The Cyber Security and Resilience Bill (CSRB), clause by clause.

The Cyber Security and Resilience (Network and Information Systems) Bill would amend the NIS Regulations 2018 to bring data centres, managed service providers, large load controllers and critical suppliers into scope, tighten incident reporting to 24 and 72 hours, and give ministers new regulation-making and national security powers. It has 70 clauses in five Parts. Each is explained below, with a link to the official text.

Find a clause Official text (PDF)

HL Bill 62, as amended on Report70 clauses, 2 SchedulesChecked 9 November 2026

Last updated 9 November 2026Status: not yet law. The Commons considers the Lords amendments on 24 November 2026.Sources: UK Parliament · HL Bill 62 · NIS Regulations 2018

The print we usedHL Bill 62

Print: HL Bill 62 (as amended on Report)
Printed: 26 October 2026
Structure: 5 Parts, 70 clauses, 2 Schedules
Stage: Commons consideration of Lords amendments
Status: Not law: no Royal Assent
Checked: 9 November 2026

Clause numbers can change before Royal Assent if the Commons changes the Lords amendments.

Where this stands

This is a Bill, not law. It has not received Royal Assent, so every duty described here is proposed. Lords stages complete (Third Reading 2 November 2026). The Commons has not yet considered the Lords amendments.

Clause numbers, subsections and page numbers refer to HL Bill 62 (as amended on Report, printed 26 October 2026), checked against the Parliament Bills API on 9 November 2026. Numbers can change if the Commons amends or rejects Lords amendments.

The five Parts

Part 1 · Clauses 1 to 2Introduction

Part 1 defines "the NIS Regulations" as the Network and Information Systems Regulations 2018 and gives a map of the rest of the Bill: Part 2 amends those Regulations, Part 3 gives the Secretary of State new powers, and Part 4 covers national security directions.

Part 2 · Clauses 3 to 23The NIS Regulations

Part 2 would amend the NIS Regulations 2018. It brings data centres, large load controllers and managed service providers into scope, lets regulators designate critical suppliers, replaces incident reporting with a 24-hour initial and 72-hour full notification, adds customer notification, and rewrites cost recovery, information powers and penalties.

Part 3 · Clauses 24 to 43Secretary of State powers

Part 3 would let the Secretary of State specify essential activities and regulators, set strategic priorities, make regulations imposing security duties (penalties capped at the greater of £17m and 10% of turnover) and issue a code of practice, with a report on the legislation at least every three years. Most of it depends on future regulations.

Part 4 · Clauses 44 to 67National security directions

Part 4 would let the Secretary of State give binding national security directions: vendor-related directions about a supplier's goods or services, and general directions where a compromise threatens national security. Breaches could cost up to £17m (the greater of £17m and 10% of turnover once regulations exist) plus daily penalties. It adds a regime review and foreign powers register.

Part 5 · Clauses 68 to 70Extent, commencement and short title

Part 5 says the Bill would extend to the whole UK, sets out when each provision would come into force (some on Royal Assent, some two months later, the rest on dates set by regulations), and gives the short title: the Cyber Security and Resilience (Network and Information Systems) Act 2026.

Schedules 1 and 2Enforcement; minor amendments

Schedule 1 extends inspections, enforcement notices and appeals. Schedule 2 makes minor and consequential amendments. Both are explained on the Part 2 page.

Part 1 · Clauses 1 and 2Introduction

Clause 1Meaning of “the NIS Regulations”

Affects: Everyone reading the BillOfficial text: HL Bill 62, PDF page 7 bills.parliament.uk #clause-1

What the Bill says

Throughout the Bill, "the NIS Regulations" means the Network and Information Systems Regulations 2018 (S.I. 2018/506).

What this means in practice (our interpretation)

Most of the duties people associate with the Bill are not free-standing: they are amendments to the 2018 Regulations. That is why many provisions are cited as a regulation number (for example regulation 14E) as well as a clause number.

Clause 2Overview of Act

Affects: Everyone reading the BillOfficial text: HL Bill 62, PDF page 7 bills.parliament.uk #clause-2

What the Bill says

Clause 2(1) and (2): Part 2 amends the NIS Regulations, including amendments that would:

extend the Regulations to data centres, load control services and managed services;
provide for the designation of critical suppliers;
change the reporting of incidents;
cover cost recovery, sharing and gathering of information, and enforcement.

