in accordance with the scheme.
What a scheme must specify
Regulation 20A(3) sets out the minimum contents. This is what to look for when your regulator publishes one.
Which functions are chargeable
The scheme must name the functions a charge is payable for, rather than charging at large.
The chargeable periods
Charges attach to defined periods, so you can work out which years you are exposed to.
Amount, or how it is calculated
Either the actual amount or the method, including the factors the authority will weigh.
When and how to pay
Payment mechanics must be in the scheme itself.
A start date at least 14 days out
A scheme cannot take effect until at least 14 days after it is published, so charges are never retrospective on publication.
Consultation before it is made
The authority must consult the regulated persons it considers appropriate before making or revising a scheme. Minor revisions are exempt.
Schemes must be published, may be revised or revoked, and may set different charges for different types of organisation. A scheme may also exempt named descriptions of person, or waive charges where specified conditions are met.
Regulation 20A(5) states that a charge need not relate to the exercise of functions in relation to the person paying it. You are not simply being invoiced for time spent on you. Charges fund the authority’s regulatory function across its whole population of regulated entities.
Regulation 20A(2) also lets an authority recover costs it incurred before the charging power commenced, where those costs were preparation for charging. Set-up costs can therefore appear in the first scheme.
If you dispute a charge
- Turnover-based charges are determined by the regulator. Where the amount turns on your turnover and you disagree with the authority about the figure, regulation 20B(1) makes the authority’s determination the operative one.
- Unpaid charges are a civil debt. Regulation 20B(2) makes a charge recoverable as a civil debt due to the authority, so non-payment is a debt matter rather than a further regulatory breach.
The transparency obligation that runs the other way
Regulation 20B(3) to (5) requires each authority to publish a statement for every chargeable period setting out:
- the total charges it actually received for the period;
- the total still outstanding that it expects to recover; and
- what exercising the charged-for functions actually cost it.
That third figure is the useful one. It lets regulated organisations and trade bodies test whether a scheme is genuinely recovering cost or over-recovering, and it is the natural evidence base for challenging a scheme at consultation.
Cost recovery questions answered.
Regulators could already charge an OES or RDSP a fee for work done on it under regulation 21 of the NIS Regulations 2018, but not for enforcement work. Clause 17 of the Cyber Security and Resilience Bill (HL Bill 62) would omit regulation 21 and replace it with two powers: periodic charges under a published charging scheme (new regulation 20A), which work like a levy, and one-off charges for the costs of exercising a NIS function in relation to a person (new regulation 20C).
Under a charging scheme, a regulator can recover its relevant costs of running the NIS regime, and a charge need not relate to work done on you. Separately, regulation 20C lets it charge a person it regulates for the costs of exercising a function in relation to that person, which can now include enforcement work. It cannot charge for appeals against its decisions or for civil proceedings it brings.
Anyone the regulator regulates: operators of essential services, relevant digital service providers, relevant managed service providers and designated critical suppliers. What you pay depends on your regulator's charging scheme (for example the Information Commission (formerly the ICO), Ofcom or a sector regulator). Critical National Infrastructure (CNI) is not a legal category in the Bill.
Guides on this topic.
All guidesCyber Security and Resilience Bill summary
The CSRB on one page: what HL Bill 62 does, who it adds, what changed in the Lords, when it starts and what is still moving.
Read the guideWhat will the Cyber Security and Resilience Bill cost you?
Official cost estimates per organisation from the Bill's May 2026 impact assessment, what they leave out, and how to build your own budget.
Read the guideCyber insurance and the Cyber Security and Resilience Bill
What the Cyber Security and Resilience Bill means for cyber insurance: whether fines can be insured, notification clashes and questions for your broker.
Read the guideHow to register with your regulator under the Cyber Security and Resilience Bill
Who must register under the Cyber Security and Resilience Bill, with which regulator, what details to give and the three-month clock.
Read the guideMSP compliance checklist for the Cyber Security and Resilience Bill
A ten-step checklist for managed service providers: scope, registration, security, 24/72-hour reporting, customer updates, evidence, costs and penalties.
Read the guideNIS Regulations 2018 vs the Cyber Security and Resilience Bill
NIS Regulations 2018 vs the Cyber Security and Resilience Bill: what changes in scope, incident reporting, fines and powers, and what stays the same.
Read the guideAvoid the investigation costs.
The cheapest investigation is the one that never happens. Proactive compliance is now a direct cost-saving strategy.