Will the Cyber Security and Resilience Bill actually be enforced?

Will the Bill actually be enforced?

Probably more than before, but nothing guarantees it. Under the NIS Regulations 2018, regulators levied no penalty notices by 2022 and, the Government's 2025 impact assessment said, "very few fines" since. The Cyber Security and Resilience Bill (CSRB) would raise fines, sharpen information and inspection powers and fund regulators through charges. Whether they use them is the open question.

The Bill has passed both Houses but is not yet law. The Commons still has to consider Lords amendments; on 4 November 2026 the Commons extended the carry-over, so the Bill lapses if it is not passed by the end of 29 April 2027. Most enforcement provisions start only when commencement regulations are made. Check the timeline for the latest position. Clause numbers below are from HL Bill 62, the text as amended on Report.

What is the enforcement record under the NIS Regulations 2018?

Thin. The Government has reviewed the 2018 Regulations twice, and the Bill's own Impact Assessment updates the picture.

Source	Date	What it says about enforcement
First post-implementation review (DCMS)	29 May 2020	"a clearer and more effective enforcement regime is needed, achieved by refining the current provisions around notices, penalties, and thresholds"
Second post-implementation review (DCMS)	4 July 2022	"NIS competent authorities have levied no penalty notices since the regulations came into effect"
Same review	4 July 2022	"Enforcement has only been confirmed to have been carried out by 2 competent authorities"
Same review	4 July 2022	"there are cases where enforcement activities were merited but no action was taken"
Same review	4 July 2022	Regulators relied on "regular engagements, inspections, and information notices rather than any binding provisions of the regulations, such as enforcement notices, civil proceedings, or penalty notices"
Bill Impact Assessment (DSIT)	12 November 2025	"The 2022 PIR showed that no fines had been levied by regulators since the Regulations came into effect in 2018. Since then, through engagement with regulators, we know that very few fines have been levied and the issues highlighted in the PIR persist."

Two things are not published. We could not find any NIS penalty notice on a regulator's website, and the Impact Assessment does not say how many "very few" means, which regulators issued them or for what. If a count exists, it has not been made public.

Incident reporting under the old regime was also thin. The Impact Assessment said only 13, 12 and 22 NIS incidents were reported in 2019, 2020 and 2021, because "the definition of a significant incident is too narrow".

Wasn't Advanced Computer Software Group fined after the NHS 111 attack?

Yes, but not under the NIS Regulations. On 26 March 2025 the Information Commissioner issued a penalty notice of £3,076,320 against Advanced Computer Software Group, Advanced Health and Care and their parent, Aston Midco. The notice was given under section 155 of the Data Protection Act 2018 for an infringement of Article 32(1) UK GDPR, the security of processing. The Commissioner first proposed £6,090,000, and Advanced settled and agreed not to appeal.

That is a data protection fine about personal data. It says nothing about NIS enforcement, and it should not be quoted as a NIS fine. Under the Bill, a firm that manages IT systems for customers and is not a micro or small enterprise would be a relevant managed service provider, so a similar future case could run under both regimes.

Why was enforcement so rare?

The reviews give four reasons, and the Government repeats most of them.

1. A collaborative model by design. The 2022 review says the framework "is predicated on a collaborative relationship between regulators and regulated entities" and that formal tools "should only be used as a last resort".
2. Unclear penalty bands. Today's regulation 18(6) has three caps: £1 million for a non-material contravention, £8.5 million for a material one and £17 million where there is a significant risk or impact. The GOV.UK enforcement factsheet says this structure is "not sufficiently transparent" and "can lead to unnecessary legal challenges and difficulties in using enforcement action".
3. A low ceiling. The Impact Assessment said £17 million can be "less than 1% of the annual turnover of regulated organisations", so in some sectors the fine can be cheaper than compliance.
4. Stretched regulators. In the 2022 review, 5 competent authorities said they did not have the right tools, citing "lack of capacity and capability (staff and training); and limited powers". The review's summary was blunt: "Competent authorities also need more resources".

Our analysis. Only the second and third reasons are fixed in the Bill's text. The first is a policy choice that the Bill keeps. The Minister in the Commons said "Our goal is 100% compliance and zero fines" (HC Deb 6 January 2026, c177), and in the Lords that "The ideal scenario is no penalties at all". The fourth depends on money and hiring that the Bill enables but does not supply.

How many regulators are there: 12 or 18?

The Government says 12. A Lords supporter of the regime review said about 18. The statute supports 12 today.

Claim	Who and where
"12 regulators are responsible for implementing these laws"	GOV.UK summary factsheet (updated 3 November 2026)
"Twelve regulators (called 'competent authorities' in the regulations)"	Bill Impact Assessment, 12 November 2025
"Our 12 regulators cover all NIS sectors and the UK's four nations"	Baroness Lloyd of Effra, Lords Second Reading, 14 July 2026
"a multiplicity of cyber regulators, an estimated 18 in all ... How could 18 regulators possibly amass the necessary skills"	Lord Birt, Lords Report, 26 October 2026, HL Deb c1001

We counted the bodies named in Schedule 1 of the NIS Regulations. There are 11: the Secretary of State for Energy Security and Net Zero, the Gas and Electricity Markets Authority, the Secretary of State for Transport, the Civil Aviation Authority, the Secretary of State for Health, the Secretary of State for Environment, Food and Rural Affairs, Ofcom, the Scottish Ministers, the Drinking Water Quality Regulator for Scotland, the Welsh Ministers and Northern Ireland's Department of Finance. Regulation 3(2) adds the Information Commission for digital services, which makes 12.

