Vendor-related direction powers explained
Vendor-related direction powers would let ministers tell regulated organisations to stop buying from or remove a supplier judged a national security risk. Tabled for the Cyber Security and Resilience Bill (CSRB), they were not on the Report Stage list, but existing Part 4 directions can already reach goods and services.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
Where this stands
Vendor-related direction powers would let a minister order regulated organisations to stop buying from a supplier, restrict how they use its products, or remove equipment already installed. The Government tabled amendments for them ahead of Lords Committee Stage, but did not move them there, and they were not on the Report Stage marshalled list on 26 October 2026.
So they were not in the printed Cyber Security and Resilience Bill (CSRB) we reviewed. They could still return in the Commons or a later stage. Treat the detail below as reported proposals, not settled law.
What the Bill already allows
Do not assume this means ministers have no such power. Part 4 of the Bill already lets the Secretary of State give a national security direction to a regulated person. That direction can include:
- a prohibition or restriction on using goods, services or facilities
- a prohibition on installing goods or taking up services or facilities
- a requirement to remove, disable or modify goods or facilities, or modify services
The trigger is different. A direction under clause 43 needs a security or operational compromise, or the threat of one, that gives rise to a risk to national security, and must be necessary and proportionate. The vendor proposal is reported to focus on the supplier itself.
What the proposals were reported to do
According to the Government's announcement and reporting on the tabled amendments, a minister could require in-scope organisations to:
- stop procuring goods, services or facilities from a named supplier
- restrict or set conditions on using that supplier's products or services
- modify, disable or remove equipment or software already in place
The reported aim is to deal with suppliers that may pose a critical national security risk, particularly those with ties to hostile states.
How it compares with the Huawei powers
The model is the designated vendor direction regime in the Telecommunications (Security) Act 2021, which was used to require removal of Huawei equipment from UK 5G networks. Two reported differences matter:
| Telecoms regime | Reported proposal | |
|---|---|---|
| Scope | Public telecoms providers | Sectors regulated under the Bill |
| Naming the vendor | Vendor designated publicly | No requirement for public designation first |
| Telling the vendor | Vendor notified | No duty to send the vendor a copy |
| Oversight | Reports and notices under that Act | Reported aggregate reporting to Parliament |
Critics argue less transparency makes decisions harder to challenge. The Government's case is that quiet, quick action may be necessary for security. See our vendor powers news post for how this developed.
How this differs from critical supplier designation
These are easy to confuse, but they work in opposite ways.
- Critical supplier designation brings an important supplier into regulation, so the supplier must meet duties. A regulator makes the decision.
- A vendor direction would tell the customer to stop using, restrict or remove a supplier. A minister would make the decision.
A supplier can be important and trustworthy, or small and considered high risk. The tests are separate.
What to do now
Nothing here is in force, and the provisions may never pass in this form. But national security directions already appear in the text, and the steps below are useful anyway.
- Map where key suppliers sit. Include embedded components, software libraries and suppliers' own subcontractors. You cannot remove what you cannot find.
- Identify what would be hard to replace. List single points of dependence, and how long replacement would take.
- Know supplier ownership and jurisdiction. Record where this is known and what is unclear.
- Review contracts. Check termination, step-in and exit rights, and what happens if a legal direction forces you to stop using a product.
- Draft a removal playbook. Plan for at least one important system, with costs and service impact.
- Check confidentiality handling. A direction may carry non-disclosure requirements, so decide who would receive one and how it stays restricted.
- Follow the Commons stage. Check the timeline for the latest position.
Sources
Frequently asked questions
No. The Bill is not yet law, and these powers were proposed by Government amendments that were not on the Lords Report Stage list. They could still return.
Designation brings a supplier into regulation. A vendor direction would tell a customer to stop using, restrict or remove a supplier’s products.
Clause 43 lets the Secretary of State prohibit or restrict goods, services or facilities through a national security direction, if its tests are met.
We have not found a settled answer in the proposals. Assume your organisation could bear the cost until the final text says otherwise.