# Part 3 of the Cyber Security and Resilience Bill (CSRB): Security and resilience of systems: functions of the Secretary of State (Clauses 24 to 43)

> Part 3 would let the Secretary of State specify essential activities and regulators, set strategic priorities, make regulations imposing security duties (penalties capped at the greater of £17m and 10% of turnover) and issue a code of practice, with a report on the legislation at least every three years. Most of it depends on future regulations.

Canonical page: https://cybersecurityandresiliencebill.com/the-bill/part-3-secretary-of-state-powers
Last updated: 2026-11-09 · Source print: HL Bill 62, as amended on Report (26 October 2026)

## Where this stands

This is a Bill, not law. It has not received Royal Assent, so every duty described here is proposed. Lords stages complete (Third Reading 2 November 2026). The Commons has not yet considered the Lords amendments.

Clause numbers, subsections and page numbers refer to HL Bill 62 (as amended on Report, printed 26 October 2026): https://bills.parliament.uk/publications/68323/documents/8979. Checked against the Parliament Bills API on 9 November 2026. Numbers can change if the Commons amends or rejects Lords amendments.

"What the Bill says" is a close paraphrase of the clause text. "What this means in practice" is our interpretation.

## Clause table

| Clause | Heading | What it does | Who it affects |
| --- | --- | --- | --- |
| [24](https://cybersecurityandresiliencebill.com/the-bill/part-3-secretary-of-state-powers#clause-24) | Key definitions in Part 3 | Defines "network and information system", "essential activity" and "regulatory authority" for Part 3. | Anyone carrying on, or supplying, an essential activity |
| [25](https://cybersecurityandresiliencebill.com/the-bill/part-3-secretary-of-state-powers#clause-25) | Statement of strategic priorities etc | Lets the Secretary of State designate a statement of Government priorities and objectives for regulators. | Regulators; indirectly all regulated persons |
| [26](https://cybersecurityandresiliencebill.com/the-bill/part-3-secretary-of-state-powers#clause-26) | Consultation and procedure in relation to statement | Requires consultation with regulators and a 40-day period in Parliament before a statement is designated. | Regulators; Parliament |
| [27](https://cybersecurityandresiliencebill.com/the-bill/part-3-secretary-of-state-powers#clause-27) | Duties of regulatory authorities in relation to statement | Regulators must have regard to the statement and seek to achieve its objectives. | Regulators |
| [28](https://cybersecurityandresiliencebill.com/the-bill/part-3-secretary-of-state-powers#clause-28) | Report by Secretary of State | Annual report to Parliament on how regulators are meeting their duties under clause 27. | Regulators; Parliament |
| [29](https://cybersecurityandresiliencebill.com/the-bill/part-3-secretary-of-state-powers#clause-29) | Regulations relating to security and resilience of network and information systems | The main power to make regulations on managing and reducing risks to systems used for essential activities. | Organisations carrying on essential activities and their activity-critical suppliers |
| [30](https://cybersecurityandresiliencebill.com/the-bill/part-3-secretary-of-state-powers#clause-30) | Imposition of requirements on regulated persons | Regulations may impose requirements on "regulated persons", including OES, RDSPs, RMSPs and critical suppliers. | OES, RDSPs, RMSPs, critical suppliers and anyone else specified |
| [31](https://cybersecurityandresiliencebill.com/the-bill/part-3-secretary-of-state-powers#clause-31) | Functions of regulatory authorities: enforcement, sanctions and appeals | Regulations may give regulators monitoring, investigation, inspection and sanction powers, with appeals. | Regulated persons; regulators |
| [32](https://cybersecurityandresiliencebill.com/the-bill/part-3-secretary-of-state-powers#clause-32) | Functions of the Secretary of State: loss of control of artificial intelligence agent | Regulations may give the Secretary of State powers where a compromise is or may be attributable to loss of control of an AI agent. | Regulated persons whose systems involve AI agents |
| [33](https://cybersecurityandresiliencebill.com/the-bill/part-3-secretary-of-state-powers#clause-33) | Provision about financial penalties | Caps penalties in Part 3 regulations at the greater of £17m and 10% of worldwide turnover. | Regulated persons under clause 29 regulations |
| [34](https://cybersecurityandresiliencebill.com/the-bill/part-3-secretary-of-state-powers#clause-34) | Regulatory authorities, the Secretary of State and other persons: information, guidance and other functions | Regulations may cover information sharing, guidance, registers, reports, reviews and co-operation. | Regulators and public bodies such as the NCSC |
| [35](https://cybersecurityandresiliencebill.com/the-bill/part-3-secretary-of-state-powers#clause-35) | Recovery of costs of regulatory authorities | Regulations may let regulators charge regulated persons for their costs under Parts 3 and 4 and the NIS Regulations. | Regulated persons |
| [36](https://cybersecurityandresiliencebill.com/the-bill/part-3-secretary-of-state-powers#clause-36) | Supplementary provision and interpretation | Lets regulations confer discretions, delegate functions and refer to guidance or codes; defines Chapter 3 terms. | Drafting provision |
| [37](https://cybersecurityandresiliencebill.com/the-bill/part-3-secretary-of-state-powers#clause-37) | Code of practice | Lets the Secretary of State issue a code of practice of recommended measures for compliance. | Regulated persons |
| [38](https://cybersecurityandresiliencebill.com/the-bill/part-3-secretary-of-state-powers#clause-38) | Procedure for issue of code of practice | A draft code is laid before Parliament for 40 days and can be blocked by either House. | Parliament; regulated persons |
| [39](https://cybersecurityandresiliencebill.com/the-bill/part-3-secretary-of-state-powers#clause-39) | Effects of code of practice | Not following the code is not of itself a breach, but courts and regulators must take it into account. | Regulated persons; courts; regulators |
| [40](https://cybersecurityandresiliencebill.com/the-bill/part-3-secretary-of-state-powers#clause-40) | Withdrawal of code of practice | The Secretary of State may withdraw the code after consultation and notice to Parliament. | Regulated persons |
| [41](https://cybersecurityandresiliencebill.com/the-bill/part-3-secretary-of-state-powers#clause-41) | Report on network and information systems legislation | A report to Parliament on the NIS legislation at least once every three years. | Parliament; regulators |
| [42](https://cybersecurityandresiliencebill.com/the-bill/part-3-secretary-of-state-powers#clause-42) | Regulations under section 24 or Chapter 3 | Regulations may differ by purpose or area, apply to the Crown and UK waters, and amend primary legislation. | Drafting provision |
| [43](https://cybersecurityandresiliencebill.com/the-bill/part-3-secretary-of-state-powers#clause-43) | Consultation and procedure | Requires consultation and affirmative approval for the main Part 3 regulations. | Parliament; anyone consulted on regulations |

