How this links to the Cyber Security and Resilience Bill
The statement gives ministers a formal way to steer the dozen or so NIS regulators towards common priorities. It replaces the national strategy duty in regulation 2 of the 2018 Regulations. It is one of the few parts of the Bill that commences automatically, two months after Royal Assent, so it is likely to be among the first things organisations see.
- cl.25(2): sets out the Government’s strategic priorities, the roles and responsibilities of regulators and others, and objectives for regulators.
- cl.26: regulators must be consulted for at least 40 days; the statement is laid before Parliament and cannot be designated if either House resolves against it within 40 days.
- cl.27: regulators must have regard to the statement and seek to achieve its objectives when exercising functions under the NIS Regulations, Part 3 and Part 4.
- Sch 2 paras 3, 4 and 14: omit reg 2 and reg 3(6), which continue until the first statement is designated.
What does the statement do?
The statement is addressed to regulators, not to regulated organisations. Once designated, each regulatory authority (including every designated competent authority and the Information Commission, under cl.24(8)) must have regard to it and seek to achieve any relevant objectives when using its NIS, Part 3 or Part 4 functions (cl.27).
That matters to organisations indirectly. The statement will influence how regulators prioritise supervision, how they use information notices and enforcement, and how they write sector guidance. Clause 28 requires the Secretary of State to report to Parliament each year on how regulators have complied and plan to comply.
How often can it change?
The statement can be amended, replaced in part or withdrawn, but not within three years of the last designation (cl.25(6)). There are two exceptions: a general election has taken place, or the Secretary of State considers there has been a significant change in Government policy or in the nature of threats (cl.25(7)). Any amendment goes through the same consultation and Parliamentary procedure as the original (cl.25(4), cl.26).
Consultation with regulators can be carried out before the clause comes into force (cl.26(8)), so a draft could be ready soon after Royal Assent. No draft has been published. Royal Assent is expected between late 2026 and spring 2027.
Where it appears in the Bill
- cl.25Designation, content, amendment and withdrawal of the statement; three-year rule.
- cl.26Consultation with regulators and 40-day Parliamentary procedure.
- cl.27Duty on regulatory authorities to have regard to the statement.
- cl.28Annual report to Parliament on regulators’ compliance.
- cl.60(2)(b); Sch 2 paras 3, 4, 14Commencement two months after Royal Assent; replacement of the NIS national strategy.
References are to HL Bill 32 as brought from the Commons. Read the Bill.
Frequently asked questions
Does the Statement of Strategic Priorities impose duties on businesses?
Not directly. Clause 27 places the duty on regulatory authorities, which must have regard to the statement and seek to achieve its objectives. Businesses will feel its effect through how regulators prioritise supervision, write guidance and take enforcement action under the NIS Regulations and Parts 3 and 4.
When will the first statement be published?
Clause 25 comes into force two months after Royal Assent under cl.60(2)(b). The statement must then have been consulted on with regulators for at least 40 days and laid before Parliament for 40 days. Consultation can start before commencement, but no draft has been published, and Royal Assent is expected between late 2026 and spring 2027.
What happens to the existing NIS national strategy?
Schedule 2 paragraphs 3 and 4 omit regulation 2 (the NIS national strategy) and regulation 3(6), which requires competent authorities to have regard to it. Paragraph 14 keeps both in effect until the first Statement of Strategic Priorities is designated, so there is no gap in strategic direction.