Appointing a UK representative under the Cyber Security and Resilience Bill

Who needs one

Under the Cyber Security and Resilience Bill (CSRB), a provider whose principal office is outside the UK must nominate a UK representative if it is an RMSP or RDSP. The rules are in regulation 14D for RMSPs and regulation 14A for RDSPs, as amended by HL Bill 32.

The test is your principal office, not where your customers or servers are. A small UK sales office may not change the answer if your principal office is elsewhere.

Regulation 8A has a similar nomination rule for certain operators of essential services. The Bill extends it to the new data infrastructure subsector, so overseas data centre operators should check it.

If you are a micro or small enterprise, you are not an RMSP or RDSP, so these duties would not apply.

What you have to do

1. Nominate a representative in the UK, in writing.
2. Notify the Information Commission of their name and contact details, including an email address and telephone number.
3. Do both within three months of section 14 starting, or of first becoming a provider this rule applies to.
4. Report changes as soon as reasonably practicable, and within 7 days.

What the representative does

The Bill says the Information Commission or GCHQ may contact the representative "instead of or in addition to" the provider, for the purposes of their functions under the Regulations. So a representative must be able to:

• Receive regulator and GCHQ contact reliably
• Reach the right people at the provider quickly, including out of hours
• Understand what to do with confidential or urgent requests
• Keep a record of what was received and passed on

The representative does not automatically take over security or incident reporting duties. Those remain with the provider.

What the representative does not change

Regulation 14D(6) says a nomination is "without prejudice to any legal action which could be initiated against the RMSP". In practice:

• The provider remains responsible for its own duties.
• Penalties remain a risk for the provider, and the percentage maximums for undertakings include turnover outside the UK.
• The representative should not be treated as a liability shield.

What to put in the agreement

The Bill does not require these terms. They are our suggestions for a contract with an outside representative:

• The scope of the role, referring to the NIS Regulations
• Time limits for passing on regulator contact
• 24/7 contacts at the provider
• Confidentiality and security handling
• What happens on termination, including time to appoint a replacement within your 7-day notification duty
• Allocation of liability, and insurance
• A review if the final Act changes the rules

Common mistakes

• Treating it as an admin address. A virtual office that forwards post weekly will not suit urgent contact from a regulator or GCHQ.
• Assuming a UK reseller fills the role. A reseller is only your representative if you nominate it in writing and notify the regulator.
• Forgetting the deadline for new providers. The three months runs from the day the rule first applies to you, which might be after a growth spurt or a new UK service.

Choosing someone

Options include a UK group company, a law firm or a specialist representative provider. Before appointing one:

• Check the definition of "representative" in regulation 1 of the NIS Regulations, as amended.
• Confirm that they accept this specific role, not only a UK GDPR role.
• Test the route: send a dummy regulator message and time it.

We have not found Information Commission guidance on representatives under the new regime as of 2 November 2026.

Sources

• The Bill as brought from the Commons (HL Bill 32), sections 7, 13 and 14
• Government RMSP factsheet
• NIS Regulations 2018