Our analysis. Lord Birt did not show how he reached 18, and we cannot reconcile it with Schedule 1. The Bill's new sectors go to bodies already on the list: Ofcom for data centres (clause 4) and, according to the Government's factsheet, DESNZ and Ofgem for large load controllers. The number could rise later, because clause 24(6) lets the Secretary of State designate further "regulatory authorities" by regulations. His underlying point stands either way. Several of these bodies are government departments or devolved administrations with other main jobs, and the 2022 review found capacity varied by sector.

How will regulators be paid for?

By charging the organisations they regulate, if they choose to. This is the Bill's main answer to the resourcing problem.

The 2018 Regulations already let a regulator invoice an operator for "the reasonable costs" of NIS work on that operator (regulation 21). The 2022 review said "certain costs cannot currently be transferred due to limitations on cost recovery powers". The GOV.UK cost recovery factsheet adds that regulators "cannot recover costs related to most enforcement activities" and can only bill after the costs are incurred.

Clause 17 would add a new Part 5A to the NIS Regulations:

New power	What it allows	Safeguard in the text
Periodic charges (reg 20A)	Charging schemes covering the regulator's costs or expected costs, including enforcement	The scheme must be published and regulated persons consulted before it is made or revised
Turnover-based charges (reg 20B(1))	Charges set by reference to turnover	If there is a dispute, the regulator's figure applies
Transparency statement (reg 20B(3) to (5))	Each regulator publishes what it collected and what the functions cost	Published after each chargeable period
One-off charges (reg 20C)	Invoices for work done on a particular person	No charge for appeals, civil proceedings or work already covered by a scheme

The factsheet says the power is "optional. It is a power, not a duty" and that "regulators will not be able to make a profit". Part 3 regulations could add a further charging route (clause 35). For what this means for your budget, see cost recovery.

Our analysis. Charging fixes the funding gap only for regulators that build a scheme, consult on it and then hire. Charging schemes sit in Part 2, which needs commencement regulations, so there will be a gap between new duties and new money. Sir Julian Lewis raised exactly this in the Commons, asking whether "duties will be laid on regulators to fulfil their role before they have the resources to carry it out" (HC Deb 6 January 2026, c177). The Minister replied that "the regulators will not know what they are regulating until the Bill has passed". Public sector operators and their regulators sit partly outside the logic too: the 2022 review assumed public regulators' costs "have not been passed on" to public sector operators.

What does the Bill change for enforcement?

It widens the tools, raises the ceilings and simplifies the bands. Every item below would apply only once the relevant provision is commenced.

Tool	Today	Under the Bill	Clause
Information notices	Regulation 15	Rewritten. Can go to "any other person" likely to hold the information, not just the regulated firm. Can require a person to generate or collect information. Reaches information stored outside the UK. Legal privilege protected. Failure gets its own enforcement notice route (reg 17(2ZB)), appealable to the First-tier Tribunal, and sits in the higher penalty band	20 (new regs 15 and 15A); 21; Sch 1 paras 3 and 4
Inspections	Regulation 16 covers OES and RDSPs	Extended to RMSPs. Inspectors must first give notice of the consequences of not cooperating. Documents held abroad are covered, premises abroad are not	Sch 1 para 2
Enforcement notices	OES and RDSP failures	Extended to RMSPs and to new duties. Required steps can include steps outside the UK. Paying a penalty does not end the duty to comply	Sch 1 para 3
Penalty bands	£1m, £8.5m and £17m caps	Two caps: standard and higher, tied to turnover	21
Penalty factors	Limited	Must be "appropriate and proportionate", considering impact, remedial steps and compliance history	21 (new reg 18(5) and (6))
Daily penalties	None	None under the NIS Regulations	21
Regulator charging	Invoices for costs already incurred	Charging schemes, including for enforcement	17

What are the new penalty caps?

There are three different regimes in the Bill, and they are easy to confuse.

Regime	Who imposes it	Maximum for an undertaking	Daily rate
NIS Regulations, standard maximum (clause 21, new reg 18(8))	The sector regulator or Information Commission	Greater of £10 million and 2% of worldwide turnover	None
NIS Regulations, higher maximum (clause 21, new reg 18(9))	The sector regulator or Information Commission	Greater of £17 million and 4% of worldwide turnover	None
Part 3 security regulations (clause 33)	As set in future regulations	Regulations may not exceed the greater of £17 million and 10% of turnover	Allowed if the regulations provide for it
Part 4 national security directions (clause 54)	The enforcement authority	£17 million, or the greater of £17 million and 10% of turnover once turnover regulations under cl 54(5) are in force. £10 million for information and inspection failures	Up to £100,000 a day (directions) or £50,000 a day (information and inspection)

The higher NIS band covers the core duties: security measures, incident notification and the 24-hour and 72-hour content requirements, customer notification, directions, inspections, information notices and enforcement notices. The standard band covers lesser duties such as notifying the regulator under regulation 8(2), sending copies to the CSIRT and further disclosures. For non-undertakings, such as some public bodies, the caps are £10 million and £17 million. See fines and penalties for worked examples.