Clause 2(3) and (4): Part 3 gives the Secretary of State powers to specify regulated activities and designate regulators (Chapter 1), designate a statement of strategic priorities (Chapter 2), make regulations on the security and resilience of network and information systems (Chapter 3) and issue a code of practice (Chapter 4). Chapter 5 requires a report on the legislation.

Clause 2(5): Part 4 gives the Secretary of State powers to give directions where there is a risk to national security.

What this means in practice (our interpretation)

Clause 2 is a signpost with no legal effect of its own. It is useful as a quick map: Part 2 changes the rules that apply on day one of commencement, while Part 3 is mostly enabling powers whose detail will come later in regulations.

History. A Government amendment agreed at Lords Third Reading on 2 November 2026 (HL Bill 62–I, amendment 1; not in the HL Bill 62 print) changes "persons providing data centres" in clause 2(2)(a) to "persons providing data centre services". It is a drafting change.

All 70 clauses

Click a clause number to go to its section. Headings are as printed in HL Bill 62; the other columns are our summaries.

Part 1: Introduction (Clauses 1 to 2)

Clause	Heading	What it does	Who it affects
1	Meaning of “the NIS Regulations”	Defines "the NIS Regulations" as the Network and Information Systems Regulations 2018 (S.I. 2018/506).	Everyone reading the Bill
2	Overview of Act	Summarises what each Part of the Bill does.	Everyone reading the Bill

Part 2: The NIS Regulations (Clauses 3 to 23)

Clause	Heading	What it does	Who it affects
3	Identification of operators of essential services	Applies OES identification to operators outside the UK and excludes public telecoms networks and services.	Operators of essential services (OES), including non-UK operators
4	Data centres to be regulated as essential services	Adds a data infrastructure subsector regulated by Ofcom, with 1 MW and 10 MW (enterprise) thresholds.	Data centre operators at or above the thresholds
5	Operators of data centre services: Crown application etc	Applies the data centre rules to the Crown, with exceptions for the intelligence agencies and secret/top secret work.	Government and Crown data centres; commercial providers hosting classified material
6	Designation of large load controllers as operators of an essential service	Makes load control an essential service where a controller has 300 MW or more of potential electrical control.	Load controllers of EVs, charge points, heat pumps, batteries and virtual power plants
7	Digital services	Redefines cloud computing and creates "relevant digital service providers" (RDSPs).	Cloud providers, online marketplaces and online search engines (not micro or small)
8	Duties of relevant digital service providers	Updates RDSP security duties and requires regard to Information Commission guidance.	RDSPs
9	Managed service providers	Defines "managed service" and "relevant managed service provider" (RMSP), regulated by the Information Commission.	Managed service providers (not micro or small), including non-UK providers
10	Duties of managed service providers to manage risks	Requires RMSPs to take appropriate and proportionate security measures (new regulation 14B).	RMSPs
11	Digital or managed service providers: meaning of “subject to public authority oversight”	Defines when a digital or managed service provider counts as under public authority oversight.	Public bodies and publicly controlled companies that provide digital or managed services
12	Critical suppliers	Lets regulators designate critical suppliers to OES, RDSPs and RMSPs (new regulations 14H to 14L).	Suppliers to regulated organisations, of any size and wherever established
13	Provision of information by operators of data centre services	Requires in-scope data centre operators to give their regulator contact and ownership details within 3 months.	Data centre operators that are OES
14	Provision of information by providers of digital or managed services etc	Registration with the Information Commission for RDSPs and RMSPs, 7-day change notices and UK representatives.	RDSPs and RMSPs, including those based outside the UK
15	Reporting of incidents by regulated persons	Replaces incident reporting: initial notification within 24 hours, full notification within 72 hours, copied to the CSIRT.	OES (including data centres), RDSPs and RMSPs
16	Notification of incidents to customers	After a full notification, data centres, RDSPs and RMSPs must notify UK customers likely to be adversely affected.	Data centre OES, RDSPs and RMSPs, and their UK customers
17	Powers to impose charges	Lets regulators recover their costs through published charging schemes and invoiced charges.	All persons regulated by a NIS enforcement authority
18	Sharing and use of information under the NIS Regulations etc	Replaces the information-sharing rules, including sharing with GCHQ, law enforcement and listed overseas authorities.	Regulators; indirectly every regulated person whose information they hold
19	Guidance	Sets what regulators' guidance must cover and requires consistency with the code of practice and Government guidance.	Regulators; regulated persons who rely on their guidance
20	Powers to require information	Replaces regulation 15 with information notices that can reach regulated and unregulated persons.	Regulated persons and anyone likely to hold relevant information
21	Financial penalties	Two penalty caps: greater of £10m and 2% of turnover, or greater of £17m and 4%, by type of failure.	OES, RDSPs, RMSPs and anyone given an information or enforcement notice
22	Enforcement and appeals	Introduces Schedule 1 (inspections, enforcement notices, appeals and civil proceedings).	OES, RDSPs, RMSPs, critical suppliers and recipients of information notices
23	Minor and consequential amendments etc	Introduces Schedule 2 (minor and consequential amendments).	Mainly drafting; see Schedule 2

