Henry VIII powers in the Cyber Security and Resilience Bill
Henry VIII powers let ministers change Acts of Parliament through secondary legislation. The Cyber Security and Resilience Bill (CSRB) contains several, along with wider regulation-making powers, so your duties could change after the Act passes without a new Bill.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
What a Henry VIII power is
A Henry VIII power lets a minister change an Act of Parliament using secondary legislation, which gets less scrutiny than a Bill. The name refers to the Statute of Proclamations of 1539, which gave that king wide law-making power.
The Cyber Security and Resilience Bill (CSRB) contains several of these powers. They matter to businesses because many of the rules you will actually follow could be set or changed by regulations after the Act passes.
Why this matters more than it sounds
The Bill is partly a framework. Part 2 makes direct changes to the NIS Regulations. Part 3 gives the Secretary of State broad powers to make further regulations on the security and resilience of network and information systems, and on who and what is regulated.
So the Act that passes is not the final word. Your duties could expand through regulations without a new Bill.
The two kinds of power people mix up
Ordinary regulation-making powers let ministers fill in or extend a regime. Clause 29, for example, allows regulations to manage and reduce risks of security or operational compromise, and to mitigate their impact. This is broad, but it is not itself a Henry VIII power in the strict sense unless it changes primary legislation.
True Henry VIII powers let regulations amend Acts of Parliament, sometimes including this one.
| Clause | What it allows | Why it was flagged or matters |
|---|---|---|
| 37(7) | Changing the procedure for issuing a code of practice, by amending clause 36 so far as it concerns consultation, and clause 37 | The Lords committee called it unusual |
| 40(5) | Changing what must be covered in the five-yearly report on NIS legislation | The Lords committee described it as broad |
| 41(3) | Consequential provision in Part 3 regulations that can amend or repeal primary legislation | Could reach other Acts, and the Bill once enacted |
Clause numbers come from the text brought from the Commons, and may change.
What Parliament can do about them
Draft affirmative procedure. Clause 42(5)(b) requires both Houses to approve regulations under Part 3 that amend primary legislation before they are made.
Made affirmative procedure. Ministers said a Commons Committee amendment allows national security powers to be used in an emergency through a procedure where regulations are made first and approved afterwards.
The limit on this scrutiny. Parliament can approve or reject regulations, but it generally can't amend them. Rejection is rare, which is why peers worry about wide powers.
What the Lords said
The Delegated Powers and Regulatory Reform Committee reported on the Bill in its Seventh Report of Session 2026-27 (HL Paper 41), published on 21 July 2026. It drew attention to clauses 37(7) and 40(5). A further report and the Constitution Committee's report were also cited at Report Stage.
At Second Reading, the Minister said most delegated powers are subject to consultation and the affirmative procedure. The Government argues it needs flexibility because cyber threats change faster than primary legislation can.
We could not retrieve the full committee report for this guide, and we have not confirmed how far amendments narrowed these powers. Read the final Act before relying on the table above.
What this means for your compliance plan
Do not treat Royal Assent as the finish line. Instead:
- Plan for change. Build room in budgets and contracts for later requirements.
- Watch consultations. The most useful time to influence a rule is before a draft reaches Parliament. Our tracker follows what is still to be decided.
- Add a change-in-law clause. Use it with suppliers and customers, so new regulations don't force a renegotiation.
- Assign an owner. Someone should check for new regulations and regulator guidance.
- Align to stable principles. Good risk management, detection and incident response hold up better than any single checklist. The Cyber Assessment Framework is a practical place to start.
- Avoid over-engineering for rumours. Plan for what is published, and record assumptions you will revisit.
What is unsettled
- Whether the final Act keeps each power as drafted.
- How often ministers will use them.
- Which requirements will appear in the first regulations.
Sources
Frequently asked questions
A power in an Act that lets a minister amend or repeal primary legislation using secondary legislation.
Examples in the text brought from the Commons include clauses 37(7), 40(5) and 41(3). Numbering may change in the final Act.
Regulations amending primary legislation under Part 3 need approval by both Houses. Parliament can generally approve or reject them, but not amend them.
Because new or changed duties can arrive through regulations, without a new Bill. Build monitoring and change clauses into your plan.