UK Cyber Security and Resilience Bill vs. EU NIS2.
They differ in jurisdiction, scope, penalties and reporting. NIS2 is an EU Directive covering 18 sectors; the Cyber Security and Resilience Bill (HL Bill 62) is a UK Bill, not yet law, that would amend the NIS Regulations 2018 to add data centres, managed service providers and critical suppliers. The Bill's maximum is the greater of £17m and 4% of turnover; NIS2 sets a maximum of at least €10m or 2%. Both use 24-hour and 72-hour reports, and NIS2 adds a one-month final report. A firm in both markets can face both.
Last updated Status: not yet law. The Commons considers the Lords amendments on 24 November 2026.Sources: UK Parliament · HL Bill 62 · NIS Regulations 2018- UK
- CSRB (HL Bill 62)
- EU
- NIS2 Directive
- Shared root
- NIS Directive (2016)
Are they the same law? No.
They are distinct legal frameworks. The EU NIS2 Directive (Directive (EU) 2022/2555) applies to EU member states. The UK Cyber Security and Resilience Bill (CSRB, HL Bill 62) would apply to the United Kingdom; it is not yet law. Although both evolve from the original NIS Directive (2016), NIS2 widened scope across 18 sectors, including data centre service providers and managed (security) service providers. The UK has taken a narrower route: it keeps the NIS Regulations 2018 and would amend them to add data centres, relevant managed service providers and large load controllers, plus a power to designate critical suppliers.
For what the Bill changes in the UK rules, see the NIS Regulations vs the Bill; for who would enforce it, see which regulator covers you. Read the Bill itself in our clause-by-clause guide, or see the glossary entry for NIS2.
A UK company can still have NIS2 duties if it operates or provides services in the EU. See does NIS2 apply to UK companies? for the three routes, and CRA vs DORA vs NIS2 for the wider EU picture.
Regulatory comparison matrix across the dimensions that matter.
How the two regimes differ across the dimensions that matter for compliance.
| Feature | UK Cyber Security and Resilience Bill (HL Bill 62) | EU NIS2 Directive |
|---|---|---|
| Jurisdiction | United Kingdom only | 27 EU member states |
| Key targeted sectors | MSPs, data centres, essential services (water, energy, transport, health, digital). | 18 sectors (energy, transport, banking, space, waste water, food, etc.), including data centre providers and managed (security) service providers |
| Maximum penalty | the greater of £17m and 4% global turnover (clause 21; today's NIS maximum is £17m) | At least €10M or 2% global turnover, whichever is higher (essential entities; Art. 34(4) sets the minimum maximum) |
| Incident reporting | 24h initial · 72h full Actual adverse effect required | 24h early warning · 72h incident notification |
| Supply chain | Power to designate "critical suppliers" (clause 12, new reg 14H), with requirements set by future clause 29 regulations; MSPs regulated directly. | Entities must manage the security of their own supply chains. |
| Cost recovery | Yes - regulators can charge every entity they regulate under a charging scheme, plus one-off charges (regs 20A and 20C). | Varies by member-state implementation. |
Common questions
No. While they share principles, they are separate legal regimes with different regulators (the Information Commission (formerly the ICO), Ofcom and sector regulators vs EU competent authorities), different reporting thresholds, and distinct scope definitions (especially for MSPs and Data Centres).
The 'Scope of Regulation' is the primary differentiator. NIS2 covers 18 fixed sectors. NIS2 already covers data centre service providers and managed (security) service providers. The UK Cyber Security and Resilience Bill adds those two groups to a narrower list of sectors by amending the NIS Regulations 2018, and excludes micro and small enterprises from the managed and digital service categories. A small firm can still be caught if a regulator designates it as a critical supplier.
Guides on this topic.
All guidesDoes NIS2 apply to UK companies?
NIS2 is an EU directive and does not apply in the UK, but UK companies operating in the EU or offering certain services there can still be caught.
Read the guideGlobal cyber incident reporting deadlines
UK, EU, US and Australian cyber incident reporting deadlines in one table, including what starts each clock and how to run a multi-country process.
Read the guideNeed to map your compliance across both regimes?
Many international organisations must comply with both. Our gap-analysis service identifies overlapping requirements to save you duplication of effort.