How this links to the Cyber Security and Resilience Bill
Search engines have been regulated as digital services since 2018. The Bill leaves the definition alone but brings search providers under the reshaped Relevant Digital Service Provider regime, with fixed 24 and 72-hour incident reporting, customer notification, fuller registration and a higher penalty band for security and reporting failures. Most in-scope providers are large and based abroad, so the UK representative rules matter.
- cl.7(5): an online search engine is one of three relevant digital services, with online marketplaces and cloud computing services.
- cl.7(8), new reg 1(3)(e): the RDSP definition applies whether or not the provider is established in the UK, subject to the micro or small, public authority oversight and critical supplier exemptions.
- cl.15, new reg 12A: 24-hour initial and 72-hour full notification to the Information Commission, both from first awareness, with a copy to the CSIRT.
- cl.14, reg 14A: an RDSP with its principal office outside the UK must nominate a UK representative and notify its details, including email and phone, within 3 months.
What counts as an online search engine?
Regulation 1(2) of the NIS Regulations 2018 defines an online search engine as “a digital service that allows users to perform searches of, in principle, all websites or websites in a particular language on the basis of a query on any subject in the form of a keyword, phrase or other input”. The Bill does not amend this wording.
The phrase “in principle, all websites” is the dividing line. General web search engines and those covering all websites in one language are in. A search box that only indexes your own website, product catalogue or document library is not an online search engine, however sophisticated it is.
Whether AI answer engines that search the web fall within the definition depends on how they work and is not addressed by the Bill. The AI companies guide discusses the wider AI scope debate at Lords Committee.
What does a search engine RDSP have to do?
It must register with the Information Commission, meet the reg 12 security duty for the systems it relies on to provide the service, report significant incidents under reg 12A and notify affected customers under reg 12C. Non-UK providers need a UK representative.
Security duty and incident notification failures carry the higher maximum under new reg 18, the greater of £17m and 4% of turnover. Registration and representative failures carry the standard maximum, the greater of £10m and 2%. The online marketplaces and search engines guide covers the full regime.
Is it an online search engine under the NIS Regulations?
| Service | Likely position | Why |
|---|---|---|
| General web search engine | In scope (unless micro or small) | Searches, in principle, all websites |
| Search engine covering all websites in one language | In scope (unless micro or small) | Definition expressly includes a particular language |
| Site search on a retailer’s own website | Out of scope | Does not search all websites |
| Enterprise document search tool | Out of scope as a search engine | Searches the customer’s own content only |
Where it appears in the Bill
- NIS reg 1(2)2018 definition of online search engine, not amended by the Bill.
- cl.7(5), (8)Relevant digital service and the RDSP definition, including non-UK providers.
- cl.15, new reg 12A24-hour and 72-hour incident notification to the Information Commission.
- cl.14, reg 14AUK representative for RDSPs with a principal office outside the UK.
References are to HL Bill 32 as brought from the Commons. Read the Bill.
Frequently asked questions
Does a search function on my website make me an online search engine?
No. The NIS definition requires a service that lets users search, in principle, all websites or all websites in a particular language, on a query about any subject. A search box that only covers your own site, catalogue or content does not meet that test, so it does not make you a Relevant Digital Service Provider.
Do foreign search engines have to follow the Cyber Security and Resilience Bill?
Yes, if they provide the service in the UK and are not micro or small. The RDSP definition applies whether or not the provider is established in the UK. A provider with its principal office abroad must nominate a UK representative and notify the Information Commission of the representative’s name and contact details within three months.
How fast must a search engine report a cyber incident?
Under new regulation 12A, an initial notification must reach the Information Commission within 24 hours and a full notification within 72 hours. Both periods run from when the provider is first aware that a reportable incident has occurred or is occurring, so the 72 hours do not start after the first report. A copy goes to the CSIRT.