How this links to the Cyber Security and Resilience Bill
Clause 14 expands the existing digital service provider register and creates a new register for managed service providers. It fixes firm deadlines and sends the register to GCHQ. Registration is the first practical duty most newly regulated providers will face once the relevant provisions commence.
- Cl.14(2): amends reg 14 so RDSPs give their proper address, directors or partners, and which relevant digital services they provide.
- Cl.14(9): inserts reg 14C, a register of RMSPs with the same core details.
- Registration date: 3 months after the day cl.14 comes into force, or 3 months after the provider first meets the scope conditions (regs 14(4), 14C(4)).
- Regs 14(5) and 14C(6): the Information Commission sends the register to GCHQ within 4 months of commencement and annually after that.
- New reg 18(10): registration failures are in the standard penalty band.
Who has to register?
A relevant digital service provider must register under regulation 14, and a relevant managed service provider under new regulation 14C. Operators of essential services do not register with the Information Commission; instead they must notify their designated competent authority that they meet the thresholds (reg 8(2)).
Organisations exempt from RDSP or RMSP status, such as a micro or small enterprise or a body subject to public authority oversight with half or less of its income from commercial activity, do not need to register.
What must be submitted, and when?
The details are set out in regulation 14(2) as amended and regulation 14C(2). The registration date is the end of three months from the day clause 14 comes into force, for providers already in scope then, or three months from the day a provider first meets the scope conditions.
- name;
- proper address (registered or principal office for a company);
- names of directors, or of partners for a partnership;
- up-to-date contact details, including email and telephone (RMSPs);
- which relevant digital services are provided (RDSPs).
What about changes and overseas providers?
Changes must be notified as soon as reasonably practicable and within 7 days of taking effect (regs 14(3) and 14C(5)). Providers whose principal office is outside the UK must also nominate a UK representative within the same three-month window (regs 14A and 14D). Failing to register, failing to update, and failing to nominate a representative all fall in the standard penalty band: for an undertaking, the greater of £10 million and 2% of turnover.
Where it appears in the Bill
- Cl.14(2), NIS reg 14RDSP registration details and registration date.
- Cl.14(9), new reg 14CNew RMSP register.
- Regs 14A and 14DUK representatives for overseas RDSPs and RMSPs.
- New reg 18(10)Registration failures in the standard band.
References are to HL Bill 32 as brought from the Commons. Read the Bill.
Frequently asked questions
When will managed service providers have to register?
Within three months of clause 14 of the Act coming into force, if they are in scope on that day, or within three months of first meeting the scope conditions if later. Commencement will be set by regulations after Royal Assent, which is expected between late 2026 and spring 2027, so no calendar date is fixed yet.
Is there a registration fee?
The registration provisions in regulation 14 and new regulation 14C do not set a fee. The Bill does contain separate cost recovery powers allowing regulators to charge regulated persons, but how the Information Commission will use them is not yet settled. Check its guidance once the provisions commence.
Who sees the register?
The Information Commission maintains the registers, and the Bill requires it to send a copy to GCHQ within four months of clause 14 coming into force and annually after that, to support GCHQ's functions. The Bill does not require the register to be published, so whether it will be public is not settled.