# Cost Recovery & Regulatory Fees — Cyber Security and Resilience Bill

> The Cyber Security and Resilience Bill (HL Bill 62) would replace the 2018 NIS fee power with a broader "cost recovery" mechanism that lets regulators invoice regulated entities for the costs of oversight, audits, and investigations. This page explains how the mechanism works, what organisations could be charged for, and who is liable to pay.

Canonical page: https://cybersecurityandresiliencebill.com/cost-recovery

## The "cost recovery" mechanism explained

NIS regulators can already charge fees under the 2018 Regulations. The Bill would replace that narrow power with charging schemes that spread the cost of oversight across the organisations each regulator oversees. It is not yet law.

## What changes: from case-by-case fees to charging schemes

The cost recovery clause would allow regulators to invoice regulated entities to cover the expenses of their supervisory activities. The 2018 Regulations already allow a fee for work done on a particular OES or RDSP ([regulation 21](https://www.legislation.gov.uk/uksi/2018/506/regulation/21)), but exclude enforcement. [Clause 17](https://cybersecurityandresiliencebill.com/the-bill/part-2-nis-regulations#clause-17) of [HL Bill 62](https://bills.parliament.uk/publications/68323/documents/8980) would replace that with periodic charging schemes (regulation 20A) and one-off charges (regulation 20C), and extend charging to managed service providers and critical suppliers.

**Implication: double-jeopardy financial risk.** Under new regulation 20C, a regulator could charge you for the costs of exercising its functions in relation to you, which could include an investigation after an incident, whatever the penalty outcome. It could not charge for appeals or for proceedings it brings.

## What you could be charged for

Cost recovery turns regulatory activity into a direct line item for in-scope organisations.

### Audits & inspections

Routine compliance checks and deep-dive technical audits may be chargeable, either through a charging scheme or as a one-off charge under regulation 20C.

### Investigation costs

Post-incident forensics and regulatory inquiries consume significant resources. Under regulation 20C, a regulator could recover those costs from the organisation concerned.

## Frequently asked questions

### What is the 'Cost Recovery' mechanism in HL Bill 62?

Regulators could already charge an OES or RDSP a fee for work done on it under regulation 21 of the NIS Regulations 2018, but not for enforcement work. Clause 17 of the Cyber Security and Resilience Bill (HL Bill 62) would omit regulation 21 and replace it with two powers: periodic charges under a published charging scheme (new regulation 20A), which work like a levy, and one-off charges for the costs of exercising a NIS function in relation to a person (new regulation 20C).

### What costs can be recovered?

Under a charging scheme, a regulator can recover its relevant costs of running the NIS regime, and a charge need not relate to work done on you. Separately, regulation 20C lets it charge a person it regulates for the costs of exercising a function in relation to that person, which can now include enforcement work. It cannot charge for appeals against its decisions or for civil proceedings it brings.

### Who has to pay?

Anyone the regulator regulates: operators of essential services, relevant digital service providers, relevant managed service providers and designated critical suppliers. What you pay depends on your regulator's charging scheme (for example the Information Commission (formerly the ICO), Ofcom or a sector regulator). Critical National Infrastructure (CNI) is not a legal category in the Bill.

## Avoid the investigation costs

The cheapest investigation is the one that never happens. Proactive compliance is now a direct cost-saving strategy. Check your liability risk at https://cybersecurityandresiliencebill.com/assessment or talk to the Precursor Security team at https://cybersecurityandresiliencebill.com/contact.