When does the Cyber Security and Resilience Bill come into force?
Not all at once, and not yet. The Cyber Security and Resilience Bill (CSRB) must first receive Royal Assent. Some parts then start immediately and some two months later, while the main duties on regulated organisations start on dates the Secretary of State sets by regulations.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
The three stages
The Cyber Security and Resilience Bill (CSRB) has no single start date. In the text brought from the Commons, section 60 sets out three stages. Section numbers may change in the final Act.
| Stage | When | What starts | What it means for you |
|---|---|---|---|
| 1 | The day of Royal Assent | Part 1, Chapters 1, 3 and 6 of Part 3, section 40 and the final Part (general provisions) | Mostly powers and technical provisions. Ministers can begin using the powers to make regulations |
| 2 | Two months after Royal Assent | Section 18(3) and (4), Chapter 2 of Part 3 and some paragraphs of Schedule 2 | Includes the statement of strategic priorities and some information sharing provisions |
| 3 | A date set by the Secretary of State in regulations | Everything else | Includes most of Part 2: new regulated groups, registration, security duties, incident reporting, charges and penalties |
Stage 3 can use different dates for different purposes, so duties may not all begin together. Transitional provisions are also possible.
Royal Assent will not start your 24-hour clock
The new reporting rules are in Part 2, which is not on either fixed list. Until the relevant date is set, the existing NIS Regulations 2018 continue to apply to the organisations they already cover. Nothing in the Bill's text gives a date for this stage.
Where the Bill is now
Lords Third Reading was scheduled for 2 November 2026. The Commons must then consider amendments made by the Lords, and the two Houses must agree a final text before Royal Assent. For the latest position, see the status and timeline page.
The Bill's text refers to the "Cyber Security and Resilience (Network and Information Systems) Act 2026". That title could change if the Bill passes in 2027.
Deadlines that depend on commencement
The Bill sets some periods but not the dates they run from. These deadlines start when the relevant section comes into force.
| Duty | Who | Deadline |
|---|---|---|
| Register with the Information Commission | RMSPs and RDSPs in scope on the day | 3 months from section 14 coming into force |
| Register if you come into scope later | RMSPs and RDSPs | 3 months from first meeting the conditions |
| Nominate a UK representative | RMSPs and RDSPs with a principal office outside the UK | 3 months, on the same basis |
| Provide information to the regulator | Data centre operators | 3 months from being treated as designated, or from notice of designation |
| Update registered details | RMSPs, RDSPs and data centre operators | As soon as reasonably practicable, and within 7 days of the change |
Critical supplier designation has a separate rule. Section 12 cannot start on a different day from the first regulations under section 29(1) that place requirements on providers of activity-critical supplies. So designations cannot begin until those requirements are ready.
What to do at each stage
Now, before Royal Assent
- Work out which category applies to each of your services.
- Draft your incident process using the 24-hour runbook.
- Identify who would submit registration details, including directors' names and contact details.
At Royal Assent
- Read the final Act, as Lords amendments and any later changes could alter this guide.
- Watch for regulations and consultations. Stage 1 lets ministers start using some of the new powers.
At the two-month point
- Check for a draft statement of strategic priorities, which will guide regulators.
When commencement regulations are published
- Put the dates in your compliance plan.
- Check for transitional rules and regulator guidance.
- Register within the three-month window.
- Run a test of your incident process with the regulator's published form, if there is one.
Why not wait?
Security changes and contract updates can take longer than the three-month registration window. That is our view, not a legal requirement. Starting with scoping and incident readiness is usually low cost, and the work is useful even if the detail changes. The compliance guide covers the wider preparation.
Sources
Frequently asked questions
No. It becomes law when it receives Royal Assent. Lords Third Reading was scheduled for 2 November 2026, and the Commons must then consider the amendments made by the Lords.
The reporting duties are in Part 2, which is not on either of the fixed commencement lists. They start on a date set by regulations, so Royal Assent alone will not start the 24-hour clock.
For RMSPs and RDSPs, the registration deadline is three months after the registration section comes into force, or three months after first meeting the conditions if that happens later.
The Bill’s text refers to the Cyber Security and Resilience (Network and Information Systems) Act 2026. The year could change if Royal Assent falls in 2027.