Does the Cyber Security and Resilience Bill apply to US and overseas companies?
Yes, it can. The Cyber Security and Resilience Bill (CSRB) covers managed and digital service providers offering services in the UK, whether or not they are established there. A US company meeting the tests could have to register, report incidents and appoint a UK representative.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
The short answer
Location does not get you out of the Cyber Security and Resilience Bill (CSRB). The question is whether you provide a covered service in the UK and meet the tests. The Bill is not yet law, and the US is not named anywhere in it: the same rules apply to any company outside the UK.
Who is caught
| Category | Overseas wording in HL Bill 32 | Other tests |
|---|---|---|
| RMSP | Provides a managed service in the UK "whether or not the person is established in the United Kingdom" | Not micro or small; public authority oversight conditions |
| RDSP | Provides a relevant digital service in the UK, with the same wording | Not micro or small; public authority oversight conditions |
| OES | New regulation 8(1ZA) says the rule applies whether or not the person is established in the UK | Meets the Schedule 2 threshold, or is designated |
| Regulated persons under section 29 regulations | Section 30(3) contains the same wording | Depends on the regulations |
The Bill does not define every practical case, such as how much UK activity counts as providing a service "in the UK". We have not found regulator guidance on this, so take advice if you serve UK customers only occasionally.
Examples
- US managed security provider with UK customers. A contract for ongoing monitoring with access to customer systems looks like a managed service. The government's factsheet lists SOC and SIEM services as examples.
- Non-UK cloud platform sold to UK businesses. Check it against the cloud computing definition: scalable, elastic, shareable resources, on-demand and with broad remote access.
- Non-UK data centre. The data centre service is described as being provided in the UK, so a facility outside the UK looks unlikely to be caught by that entry. A foreign company running a UK facility could be.
- Software licensed to UK businesses, with no ongoing access. This may not be either service, but check how it is actually delivered.
What an overseas provider would have to do
- Register with the Information Commission within three months, if you are an RDSP or RMSP.
- Nominate a UK representative in writing and notify the regulator. See UK representatives.
- Manage risk to systems you rely on to provide services in the UK.
- Report significant incidents within 24 and 72 hours, with a copy to the CSIRT.
- Notify affected UK customers. The duty covers customers in the UK.
These sit alongside UK GDPR, which has its own rules on overseas organisations.
Enforcement
The maximum penalties for undertakings count turnover "both inside and outside the United Kingdom". So a global group could face a much larger maximum than its UK revenue suggests. How regulators would enforce against companies with no UK presence is a practical question the Bill's text does not fully answer.
If you also operate in the EU
A provider serving both the UK and EU may also have duties under NIS2, including an EU representative for certain digital providers. The two regimes are separate, so meeting one does not show you have met the other. See does NIS2 apply to UK companies? for the reverse position.
What to do now
- List your UK customers and services, and map them against the definitions.
- Check your size against Commission Recommendation 2003/361/EC, including linked businesses.
- Identify who could act as a UK representative.
- Make sure your incident process works in UK time and can reach UK customers.
Sources
- The Bill as brought from the Commons (HL Bill 32), sections 3, 7, 9, 14, 21 and 30
- Government RMSP factsheet
- Mayer Brown: Bill introduced to Parliament
- Our Report Stage coverage
Frequently asked questions
It can, if it provides a cloud computing service in the UK, is not a micro or small enterprise and meets the other RDSP tests. Whether a SaaS product fits the cloud definition depends on the facts, so check the definition in regulation 1.
The Bill does not require one, but RDSPs and RMSPs with a principal office outside the UK must nominate a UK representative in writing.
No. The Bill says the nomination does not affect any legal action that could be started against the provider itself.
Yes. For undertakings, the percentage maximums refer to turnover both inside and outside the UK.
Regulation 14H focuses on directly supplying a regulated organisation, and has no UK establishment test. During the Lords debate, the minister said a non-UK model developer could potentially be designated.