How this links to the Cyber Security and Resilience Bill
Essential activity is the foundation of Part 3, the Cyber Security and Resilience Bill’s new framework for future regulation. It lets the Government extend cyber security requirements to new sectors by regulations, without a new Act. Sectors outside the NIS Regulations today, such as financial services or public services, could be brought in this way.
- Clause 24(3) defines an essential activity as one specified in regulations made by the Secretary of State.
- Clause 24(4) limits this to activities essential to the UK economy, or to the day-to-day functioning of society, in the UK or any part of it.
- Clause 24(5)(b) treats existing NIS Schedule 2 essential services, relevant digital services and managed services as essential activities.
- Clause 30(3) lets secondary legislation under clause 29(1) impose requirements on people who carry on an essential activity, or provide an activity-critical supply.
- Clause 42 requires consultation and approval by both Houses before regulations specifying new essential activities are made.
How does an activity become an essential activity?
The Secretary of State makes regulations under clause 24(3) naming the activity. Clause 24(4) allows this only if the Secretary of State considers that carrying on the activity is essential to the economy of the United Kingdom, or of any part of it, or to the day-to-day functioning of society there. Clause 24(5)(a) makes clear that providing a service counts as carrying on an activity.
Before making the regulations the Secretary of State must consult such persons as they consider appropriate (clause 42(1)(a)). Because consultation is required, clause 42(5) means a draft must be laid before, and approved by, each House of Parliament.
Which activities are already treated as essential?
Three groups are treated as essential activities from the start, without any regulations. This links Part 3 to the existing regime, so the organisations already regulated under the NIS Regulations sit inside the new framework from day one:
- Every essential service specified in Schedule 2 to the NIS Regulations, which are the services an operator of essential services provides.
- Relevant digital services: cloud computing services, online marketplaces and online search engines.
- Managed services, as defined in new NIS regulation 1(3B).
Does Part 3 affect organisations already regulated under NIS?
Yes, potentially. Clause 30(5) treats operators of essential services, relevant digital service providers and relevant managed service providers as regulated persons for Part 3 from the start. Future Part 3 regulations could therefore impose further requirements on them, as well as on sectors newly added as essential activities.
Any such requirements would still need consultation and approval by both Houses under clause 42, so existing NIS organisations should get advance warning through a public consultation before any draft is laid.
What happens once an activity is essential?
Being an essential activity does not, by itself, create any duties. Duties come from regulations under clause 29(1), which may impose requirements on "regulated persons" (clause 30). A regulated person must carry on an essential activity in the UK, or provide an activity-critical supply, whether or not it is established in the UK.
The regulations can also set up regulatory authorities, enforcement, penalties capped by clause 32(3), and cost recovery. Clause 25 lets the Government designate a statement of strategic priorities for the security of systems used for essential activities.
Common misconceptions
Myth: Being an essential activity means new duties apply now.
Reality: No duties follow until regulations under clause 29(1) impose them. No new essential activities had been specified as of September 2026, and the Bill has not yet received Royal Assent.
Where it appears in the Bill
- Clause 24(3)-(5)Definition of essential activity, the test, and activities treated as specified.
- Clause 29(1)Power to make regulations on security and resilience of relevant systems.
- Clause 30(3)Regulated persons must carry on an essential activity or provide an activity-critical supply.
- Clause 42(1)(a), (5)Consultation and draft affirmative procedure for clause 24(3) regulations.
References are to HL Bill 32 as brought from the Commons. Read the Bill.
Frequently asked questions
Can the Government add new sectors to the Cyber Security and Resilience Bill without a new Act?
Yes. Clause 24(3) lets the Secretary of State specify new essential activities by regulations, if they are essential to the UK economy or the day-to-day functioning of society. The Secretary of State must consult first, and each House of Parliament must approve a draft of the regulations. Requirements then follow from separate regulations under clause 29(1).
Is an essential activity the same as an essential service?
Not quite. An essential service is a NIS Regulations concept, tied to the sector thresholds in NIS Schedule 2. Essential activity is the wider Part 3 concept. Every NIS essential service is treated as an essential activity, as are relevant digital services and managed services, but the Secretary of State can add further activities that are not essential services.
When will new essential activities be specified?
That is not known. Clause 24 comes into force on Royal Assent, which is expected between late 2026 and spring 2027. The Government must then consult and win approval from both Houses for any regulations. No draft regulations specifying new essential activities had been published as of September 2026.