The register of foreign powers amendment explained
The register of foreign powers is a Lords amendment to the Cyber Security and Resilience Bill (CSRB) requiring the Government to list states posing an acute cyber risk. Peers backed it 194 to 155 on 26 October 2026, but the Commons could still reverse it.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
Where this stands
The register of foreign powers is a Lords amendment to the Cyber Security and Resilience Bill (CSRB), which would require the Government to keep a list of foreign states that pose a serious cyber threat to the UK. Peers agreed it by 194 votes to 155 on 26 October 2026, against the Government's wishes.
It is not law. The Commons must now consider the Lords' changes, and the Government may try to reverse it. Check the timeline for the latest position.
What the amendment would do
We could not retrieve the amendment's final printed text, so this summary relies on a sponsor's account and parliamentary reports. Check the wording before relying on any detail.
Amendment 164 was moved by Viscount Camrose and supported by Lord Alton and Lord Markham. It would create a register of foreign powers said to pose an acute risk to critical network and information systems, for use with the Secretary of State's national security powers under Part 4.
According to Lord Alton's account:
- Listing would depend on assessments led by GCHQ, not diplomatic judgement.
- A state would be listed if intelligence agencies confirmed that it or its proxies attacked essential services in the previous seven years, or warned of imminent danger.
- For China, the state, military and Communist Party would be treated as one entity.
- The Secretary of State would review risks from foreign-owned infrastructure in the UK and lay an action plan before Parliament within six months.
An earlier version, considered in the Commons, had also proposed regulations within six months.
The arguments
For. Supporters want a clear, objective record of which countries are a threat, so organisations and ministers aren't relying on case-by-case judgement. Lord Alton argued that the UK needs to be much clearer about who is threatening its security.
Against. The Minister opposed it. She warned that a country-based register could create false certainty. A list could also suggest that anything not on it is safe, whereas the actual risk depends on the system, supplier and threat. A public list also has diplomatic consequences, which the Government would want to weigh.
How it would fit with the rest of the Bill
The register does not itself ban suppliers from any listed country. It is tied to Part 4, which lets the Secretary of State give national security directions to regulated organisations.
It is also separate from:
- Vendor direction powers, which would target specific suppliers and were not on the Report Stage list.
- Critical supplier designation, which depends on the impact of disruption, not on a supplier's country.
- The accepted information-sharing change. Lord Alton also describes a separate Government amendment, Amendment 45, intended to limit sharing of information with hostile states.
What could happen next
| Outcome | Effect |
|---|---|
| The Commons accepts it | The register becomes part of the Act, subject to any later regulations |
| The Commons rejects it and the Lords gives way | No register |
| The Commons rejects it and the Lords insists | Ping-pong between the Houses continues |
| A compromise is agreed | A narrower register, a reporting duty or a review could take its place |
The Government's majority makes reversal in the Commons plausible, but only the Commons vote will settle it.
What organisations should do
Do not build your supplier policy around a list that doesn't yet exist. But the amendment points to questions you may be asked anyway.
- Know supplier ownership and control. Identify suppliers where state ownership or influence is a realistic concern.
- Look beyond the headline supplier. Components, subcontractors and support teams can raise the same issues.
- Assess risk by what the supplier can reach. Access to core systems matters more than a flag on a form.
- Avoid country-only rules. Blanket decisions can raise legal issues and give false assurance. Document why you made each decision.
- Plan how you would respond to a change. If a state were listed, or a direction were given, could you identify and replace affected systems?
- Follow the final wording. Whether the register is public, classified or only feeds ministers' decisions would change its practical impact.
What we do not know
- The exact text that returns to the Commons.
- Whether any register would be public.
- Whether being listed would have any direct legal effect on companies from that country.
- How it would interact with existing sanctions and investment-screening rules.
Sources
Frequently asked questions
No. It is a Lords amendment to a Bill that has not been passed. The Commons must consider it.
Not by itself, based on the accounts we have seen. It is linked to the Secretary of State’s Part 4 powers. Check the final wording.
The Minister warned that a country-based register could create false certainty.
There is no need to build around a list that does not exist. Do understand supplier ownership and how you would respond to a direction.