How this links to the Cyber Security and Resilience Bill
The 2018 Regulations let regulators charge a fee for work done on a particular OES or RDSP (reg 21). Clause 17 replaces this with a new Part 5A giving two routes: periodic charges under a published scheme, which can fund the regulator’s whole function, and invoiced charges for work on a specific person. This moves NIS oversight towards being funded by the organisations regulated.
- New reg 20A: periodic charges under a published charging scheme; a charge need not relate to functions exercised in relation to the payer (reg 20A(5)).
- New reg 20A(2)(b): preparatory costs incurred before cl.17 commences can be recovered.
- New reg 20B: turnover disputes are settled by the regulator’s figure; charges are civil debts; regulators publish annual income and cost statements.
- New reg 20C: case-specific charges with an invoice, excluding appeal costs, reg A20 proceedings and anything covered by a scheme.
- cl.34 lets future Part 3 regulations add charging powers, and Sch 2 para 11 omits the old reg 21.
How do periodic charging schemes work?
A NIS enforcement authority (a designated competent authority or the Information Commission) may impose a charge only if a charging scheme has effect, the charge relates to a chargeable period in the scheme, the person was regulated by that authority during that period, and the charge follows the scheme (reg 20A(1)).
The scheme must specify the functions charged for, the chargeable periods, the amount or how it is calculated, and when and how to pay. It cannot take effect until at least 14 days after publication (reg 20A(3)). Before making or revising a scheme, the authority must consult the regulated persons it considers appropriate, except for minor revisions (reg 20A(8)-(9)). The recoverable costs cover functions under the NIS Regulations and Parts 3 and 4 of the Act, including enforcement.
Can a regulator invoice us for work on our own case?
Yes. New reg 20C lets an authority require a person it regulates, or has regulated, to pay a charge for costs incurred in exercising a function in relation to that person, with an invoice stating the costs. Three things are excluded: costs of an appeal under reg 19A, costs of civil proceedings under reg A20, and anything already chargeable under the authority’s scheme.
Separately, reg 16(3)(a) of the 2018 Regulations already requires an inspected organisation to pay the reasonable costs of an inspection if required, and cl.47(4)(a) does the same for Part 4 inspections.
What protections do regulated organisations have?
Schemes must be published, and the regulator must publish a statement for each chargeable period showing the charges received, the amount still outstanding and the actual cost of the functions charged for (reg 20B(3)-(5)). That statement is the main evidence for testing whether a scheme over-recovers.
The protections are thinner on disputes. Where a charge depends on turnover and the figures are disputed, the regulator’s figure prevails (reg 20B(1)), and unpaid charges are recoverable as a civil debt (reg 20B(2)). The regulations do not create a specific appeal route against a charge.
Common misconceptions
Myth: Cost recovery only applies after an incident investigation.
Reality: Periodic scheme charges can fund the regulator’s whole function and, under reg 20A(5), need not relate to any work done on the payer.
Where it appears in the Bill
- cl.17Inserts Part 5A (regs 20A to 20C) into the NIS Regulations.
- New reg 20APeriodic charges under a charging scheme; contents, consultation and scope.
- New reg 20BTurnover determinations, civil debt recovery and published statements.
- New reg 20CInvoiced charges for functions exercised in relation to a person, with exclusions.
- cl.34; Sch 2 para 11Part 3 cost recovery powers; omission of the 2018 fees regulation (reg 21).
References are to HL Bill 32 as brought from the Commons. Read the Bill.
Frequently asked questions
Will we pay a regulator even if it never investigates us?
Potentially, yes. Under new reg 20A, a regulator can impose periodic charges on every person it regulates under a published charging scheme, and reg 20A(5) says a charge need not relate to functions exercised in relation to the person paying. The level and structure will depend on each regulator’s scheme, which must be consulted on before it is made.
Can a regulator charge us for defending an appeal?
No. New reg 20C(3) prevents a regulator from using an invoiced charge to recover costs relating to an appeal under reg 19A against its decision, or the costs of bringing civil proceedings under reg A20. It also cannot invoice separately for anything already covered by its charging scheme.
When will charging start?
Not until cl.17 commences by regulations under cl.60(3) and the regulator has consulted on and published a charging scheme, which must be published at least 14 days before it takes effect. The Bill has not yet received Royal Assent. Costs incurred preparing for charging before commencement can be included in the first scheme.