## Chapter 1: Introductory

### Clause 24: Key definitions in Part 3

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-3-secretary-of-state-powers#clause-24 · Affects: Anyone carrying on, or supplying, an essential activity · Official text: HL Bill 62, PDF page 58 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=58)

**What the Bill says**

A "network and information system" is an electronic communications network (Communications Act 2003, section 32(1)) or apparatus programmed to process digital data, including data stored or transmitted for its operation, use, protection or maintenance (clause 24(1) and (2)).

An "essential activity" is one specified in regulations by the Secretary of State, who may only specify an activity considered essential to the economy, or to the day-to-day functioning of society, in the UK or any part of it (clause 24(3) and (4)). Every essential service in Schedule 2 to the NIS Regulations, and every relevant digital service and managed service, is treated as already specified (clause 24(5)).

A "regulatory authority" is a person exercising public functions in the UK designated by regulations; the existing NIS competent authorities and the Information Commission are treated as designated (clause 24(6) to (8)).

**What this means in practice (our interpretation)**

Our reading: this is how the regime can grow without a new Act. New sectors could be brought in by regulations under clause 24(3), which require consultation and approval by both Houses (clause 43).

**History.** A Government drafting amendment agreed at Lords Third Reading on 2 November 2026 (not in the HL Bill 62 print) inserts "and (5)" after "section 30(2)" in clause 24(9), so the meaning of "regulated person" also draws on clause 30(5).

Related: [Glossary: essential activity](https://cybersecurityandresiliencebill.com/glossary/essential-activity) · [Glossary: network and information systems](https://cybersecurityandresiliencebill.com/glossary/network-and-information-systems) · [Secondary legislation tracker](https://cybersecurityandresiliencebill.com/guides/secondary-legislation-tracker)

## Chapter 2: Statement of strategic priorities etc

### Clause 25: Statement of strategic priorities etc

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-3-secretary-of-state-powers#clause-25 · Affects: Regulators; indirectly all regulated persons · Official text: HL Bill 62, PDF page 60 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=60)

**What the Bill says**

The Secretary of State may designate a statement setting out the Government's strategic priorities for the security and resilience of network and information systems used for essential activities, the roles and responsibilities of regulators and others, and objectives for regulators (clause 25(1) and (2)). It must be published.

It cannot be amended, and its designation cannot be withdrawn, within three years of the last designation, unless there has been a general election or the Secretary of State considers there has been a significant change in Government policy or in the nature of threats (clause 25(6) and (7)).

**What this means in practice (our interpretation)**

Our reading: the statement replaces the old "NIS national strategy" in regulation 2 of the NIS Regulations, which Schedule 2 removes once the first statement is designated. Expect it to shape regulators' enforcement priorities.

