Regulator inspections: what happens and how to prepare
Under the Cyber Security and Resilience Bill (CSRB), a regulator can demand information, enter premises, copy or remove documents, take statements and run tests, and it can require you to pay the reasonable costs. If it finds failures, it can issue enforcement notices and fines, which you can appeal.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
Report Stage update: VinciWorks reports that Government amendments on 26 October 2026 narrowed the incident definition to incidents that have actually adversely affected systems, and removed mandatory near-miss reporting for data centre operators. We could not check this against the amended Bill, so the wording below reflects HL Bill 32 and may be out of date. See what Parliament changed.
The short version
Under the Cyber Security and Resilience Bill (CSRB), regulators can ask for information, inspect organisations they regulate, issue enforcement notices and impose penalties. Inspections already exist under the NIS Regulations 2018, and the Bill extends them to relevant managed service providers (RMSPs).
An inspector can enter premises, take copies of documents, take statements and run tests, and you may have to pay the reasonable costs. Regulators haven't all set out how they'll run this regime, so the steps below explain the legal powers rather than a fixed routine.
How the enforcement steps fit together
These powers aren't a strict ladder. A regulator can use them in different orders, and a penalty can be served whether or not an enforcement notice was served first.
| Step | What it does | Key rule |
|---|---|---|
| Information notice | Requires information or documents | Must explain what's needed, why, how and by when, and the consequences of not complying |
| Inspection | Tests your compliance in person or through others | Inspector must give notice of the consequences of non-compliance first |
| Enforcement notice | Requires you to fix a failure | Needs reasonable grounds; you can make representations first |
| Notice of intention to fine | Sets out the proposed penalty | You can make representations |
| Penalty notice | Imposes the final penalty | Must explain the appeal process |
| Appeal | Challenges certain decisions | Goes to the First-tier Tribunal |
Information notices
Under the Bill's new regulation 15, a regulator can demand information it reasonably needs to do its job. This can include:
- whether you're in scope
- how secure your systems are
- whether an incident occurred that could have had an adverse effect
- how you've implemented security measures, including after an inspection
- how much to fine or charge you
Three details go further than many organisations expect:
- It can reach other people. Notices can go to anyone likely to hold the information, not only regulated organisations.
- You may have to create information. A notice can require you to obtain, generate, collect or retain information you wouldn't otherwise keep.
- Location doesn't help. Notices can reach people and information outside the UK.
Privileged legal communications are protected. Failing to comply can lead to an enforcement notice and a higher-band penalty.
Inspections
Regulation 16 gives regulators three options: inspect themselves, appoint someone else, or direct you to appoint a person they approve.
What inspectors can do
- enter premises at a reasonable time, except premises used mainly as a home
- require material, documents, information or equipment to be kept undisturbed, including remotely held information
- require access to relevant material, documents, information or equipment
- examine, print, copy or remove documents, information, material or equipment
- take statements from anyone
- carry out tests, or direct you to do so
- take other reasonably required steps
What you must do
- pay reasonable costs, if the regulator requires it
- cooperate with the inspector
- give access to premises and people
- allow them to examine, copy or remove material
- comply with their requests
- not intentionally obstruct them
Your protections
- Inspectors must prove their identity if asked.
- They must give notice of the consequences of non-compliance before starting (new under the Bill).
- They must keep anything removed secure, and give notice explaining how it will be handled or returned, where practicable.
- They must take proportionate steps so you can keep meeting your duties.
- Privileged communications don't have to be produced (new under the Bill).
- Powers don't extend to premises, material, equipment or people outside the UK, although documents and information stored abroad can still be covered.
After an inspection
If a regulator has reasonable grounds to believe you've failed a duty, it can serve an enforcement notice. First it must tell you about the alleged failure and how to make representations, and it must consider what you send. The notice must explain the reasons and any steps required, with a deadline.
A penalty must be appropriate and proportionate, taking account of the impact of the failure, your steps to remedy it and your compliance record. Maximum amounts depend on the failure:
- Standard: greater of £10 million and 2% of worldwide turnover
- Higher: greater of £17 million and 4% of worldwide turnover
Failing to comply with inspection requirements or information notices falls in the higher band. Paying a penalty doesn't end your duty to comply with an enforcement notice.
Appeals
You can appeal enforcement and penalty notices to the First-tier Tribunal on these grounds:
- a material error of fact
- a procedural failure that substantially prejudiced you
- an error of law
- other material irrationality that substantially prejudiced you
Get legal advice quickly, as time limits apply.
How to prepare before anyone calls
Create an inspection readiness pack. It should be possible to produce these quickly:
- scope assessment and regulator details
- system inventory and network diagrams
- risk register and security policies
- Cyber Assessment Framework assessment, if you use it
- incident log, reporting decisions and near-miss log
- penetration test results and evidence of fixes
- training records
- supplier list and assurance records
- board papers showing oversight
Then rehearse:
- Name a lead. One person deals with the regulator, with a deputy.
- Brief reception and site teams. They should check identity and contact the lead straight away.
- Plan for legal advice. Decide who's called, and how privileged material is identified.
- Track everything. Keep a list of requests, items provided, items removed and statements given.
- Prepare staff. They should answer accurately and not guess. Your legal team can advise on how statements work.
- Check your suppliers. Make sure contracts let you get information held by MSPs and cloud providers.
Keep your records accurate and current. Polished documents that don't match how you actually operate won't hold up.
Sources
Frequently asked questions
Under the Bill's Schedule 1, regulation 16 inspection powers extend to relevant managed service providers, as they already do to operators of essential services and relevant digital service providers.
You must pay the reasonable costs of the inspection if the regulator requires it.
The Bill protects privileged communications from information notices and inspections. Take legal advice if a request might cover them.
Failing to comply with an information notice or inspection requirements can lead to an enforcement notice and a penalty in the higher band.
Yes. Enforcement and penalty notices can be appealed to the First-tier Tribunal on grounds including material error of fact, error of law and irrationality.