# UK Cyber Security and Resilience Bill vs EU NIS2 — Cyber Security and Resilience Bill

> Detailed comparison of the UK Cyber Security and Resilience Bill (HL Bill 62) and the EU NIS2 Directive. Explains why they are separate compliance regimes with different jurisdictions, targeted sectors, penalties, and reporting requirements.

Canonical page: https://cybersecurityandresiliencebill.com/nis2-vs-csrb

## UK Cyber Security and Resilience Bill vs. EU NIS2

They differ in jurisdiction, scope, penalties and reporting. NIS2 is an EU Directive covering 18 sectors; the Cyber Security and Resilience Bill (HL Bill 62) is a UK Bill, not yet law, that would amend the NIS Regulations 2018 to add data centres, managed service providers and critical suppliers. The Bill's maximum is the greater of £17m and 4% of turnover; NIS2 sets a maximum of at least €10m or 2%. Both use 24-hour and 72-hour reports, and NIS2 adds a one-month final report. A firm in both markets can face both.

## The bottom line: are they the same law?

**No.** They are distinct legal frameworks.

The **[EU NIS2 Directive](https://eur-lex.europa.eu/eli/dir/2022/2555/oj)** (Directive (EU) 2022/2555) applies to EU member states. The **UK Cyber Security and Resilience Bill (CSRB, [HL Bill 62](https://bills.parliament.uk/publications/68323/documents/8980))** would apply to the United Kingdom; it is not yet law. Although both evolve from the original NIS Directive (2016), NIS2 widened scope across 18 sectors, including data centre service providers and managed (security) service providers. The UK has taken a narrower route: it keeps the [NIS Regulations 2018](https://www.legislation.gov.uk/uksi/2018/506/contents) and would amend them to add data centres, [relevant managed service providers](https://cybersecurityandresiliencebill.com/glossary/relevant-managed-service-provider) and large load controllers, plus a power to designate critical suppliers.

For what the Bill changes in the UK rules, see [the NIS Regulations vs the Bill](https://cybersecurityandresiliencebill.com/guides/nis-regulations-vs-the-bill); for who would enforce it, see [which regulator covers you](https://cybersecurityandresiliencebill.com/guides/which-regulator-covers-you). Read the Bill itself in our [clause-by-clause guide](https://cybersecurityandresiliencebill.com/the-bill), or see the glossary entry for [NIS2](https://cybersecurityandresiliencebill.com/glossary/nis2).

## Regulatory comparison matrix

How the two regimes differ across the dimensions that matter for compliance.

| Feature | UK Cyber Security and Resilience Bill (HL Bill 62) | EU NIS2 Directive |
| --- | --- | --- |
| Jurisdiction | United Kingdom only | 27 EU member states |
| Key targeted sectors | **MSPs, data centres**, essential services (water, energy, transport, health, digital). | 18 sectors (energy, transport, banking, space, waste water, food, etc.), including data centre providers and managed (security) service providers |
| Maximum penalty | **the greater of £17m and 4% global turnover** (clause 21; today's NIS maximum is £17m) | At least €10M or 2% global turnover, whichever is higher (essential entities; Art. 34(4) sets the minimum maximum) |
| Incident reporting | 24h initial · 72h full. **Actual adverse effect required** | 24h early warning · 72h incident notification |
| Supply chain | Power to designate "critical suppliers" (clause 12, new reg 14H), with requirements set by future clause 29 regulations; MSPs regulated directly. | Entities must manage the security of their own supply chains. |
| Cost recovery | **Yes** — regulators can charge every entity they regulate under a charging scheme, plus one-off charges (regs 20A and 20C). | Varies by member-state implementation. |

## Frequently asked questions

### Does complying with EU NIS2 make me compliant with the UK Cyber Security and Resilience Bill?

No. While they share principles, they are separate legal regimes with different regulators (the Information Commission (formerly the ICO), Ofcom and sector regulators vs EU competent authorities), different reporting thresholds, and distinct scope definitions (especially for MSPs and Data Centres).

### What is the biggest difference between CSRB and NIS2?

The "Scope of Regulation" is the primary differentiator. NIS2 covers 18 fixed sectors. NIS2 already covers data centre service providers and managed (security) service providers. The UK Cyber Security and Resilience Bill adds those two groups to a narrower list of sectors by amending the NIS Regulations 2018, and excludes micro and small enterprises from the managed and digital service categories. A small firm can still be caught if a regulator designates it as a critical supplier.

## Mapping compliance across both regimes

Many international organisations must comply with both regimes. Precursor Security's gap-analysis service identifies overlapping requirements to save duplication of effort — a multi-jurisdiction assessment is available at https://cybersecurityandresiliencebill.com/assessment.