Part 3: Security and resilience of systems: functions of the Secretary of State (Clauses 24 to 43)

Clause	Heading	What it does	Who it affects
24	Key definitions in Part 3	Defines "network and information system", "essential activity" and "regulatory authority" for Part 3.	Anyone carrying on, or supplying, an essential activity
25	Statement of strategic priorities etc	Lets the Secretary of State designate a statement of Government priorities and objectives for regulators.	Regulators; indirectly all regulated persons
26	Consultation and procedure in relation to statement	Requires consultation with regulators and a 40-day period in Parliament before a statement is designated.	Regulators; Parliament
27	Duties of regulatory authorities in relation to statement	Regulators must have regard to the statement and seek to achieve its objectives.	Regulators
28	Report by Secretary of State	Annual report to Parliament on how regulators are meeting their duties under clause 27.	Regulators; Parliament
29	Regulations relating to security and resilience of network and information systems	The main power to make regulations on managing and reducing risks to systems used for essential activities.	Organisations carrying on essential activities and their activity-critical suppliers
30	Imposition of requirements on regulated persons	Regulations may impose requirements on "regulated persons", including OES, RDSPs, RMSPs and critical suppliers.	OES, RDSPs, RMSPs, critical suppliers and anyone else specified
31	Functions of regulatory authorities: enforcement, sanctions and appeals	Regulations may give regulators monitoring, investigation, inspection and sanction powers, with appeals.	Regulated persons; regulators
32	Functions of the Secretary of State: loss of control of artificial intelligence agent	Regulations may give the Secretary of State powers where a compromise is or may be attributable to loss of control of an AI agent.	Regulated persons whose systems involve AI agents
33	Provision about financial penalties	Caps penalties in Part 3 regulations at the greater of £17m and 10% of worldwide turnover.	Regulated persons under clause 29 regulations
34	Regulatory authorities, the Secretary of State and other persons: information, guidance and other functions	Regulations may cover information sharing, guidance, registers, reports, reviews and co-operation.	Regulators and public bodies such as the NCSC
35	Recovery of costs of regulatory authorities	Regulations may let regulators charge regulated persons for their costs under Parts 3 and 4 and the NIS Regulations.	Regulated persons
36	Supplementary provision and interpretation	Lets regulations confer discretions, delegate functions and refer to guidance or codes; defines Chapter 3 terms.	Drafting provision
37	Code of practice	Lets the Secretary of State issue a code of practice of recommended measures for compliance.	Regulated persons
38	Procedure for issue of code of practice	A draft code is laid before Parliament for 40 days and can be blocked by either House.	Parliament; regulated persons
39	Effects of code of practice	Not following the code is not of itself a breach, but courts and regulators must take it into account.	Regulated persons; courts; regulators
40	Withdrawal of code of practice	The Secretary of State may withdraw the code after consultation and notice to Parliament.	Regulated persons
41	Report on network and information systems legislation	A report to Parliament on the NIS legislation at least once every three years.	Parliament; regulators
42	Regulations under section 24 or Chapter 3	Regulations may differ by purpose or area, apply to the Crown and UK waters, and amend primary legislation.	Drafting provision
43	Consultation and procedure	Requires consultation and affirmative approval for the main Part 3 regulations.	Parliament; anyone consulted on regulations

Part 4: Directions for national security purposes (Clauses 44 to 67)

