How this links to the Cyber Security and Resilience Bill
The Cyber Security and Resilience Bill lets ministers amend some of its own provisions, and other Acts, by regulations. The House of Lords Delegated Powers and Regulatory Reform Committee reported on the Bill in its Seventh Report of Session 2026-27 (HL Paper 41), and drew attention to Henry VIII powers. How far these powers are narrowed at Report Stage is not yet settled.
- Clause 37(7) lets the Secretary of State change the procedure for issuing a code of practice by amending clause 36 (so far as it relates to consultation) and clause 37 itself.
- Clause 40(5) lets the Secretary of State amend clause 40 to change the matters covered in the five-yearly report on NIS legislation.
- Clause 41(3) allows consequential provision in Part 3 regulations to amend or repeal primary legislation, including the Bill once enacted.
- Clause 42(5)(b) requires draft affirmative approval by both Houses for Part 3 regulations that amend primary legislation.
Why is it called a Henry VIII power?
The name refers to the Statute of Proclamations 1539, which gave Henry VIII’s proclamations the force of an Act. Today it describes any delegated power that lets a minister change primary legislation using secondary legislation. Parliament can accept or reject a statutory instrument but cannot amend it, so these powers shift control from Parliament to ministers and are closely scrutinised.
In the House of Lords, the Delegated Powers and Regulatory Reform Committee reviews the delegated powers in every Government Bill and routinely comments on Henry VIII powers, including whether the affirmative procedure applies.
Which Henry VIII powers does the Bill contain?
Reading HL Bill 32, the clearest examples are clause 37(7), clause 40(5) and clause 41(3). Clause 37(7) is notable because it reaches the safeguards on the code of practice itself. Under clause 37 as drafted, a draft code must be laid before Parliament and cannot be issued if either House resolves against it within 40 days.
Clause 40(5) is narrower, affecting only what the Government must report on. Clause 41(3) is a consequential power, common in Bills of this kind.
Amending the NIS Regulations by regulations is not in itself a Henry VIII power, because the NIS Regulations are secondary legislation. Part 2 of the Bill amends them directly.
What did the Lords committees say?
The Delegated Powers and Regulatory Reform Committee published its Seventh Report of Session 2026-27 (HL Paper 41) on 21 July 2026 and drew attention to Henry VIII powers in the Bill. Its findings on clause 40(5) are covered in our Lords Second Reading report. Delegated powers were among the themes raised at Lords Second Reading and Committee Stage, which sat on 1, 3, 7 and 9 September 2026.
Report Stage is next, with no date set. Any Government amendments narrowing these powers would appear in the print for that stage.
Where it appears in the Bill
- Clause 37(7)Power to amend clauses 36 and 37 to change the code of practice procedure.
- Clause 40(5)Power to amend clause 40 to change the matters covered in reports.
- Clause 41(3)-(4)Consequential provision may amend or repeal primary legislation, including this Act.
- Clause 42(5)(b)Draft affirmative procedure for Part 3 regulations amending primary legislation.
References are to HL Bill 32 as brought from the Commons. Read the Bill.
Frequently asked questions
What does clause 37(7) of the Cyber Security and Resilience Bill allow?
It lets the Secretary of State change, by regulations, the procedure for issuing or reissuing a code of practice. The regulations can amend clause 36 so far as it relates to consultation, and clause 37 other than subsection (7) itself. Clause 37 currently requires a draft code to be laid before Parliament for 40 days before issue.
Is amending the NIS Regulations a Henry VIII power?
No. The NIS Regulations 2018 are a statutory instrument, so changing them by further regulations is ordinary secondary legislation. A Henry VIII power is one that lets ministers change an Act of Parliament. In the Cyber Security and Resilience Bill, examples include clauses 37(7), 40(5) and 41(3), which allow the Bill or other Acts to be amended by regulations.
Will the Henry VIII powers be removed from the Bill?
That is not settled. The Lords Delegated Powers and Regulatory Reform Committee drew attention to them in July 2026, and delegated powers were debated at Lords Committee Stage in September 2026. Report Stage is next, with no date set, and any Government amendments would appear in the Report Stage print.