How this links to the Cyber Security and Resilience Bill
Activity-critical supply is how the Cyber Security and Resilience Bill reaches into supply chains under Part 3. It also acts as a commencement lock. The critical supplier designation power in clause 12 cannot come into force until the first Part 3 regulations imposing requirements on activity-critical suppliers are in force.
- Clause 29(6) defines an activity-critical supply as one without which carrying on an essential activity would be at risk of disruption.
- Clause 29(3)(a) makes systems used to provide an activity-critical supply "relevant" systems for Part 3 regulations.
- Clause 30(3)(b) allows a provider of an activity-critical supply to be a regulated person, wherever it is established.
- Clause 60(5)-(6) ties the commencement of clause 12 to the first regulations imposing requirements on these providers.
- Clause 32(3) caps future Part 3 penalties at the greater of £17 million and 10% of turnover.
What counts as an activity-critical supply?
Clause 29(6) is short: a supply of goods or services without which the carrying on of an essential activity would be at risk of disruption. The test looks at the effect of losing the supply, not the type of supplier. Software, hardware, outsourced operations and specialist services could all qualify, depending on how much an essential activity relies on them.
The definition does not name anyone as a regulated person. That happens only if regulations under clause 29(1) specify providers of activity-critical supplies, or a description of them, under clause 30(2). Clause 30(4) allows those regulations to work through designation by a regulatory authority.
How does it connect to critical suppliers?
Clause 12 inserts new NIS regulations 14H to 14K, which let a regulator designate a critical supplier to an operator of essential services, a relevant digital service provider or a relevant managed service provider. Clause 60(5) says the day appointed for clause 12 must be the same day that the first clause 29(1) regulations imposing requirements on providers of activity-critical supplies come into force.
So critical supplier designation cannot commence until those Part 3 regulations exist. A designated critical supplier’s requirements will come from them. It is not automatically subject to the same duties as an OES, RDSP or RMSP.
Worked example (illustrative)
Illustrative example: a payroll and rostering platform
A software company supplies the rostering system that a regional rail operator uses to schedule drivers. If the platform failed, trains could not run to timetable, so it could be an activity-critical supply to an essential activity. It would carry duties only if future Part 3 regulations specify providers like it, or a regulator designates it once those regulations are in force. This is an illustration, not a prediction of how the regulations will be drafted.
Where it appears in the Bill
- Clause 29(3), (6)Relevant systems include those used for activity-critical supplies; definition of the term.
- Clause 30(2)-(4)Providers of activity-critical supplies can be regulated persons, including by designation.
- Clause 32(3)Part 3 penalty cap: greater of £17m and 10% of turnover.
- Clause 60(5)-(6)Clause 12 commences with the first activity-critical supply regulations.
- Clause 12Critical supplier designation, new NIS regs 14H to 14K.
References are to HL Bill 32 as brought from the Commons. Read the Bill.
Frequently asked questions
Are all suppliers to regulated organisations providing an activity-critical supply?
No. The supply must be one without which carrying on an essential activity would be at risk of disruption. Many suppliers will not meet that test. Even where they do, no duties apply until Part 3 regulations under clause 29(1) specify them as regulated persons or provide for their designation.
Why does activity-critical supply matter for critical supplier designation?
Clause 60(5) of the Cyber Security and Resilience Bill says clause 12, which creates the critical supplier designation power, must commence on the same day as the first Part 3 regulations imposing requirements on providers of activity-critical supplies. Until those regulations are in force, no organisation can be designated as a critical supplier.
What penalties could apply to activity-critical suppliers?
That depends on future regulations. Clause 32(3) sets the ceiling: for an undertaking, the maximum penalty under Part 3 regulations may not exceed the greater of £17 million and 10% of turnover. The actual amounts, and which failures attract them, will be set in the regulations after consultation and approval by both Houses.