Clause	Heading	What it does	Who it affects
44	Vendor-related directions	Directions to deal with a national security risk from using another person's goods, services or facilities.	Persons specified in affirmative regulations (regulated persons, Part 4 essential activities, essential suppliers)
45	Further provision about giving of vendor-related directions	Content of a vendor-related direction, duty to comply, skilled-person approval, consultation and secrecy.	Recipients of vendor-related directions and the vendors concerned
46	Power to make regulations about time frame for giving vendor-related directions	Regulations may set deadlines for deciding whether to give a vendor-related direction.	Persons who refer, or may be subject to, vendor-related directions
47	Power to establish mandatory referral scheme	Regulations may require specified persons to refer qualifying transactions to the Secretary of State.	Persons specified under clause 44 entering into qualifying transactions
48	General directions	Directions where a compromise, or threat of one, to a Part 4 system gives rise to a national security risk.	Regulated persons and other persons specified in affirmative regulations
49	Compliance with directions under section 44 or 48 to take priority	Where a direction conflicts with another regulatory requirement, the direction takes priority once notified.	Recipients of directions; their other regulators
50	Monitoring by regulatory authorities	The Secretary of State may direct a regulator to gather information and report on compliance with a direction.	Regulators; recipients of directions
51	Information gathering	Information notices for Part 4 purposes from the Secretary of State or a monitoring regulator.	Any person (Secretary of State); regulated persons (regulators)
52	Inspections	Inspections to verify compliance with directions, which the inspected person may have to pay for.	Recipients of directions and confirmation decisions
53	Notification of contravention	The first enforcement step: a notification setting out the contravention, steps required and proposed penalty.	Recipients of directions, information notices and inspection requirements
54	Penalty amounts	Up to £17m for breaching a direction (greater of £17m and 10% once regulations are made), plus daily penalties.	Recipients of directions and Part 4 information or inspection requirements
55	Enforcement of notification	After representations, a confirmation decision can require action and payment, enforceable in court.	Persons given a clause 53 notification
56	Enforcement of penalty	Penalties are recoverable as if payable under a county court order (or Scottish/NI equivalents).	Persons given a penalty under clause 55
57	Enforcement of non-disclosure requirements	Breaching a Part 4 secrecy requirement can lead to penalties up to £10m (£50,000 a day).	Recipients of directions and anyone consulted on them, and their staff
58	Power to direct regulatory authorities	The Secretary of State may direct regulators on their functions, for national security.	Regulators (not Ministers, devolved governments or NI departments)
59	Review, variation and revocation of directions	Directions must be reviewed from time to time and may be varied or revoked.	Recipients of directions under clauses 44, 48 and 58
60	Publication of notice of direction under section 44 etc	Notice of each vendor-related direction, variation or revocation must be published, with redactions allowed.	Recipients of vendor-related directions; vendors; the public
61	Annual report in relation to directions under section 44	An annual report to Parliament on the number and kinds of vendor-related directions.	Parliament
62	Laying before Parliament: directions under sections 48 and 58 etc	Copies of general directions, directions to regulators and variations must be laid before Parliament, with exceptions.	Parliament; recipients of directions
63	Information sharing	Part 4 information may be shared with regulators, GCHQ, UK and overseas public authorities for national security.	Anyone whose information is obtained under Part 4
64	Means of giving directions, notices etc	Directions and notices can be given by hand, post, email or via a notified UK representative.	Recipients of Part 4 directions and notices
65	Interpretation of Part 4	Defines "Part 4 essential activity", "essential goods or services" and "Part 4 NIS".	Drafting provision
66	Review of the effectiveness of the NIS regime	A review within 12 months of Royal Assent of the regime and whether to add sectors, then annual reviews. It sits in Part 4, so on the HL Bill 62 text it commences only by regulations.	Government; potentially sectors not currently in scope
67	Register of foreign powers for the purposes of Part 4	A register of foreign powers posing a risk to UK critical systems, within six months of Royal Assent. It sits in Part 4, so on the HL Bill 62 text it commences only by regulations.	Government; indirectly OES and critical suppliers using vendors linked to listed states

Part 5: General (Clauses 68 to 70)

