The Cyber Security and Resilience Act: does it exist yet?
No. As of 2 November 2026 there is no Cyber Security and Resilience Act. The Cyber Security and Resilience Bill (CSRB) is still in Parliament and only becomes an Act on Royal Assent. Even then, the main duties on organisations start later, on dates set by regulations.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
The short answer
The Cyber Security and Resilience Bill (CSRB) is not an Act. Searches for "Cyber Security and Resilience Act" or "UK Cyber Security Act 2026" usually mean this Bill, but no such Act has been passed yet. This page will be updated when that changes.
Do not cite the Act in a contract, policy or board paper as if it were in force. Refer to "the Cyber Security and Resilience (Network and Information Systems) Bill" and say which version you relied on.
What has to happen first
- Lords Third Reading. This was scheduled for 2 November 2026. We have not yet confirmed the outcome.
- Commons consideration of Lords amendments. The Lords has changed the Bill, so MPs must consider those changes. Some could pass back and forth between the Houses.
- Royal Assent. The Bill becomes an Act when both Houses have agreed the text and it receives Royal Assent. This site projects that for late 2026 to spring 2027, but that is an estimate, not an official date.
What the Act would be called
The Bill's own text refers to the "Cyber Security and Resilience (Network and Information Systems) Act 2026". Part of its work is amending another law, the Network and Information Systems Regulations 2018, so expect to read both together.
What would change on the day
| When | What starts |
|---|---|
| Royal Assent | Part 1, Chapters 1, 3 and 6 of Part 3, section 40 and Part 5 |
| Two months later | Section 18(3) and (4), Chapter 2 of Part 3 and certain paragraphs of Schedule 2 |
| Date set by regulations | Everything else, including registration, security duties and incident reporting under Part 2 |
This is based on section 60 of the Bill as brought from the Commons. Check it against the final text.
So Royal Assent gives ministers their new powers quickly, but it does not by itself start the 24-hour reporting clock. See when the Bill comes into force for more detail.
What to do while it is still a Bill
- Work out your likely category. Use OES vs RDSP vs RMSP and the Schedule 2 thresholds.
- Assign an owner. Name someone to follow the final text and any consultations.
- Rehearse the hard parts. Registration data and 24-hour notification are both quicker to prepare before you are under a deadline.
- Avoid hard-coding details. Regulation numbers, and some duties, may change before the final Act.
How to refer to it correctly
Several similar names are in use, which causes real confusion in contracts and supplier questionnaires.
| Name | What it is | Status on 2 November 2026 |
|---|---|---|
| Cyber Security and Resilience (Network and Information Systems) Bill | The UK Bill, often shortened to the Cyber Security and Resilience Bill or CSRB | Before Parliament |
| Cyber Security and Resilience (Network and Information Systems) Act 2026 | The name used in the Bill's text for the future Act | Does not exist yet |
| NIS Regulations 2018 | The current UK law, which the Bill amends | In force |
| EU Cyber Resilience Act | A separate EU law on products with digital elements | EU law, not this Bill. See our name explainer |
| NIS2 | A separate EU directive | EU law. See does NIS2 apply to UK companies? |
If a supplier or customer document says "the Cyber Security Act", ask which law they mean.
What to change in your documents after Royal Assent
When the Act is passed, check any policy, contract or risk register that mentions the Bill:
- Replace the name and citation using the published Act.
- Check clause numbers. A section of the Bill can move or change as amendments are made.
- Separate what has started from what has not. An Act can exist while its main duties are still waiting for commencement regulations.
- Do not assume a duty is live just because it is in the Act. Check for commencement regulations.
- Remember the NIS Regulations. Many duties will sit in the amended Regulations, so you may need to cite both.
Sources
Frequently asked questions
No. It does not exist yet. The Bill has to finish its passage through Parliament and receive Royal Assent first.
The Bill’s text refers to the Cyber Security and Resilience (Network and Information Systems) Act 2026. The year would change if Royal Assent falls in 2027.
No. Only some provisions start on the day of Royal Assent, and others two months later. The rest, including the Part 2 duties on regulated organisations, start on dates set by regulations.
No. The EU Cyber Resilience Act is a separate EU law about products with digital elements. The UK Bill mainly amends the NIS Regulations 2018 and regulates services and operators.