Our analysis. The clause 33 figure is a ceiling on future regulations, not a fine anyone can face today. The clause 54 10% figure depends on turnover regulations that have not been made. The Bill sets daily rates on its face only in Part 4; Part 3 regulations may also use a daily rate (clause 33(2)), and the NIS Regulations regime has none. None of these changes the willingness to use them, which was the problem the 2022 review identified.

Does the Bill make anyone check whether regulators enforce?

Partly. There is no duty to publish enforcement statistics, but four mechanisms create some visibility.

Mechanism	What it requires	Clause	When
Statement of strategic priorities	Regulators must "have regard to" it and "seek to achieve" its objectives	25 to 27	Chapter 2 of Part 3 starts two months after Royal Assent. The Minister said she expects designation "within a year of commencement" (HL Deb 26 October 2026, cc952 to 953)
Annual report on regulators	The Secretary of State reports how regulators have complied with the statement	28	Each 12 months after the first statement
Three-yearly report	Reviews the operation of the NIS Regulations and Parts 3 and 4	41	At least every three years from Royal Assent
Lords regime review	Reviews the effectiveness of the Act and the NIS Regulations, including "the institutional framework" and whether it "is the optimum framework"	66	Within 12 months of Royal Assent, then at most yearly

Clause 66 was added against the Government's wishes on 26 October 2026, by 202 votes to 155. The Commons may remove it. On the HL Bill 62 text it sits in Part 4, so it is also commenced by regulations, even though its deadline runs from Royal Assent. See which sectors could be added for the scope half of that review.

Charging regulators must also publish what they collect and spend (new reg 20B), which will be the first routine public data on regulator resourcing.

Will it be enforced? Our assessment

Our analysis. We think enforcement will rise from a very low base, for three reasons and with one big caveat.

• The tools are clearer. Two bands instead of three, defined penalty factors and a higher band that explicitly includes information notices remove the legal uncertainty the reviews blamed.
• Information flow should improve. More reportable incidents and a 24-hour clock give regulators earlier evidence. The Impact Assessment said regulators had complained that high-profile incidents were "being reported in the press without crucial details about them being reported to the regulators".
• New regulated groups have no history. RMSPs and data centres will be supervised from scratch by the Information Commission and Ofcom, which already run penalty-based regimes in other areas.

The caveat is that the Government's stated aim is compliance rather than fines, and no target, budget or headcount for regulators has been published. A penalty under the reformed regime cannot arrive before the relevant commencement regulations, and the Government has published no in-force date.

For you, the practical risk is less a fine than an information notice, an inspection or an enforcement notice that requires specific fixes on a deadline. See regulator inspections for how those steps fit together.

What should we watch?

1. Commons consideration of Lords amendments. Whether clause 66 survives decides whether there is a statutory annual check on the regulator model.
2. Commencement regulations. Clause 21 penalties and clause 17 charging start only when these are made. Track them on the secondary legislation tracker.
3. Charging scheme consultations. Each regulator that wants to charge must consult first. This will show who is serious about resourcing.
4. The first statement of strategic priorities. Look for enforcement objectives, not just guidance objectives.
5. Turnover regulations under clause 54(5). Until these exist, the Part 4 cap stays at £17 million.
6. The first published penalty notice. Under the reformed regime, that is the real test. Until it happens, treat claims about "tough enforcement" with caution.

Sources

• HL Bill 62, as amended on Report: clauses 17, 20, 21, 24 to 28, 33, 41, 54, 66, 69 and Schedule 1
• Network and Information Systems Regulations 2018, regulation 3, regulation 18, regulation 21 and Schedule 1
• DCMS: Review of the Network and Information Systems Regulations (first post-implementation review), 29 May 2020
• DCMS: Second Post-Implementation Review of the NIS Regulations 2018, 4 July 2022
• DSIT: Cyber Security and Resilience Bill Impact Assessment, 12 November 2025 (see p7 on incidents and p63 on fines)
• GOV.UK factsheet: Summary of the Bill
• GOV.UK factsheet: Enforcement
• GOV.UK factsheet: Cost recovery
• ICO: Advanced Computer Software Group enforcement action and penalty notice, 26 March 2025
• Hansard: Commons Second Reading, 6 January 2026 (Ian Murray and Sir Julian Lewis, c177)
• Hansard: Lords Second Reading, 14 July 2026 (Baroness Lloyd of Effra, c565)
• Hansard: Lords Report, 26 October 2026 (Lord Birt, c1001; Baroness Lloyd of Effra, cc952 to 953 and c1004), read through the TheyWorkForYou mirror
• UK Parliament: Lords division 3730 on Amendment 163