Clause	Heading	What it does	Who it affects
68	Extent	The Act would extend to England and Wales, Scotland and Northern Ireland.	Organisations across the whole UK
69	Commencement	Sets which provisions start on Royal Assent, which two months later, and which on dates set by regulations.	Everyone preparing for the Bill's duties
70	Short title	The Act would be cited as the Cyber Security and Resilience (Network and Information Systems) Act 2026.	Everyone citing the legislation

Changes agreed at Lords Third Reading

HL Bill 62 is the last full reprint. The Lords agreed four Government drafting amendments at Third Reading on 2 November 2026 (HL Bill 62–I). None changes a clause number or the substance of a duty:

Clause 2: "persons providing data centres" becomes "persons providing data centre services".
Clause 24: the pointer to the meaning of "regulated person" now reads "section 30(2) and (5)" (Bill wording), pointing to clause 30(5) as well.
Clause 36: the definition of "regulated person" now adds "(and see also section 30(5))".
Clause 42: after "section 30(2)" now adds "(and see also section 30(5))".

How to read this explorer

Each clause has two parts. What the Bill says is a close paraphrase of the clause text, with subsection references so you can check it. What this means in practice is our interpretation, and is labelled as such. Where the text leaves something to future regulations, or does not answer a question, we say so rather than guess.

Many clauses work by inserting new regulations into the NIS Regulations 2018, so a provision often has two references: the Bill clause (for example clause 15) and the regulation it would create (for example regulation 14E). Regulation numbers did not change when the Lords renumbered the clauses.

Links marked "Official text" open HL Bill 62 at the page where the clause starts. The PDF is a byte-identical copy of the print published by Parliament. If you need the older numbering, see the section-by-section guide, which maps HL Bill 32 numbers to HL Bill 62. For what changed in Parliament, see what Parliament has changed; for the plain PDF, see read the Bill.

Sources: HL Bill 62 (26 October 2026); the Third Reading marshalled list (HL Bill 62–I, 30 October 2026); the Explanatory Notes to HL Bill 32 (17 June 2026), which use the earlier numbering; and the stage history on the Parliament Bill page.

Questions

HL Bill 62, the print as amended on Report in the House of Lords (26 October 2026), has 70 clauses in five Parts and two Schedules. The version brought from the Commons (HL Bill 32) had 61; the Lords added clauses on AI agents, vendor-related directions, a review of the regime and a register of foreign powers.

Clause 15. It would replace regulation 11 of the NIS Regulations and add regulations 11A, 12A and 14E, requiring an initial notification within 24 hours and a full notification within 72 hours of first becoming aware of a notifiable incident, copied to the CSIRT. Clause 16 adds customer notification for data centres, digital and managed service providers.

Clause 21 sets the NIS Regulations caps: the greater of £10m and 2% of worldwide turnover (standard maximum) or the greater of £17m and 4% (higher maximum). Clause 33 caps penalties in future Part 3 regulations at the greater of £17m and 10%. Clause 54 sets Part 4 penalties for breaching a direction: up to £17m (the greater of £17m and 10% of turnover once regulations under clause 54(5) are made), plus up to £100,000 a day.

Clause 69 sets commencement. Part 1, Chapters 1, 3 and 6 of Part 3, clause 41 and Part 5 would start on Royal Assent; clause 18(3) and (4), Chapter 2 of Part 3 and Schedule 2 paragraphs 3, 4 and 15 two months later; everything else, including the main Part 2 duties, on days set by regulations. No dates have been set. One caveat: clauses 66 (review of the NIS regime) and 67 (register of foreign powers) sit in Part 4, so on the HL Bill 62 text they commence only by regulations, even though their own deadlines run from Royal Assent.

No. As of 9 November 2026 the Lords have completed their stages and the Commons has still to consider the Lords amendments. The duties described on this site are proposals until Royal Assent and commencement.

A Bill is drafted as the Act it will become, so its text refers to "sections". While it is a Bill, Parliament calls them clauses. This explorer uses "clause"; the numbers are the same.

Keep reading

The Bill, Part by Part.

Part 2The NIS RegulationsClauses 3 to 23 Part 3Secretary of State powersClauses 24 to 43 Part 4National security directionsClauses 44 to 67 Part 5Extent, commencement and short titleClauses 68 to 70

Get ready

Know where you stand before the duties land.

Take the free readiness assessment to see how your organisation measures up against the Cyber Security and Resilience Bill, or talk to our team about a plan.

Take the readiness assessment Talk to Precursor