Part 3: Security and resilience of systems: functions of the Secretary of State.

A "network and information system" is an electronic communications network (Communications Act 2003, section 32(1)) or apparatus programmed to process digital data, including data stored or transmitted for its operation, use, protection or maintenance (clause 24(1) and (2)).

An "essential activity" is one specified in regulations by the Secretary of State, who may only specify an activity considered essential to the economy, or to the day-to-day functioning of society, in the UK or any part of it (clause 24(3) and (4)). Every essential service in Schedule 2 to the NIS Regulations, and every relevant digital service and managed service, is treated as already specified (clause 24(5)).

A "regulatory authority" is a person exercising public functions in the UK designated by regulations; the existing NIS competent authorities and the Information Commission are treated as designated (clause 24(6) to (8)).

The Secretary of State may designate a statement setting out the Government's strategic priorities for the security and resilience of network and information systems used for essential activities, the roles and responsibilities of regulators and others, and objectives for regulators (clause 25(1) and (2)). It must be published.

It cannot be amended, and its designation cannot be withdrawn, within three years of the last designation, unless there has been a general election or the Secretary of State considers there has been a significant change in Government policy or in the nature of threats (clause 25(6) and (7)).

The Secretary of State must consult the regulators on a draft, allowing at least 40 days, make any appropriate changes, then lay the statement before Parliament. It cannot be designated until a 40-day period has passed, and cannot be designated if either House resolves within that period not to approve it (clause 26(2) to (6)). Consultation carried out before the clause comes into force counts (clause 26(8)).

While a statement is designated, each regulator must have regard to it and seek to achieve any relevant objectives in it when exercising functions under the NIS Regulations, Part 3 or Part 4.

After each 12-month reporting period (starting when the first statement is published), the Secretary of State must lay before Parliament and publish a report on how regulators have complied, and plan to comply, with clause 27. The Secretary of State may require regulators to supply information for it.

The Secretary of State may make regulations for identifying, managing and reducing risks of security or operational compromises to "relevant" network and information systems, and for mitigating their impact, including strengthening the resilience of those systems and the security of their physical environment (clause 29(1) and (2)).

A system is relevant if it is used for an essential activity or for an "activity-critical supply" (a supply of goods or services without which an essential activity would be at risk of disruption), or is associated with such a system (clause 29(3), (4) and (6)). A "security or operational compromise" covers anything that compromises security, availability, functionality or reliability, unauthorised access or interference, compromise of data, or loss of data (clause 29(5)).

Regulations under clause 29 may impose requirements on regulated persons, meaning persons specified (or of a description specified) who carry on an essential activity in the UK or provide an activity-critical supply, whether or not established in the UK (clause 30(1) to (3)). Specification can turn on designation by a regulator (clause 30(4)).

OES, RDSPs, RMSPs and critical suppliers (all as defined in the NIS Regulations) are treated as specified (clause 30(5)).

Requirements may include taking specified action (including outside the UK), prohibitions or restrictions, reporting, providing information, and appointing a UK representative (clause 30(6)).

Regulations may give regulators functions for monitoring, investigating, securing compliance with and mitigating non-compliance with requirements under clause 29 regulations or the NIS Regulations (clause 31(1) and (2)). These may include appointing inspectors; entry, inspection and search; seizing documents; requiring information to be obtained or retained (including outside the UK); tests and interviews; and requiring remedial steps (clause 31(3)), subject to conditions such as producing identification or obtaining a warrant (clause 31(4)).

Where regulations provide for financial penalties they must provide for appeals to a court or tribunal (clause 31(6)(a)).

Regulations under clause 29 may confer functions on the Secretary of State where a security or operational compromise of a relevant system is or may be attributable to loss of oversight or control of an "AI agent", or there is a risk of that (clause 32(1)).

"AI agent" and "loss of oversight or control" are to be defined by regulations (clause 32(2)). Functions may include imposing requirements on regulated persons in connection with identifying and investigating such compromises, preserving and analysing information, assessing causes and risks, and testing and sharing remedies (clause 32(5)), with inspector, entry, seizure, testing and direction powers (clause 32(6)) and sanctions including financial penalties (clause 32(9)).

Regulations providing for penalties may set the amount or how it is worked out, including a daily rate, and must say how sums received are dealt with (clause 33(1) and (2)).

They must include a maximum: for an undertaking, no more than the greater of £17,000,000 and 10% of turnover (inside and outside the UK); otherwise no more than £17,000,000. They must say how turnover is determined and may treat group members or controllers as part of the undertaking (clause 33(3) and (4)). The £17m figures can be uprated for inflation (clause 33(5)).

Regulations may give regulators (and, where clause 32 is used, the Secretary of State) functions on disclosure of information (including to and from persons outside the UK), guidance, records and registers, reports, reviews, and co-operation (clause 34(1) and (2)). Disclosures under the regulations need not breach confidence, but nothing may authorise a disclosure prohibited by the Investigatory Powers Act 2016 (clause 34(4) and (5)). Regulations may also give functions to other public bodies, such as monitoring incidents and promoting best practice (clause 34(6) and (7)).

Regulations may allow regulators to charge current or former regulated persons for costs of functions under Part 3, Part 4 or the NIS Regulations, including enforcement, through charging schemes covering amounts, exemptions, payment, interest and disputes. A charge need not relate to functions exercised in relation to the payer, and may take previous deficits into account.

Regulations under clause 29 may confer discretionary functions, provide for delegation, require regard to guidance or a code of practice, and refer to documents as amended from time to time. Clause 36(2) collects the Chapter 3 definitions.

The Secretary of State may issue, revise and reissue a code of practice describing measures recommended for complying with requirements under clause 29 regulations or the NIS Regulations, after consulting such persons as the Secretary of State considers appropriate. It may make different provision for different kinds of regulated person.

A draft code must be laid before Parliament. If either House resolves not to approve it within 40 days, it cannot be issued in that form; otherwise it can be issued, and comes into force on publication unless it says otherwise.

Failing to follow the code is not of itself evidence of a failure to comply with a requirement, and does not of itself create liability (clause 39(1)). The code is admissible in evidence, and courts, tribunals and regulators must take relevant provisions into account when deciding compliance questions about the period when they were in force (clause 39(2) to (4)).

Withdrawal requires consultation and a notice laid before Parliament, and takes effect at the end of 40 days unless the notice specifies otherwise.

At least once every three years from Royal Assent, the Secretary of State must lay before Parliament and publish a report on the operation of the NIS Regulations, Parts 3 and 4 and regulations under Part 3. It must set out their objectives, assess whether they have been achieved and remain appropriate, consider less onerous alternatives, and review use of the Secretary of State's powers.

Regulations under clause 24 or Chapter 3 may make different provision for different purposes or areas, apply to the Crown and to UK waters (internal waters, territorial sea and designated continental shelf areas), and make consequential provision, including amending or repealing primary legislation (Acts, Acts of the Scottish Parliament, Senedd legislation and Northern Ireland legislation).

The Secretary of State must consult before making regulations on essential activities, regulatory authorities, the meaning of "AI agent" and "loss of oversight or control", extra matters for the clause 41 report, and most substantive clause 29 regulations (requirements, regulator functions, appeals, penalty caps, information sharing, cost recovery). Earlier consultation counts (clause 43(1) to (3)).

Regulations needing consultation, or amending primary legislation, must be approved in draft by both Houses; other regulations under Part 3 are subject to annulment by either House (clause 43(5) and (6)).