What Parliament has changed in the Cyber Security and Resilience Bill so far
As of 2 November 2026, the Lords has added a review of the regime and a register of foreign powers to the Cyber Security and Resilience Bill (CSRB), and AI-agent powers. The Commons has yet to consider the Lords changes, so none of this is final.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
How to read this page
This page tracks changes to the Cyber Security and Resilience Bill (CSRB) up to 2 November 2026. It separates what we could confirm from what has only been reported. We could not access the latest Bill print or the Report Stage Hansard while writing this, so treat it as a guide to where to look, and check the Parliament website before acting.
Passage so far
| Date | Stage | Outcome |
|---|---|---|
| 3 to 24 February 2026 | Commons Committee | Line-by-line scrutiny |
| 16 June 2026 | Commons Report and Third Reading | Passed without a division |
| 17 June 2026 | Sent to the Lords | Printed as HL Bill 32 |
| 14 July 2026 | Lords Second Reading | Agreed without a division |
| 1, 3 and 7 September 2026 | Lords Committee | 193 amendments tabled, 5 agreed, all from the Government. Reprinted as HL Bill 49 |
| 26 October 2026 | Lords Report Stage | Two Government defeats |
| 2 November 2026 | Lords Third Reading | Scheduled. Outcome not yet confirmed here |
Changes at Report Stage: votes
| Amendment | Subject | Result |
|---|---|---|
| 163 | A statutory review within 12 months of Royal Assent | Agreed 202 to 155 |
| 164 | Register of foreign powers posing a cyber threat | Agreed 194 to 155 |
| 41 | Incident reporting by AI developers | Defeated 165 to 95 |
Sources describe the scope of Amendment 163 differently. Our earlier coverage focused on audit powers for the AI Security Institute. VinciWorks describes a broader review of the regime, including whether more sectors should come into scope. Read the amendment text itself before relying on either summary.
Changes at Report Stage: agreed without a vote
Amendment 70 was reported as a Government amendment giving the Secretary of State powers where a compromise involves loss of control of an AI agent.
Reported, but not confirmed here
VinciWorks reports that Government amendments at Report Stage also did the following:
- Narrowed the incident definition, so it covers incidents that have actually adversely affected the operation or security of systems.
- Removed mandatory near-miss reporting for data centres, with a voluntary framework to be developed instead.
- Required customer updates from data centres, digital service providers and managed service providers after a reportable incident.
If correct, these matter a lot. They would change the "capable of having" wording in HL Bill 32, and the government factsheet last updated on 30 June 2026 would no longer describe the final position. We found only this one source, so we have not rewritten other pages around it.
What was not changed
- Computer Misuse Act. An amendment on a review of a statutory defence was withdrawn in Committee. Ministers point to separate legislation instead.
- Vendor-related direction powers. The Government tabled these at Committee but did not move them, and they were not on the Report Stage list. They could return.
What this means for your planning
- Do not rewrite everything for one amendment. Wait for the final text before changing policies or contracts.
- Do plan for both versions of the incident test. If your process can classify events both ways, a late change will not leave you stuck.
- Keep near-miss logs anyway. They are useful evidence whatever the final reporting duty says.
- Treat the register of foreign powers and the review as things to watch. Neither directly creates a new day-to-day duty for most organisations.
What could still change
The Government may try to overturn its defeats in the Commons, particularly the foreign powers register. New amendments are also possible until both Houses agree the text.
Sources
Frequently asked questions
No. The Lords changes still have to go to the Commons, and the two Houses must agree the text before Royal Assent.
Yes. At Lords Report Stage on 26 October 2026 it lost two votes: 202 to 155 on Amendment 163, a review amendment, and 194 to 155 on a register of foreign powers.
One secondary source reports that mandatory near-miss reporting for data centres was removed at Report Stage in favour of a voluntary framework. We have not confirmed this in Hansard or the amendment papers, so check the latest print before relying on it.
No. Amendment 41, on developer incident reporting, was defeated 165 to 95.