Related: [Statement of strategic priorities](https://cybersecurityandresiliencebill.com/guides/statement-of-strategic-priorities) · [Glossary: statement of strategic priorities](https://cybersecurityandresiliencebill.com/glossary/statement-of-strategic-priorities)

### Clause 26: Consultation and procedure in relation to statement

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-3-secretary-of-state-powers#clause-26 · Affects: Regulators; Parliament · Official text: HL Bill 62, PDF page 61 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=61)

**What the Bill says**

The Secretary of State must consult the regulators on a draft, allowing at least 40 days, make any appropriate changes, then lay the statement before Parliament. It cannot be designated until a 40-day period has passed, and cannot be designated if either House resolves within that period not to approve it (clause 26(2) to (6)). Consultation carried out before the clause comes into force counts (clause 26(8)).

**What this means in practice (our interpretation)**

Our reading: this is a negative procedure. Parliament does not have to vote to approve the statement; it can only block it.

### Clause 27: Duties of regulatory authorities in relation to statement

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-3-secretary-of-state-powers#clause-27 · Affects: Regulators · Official text: HL Bill 62, PDF page 61 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=61)

**What the Bill says**

While a statement is designated, each regulator must have regard to it and seek to achieve any relevant objectives in it when exercising functions under the NIS Regulations, Part 3 or Part 4.

### Clause 28: Report by Secretary of State

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-3-secretary-of-state-powers#clause-28 · Affects: Regulators; Parliament · Official text: HL Bill 62, PDF page 61 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=61)

**What the Bill says**

After each 12-month reporting period (starting when the first statement is published), the Secretary of State must lay before Parliament and publish a report on how regulators have complied, and plan to comply, with clause 27. The Secretary of State may require regulators to supply information for it.

## Chapter 3: Regulations about security and resilience of systems

### Clause 29: Regulations relating to security and resilience of network and information systems

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-3-secretary-of-state-powers#clause-29 · Affects: Organisations carrying on essential activities and their activity-critical suppliers · Official text: HL Bill 62, PDF page 62 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=62)

**What the Bill says**

The Secretary of State may make regulations for identifying, managing and reducing risks of security or operational compromises to "relevant" network and information systems, and for mitigating their impact, including strengthening the resilience of those systems and the security of their physical environment (clause 29(1) and (2)).

A system is relevant if it is used for an essential activity or for an "activity-critical supply" (a supply of goods or services without which an essential activity would be at risk of disruption), or is associated with such a system (clause 29(3), (4) and (6)). A "security or operational compromise" covers anything that compromises security, availability, functionality or reliability, unauthorised access or interference, compromise of data, or loss of data (clause 29(5)).

**What this means in practice (our interpretation)**

Our reading: this is the engine of Part 3. It allows future regulations to go beyond the NIS Regulations, including onto suppliers, without a new Act. Nothing in it applies to anyone until regulations are made.

Related: [Glossary: activity-critical supply](https://cybersecurityandresiliencebill.com/glossary/activity-critical-supply) · [Glossary: secondary legislation](https://cybersecurityandresiliencebill.com/glossary/secondary-legislation) · [Secondary legislation tracker](https://cybersecurityandresiliencebill.com/guides/secondary-legislation-tracker) · [Henry VIII powers](https://cybersecurityandresiliencebill.com/guides/henry-viii-powers)

### Clause 30: Imposition of requirements on regulated persons

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-3-secretary-of-state-powers#clause-30 · Affects: OES, RDSPs, RMSPs, critical suppliers and anyone else specified · Official text: HL Bill 62, PDF page 63 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=63)

**What the Bill says**

Regulations under clause 29 may impose requirements on regulated persons, meaning persons specified (or of a description specified) who carry on an essential activity in the UK or provide an activity-critical supply, whether or not established in the UK (clause 30(1) to (3)). Specification can turn on designation by a regulator (clause 30(4)).

OES, RDSPs, RMSPs and critical suppliers (all as defined in the NIS Regulations) are treated as specified (clause 30(5)).

Requirements may include taking specified action (including outside the UK), prohibitions or restrictions, reporting, providing information, and appointing a UK representative (clause 30(6)).

**What this means in practice (our interpretation)**

Our reading: clause 30(5) is why critical suppliers can be given duties by regulations even though Part 2 does not set any. The reach to "activity-critical supply" means suppliers can be brought in directly by regulations, not only through designation.

Related: [Critical suppliers](https://cybersecurityandresiliencebill.com/whos-affected/critical-suppliers) · [Glossary: activity-critical supply](https://cybersecurityandresiliencebill.com/glossary/activity-critical-supply)

### Clause 31: Functions of regulatory authorities: enforcement, sanctions and appeals

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-3-secretary-of-state-powers#clause-31 · Affects: Regulated persons; regulators · Official text: HL Bill 62, PDF page 64 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=64)

**What the Bill says**

Regulations may give regulators functions for monitoring, investigating, securing compliance with and mitigating non-compliance with requirements under clause 29 regulations or the NIS Regulations (clause 31(1) and (2)). These may include appointing inspectors; entry, inspection and search; seizing documents; requiring information to be obtained or retained (including outside the UK); tests and interviews; and requiring remedial steps (clause 31(3)), subject to conditions such as producing identification or obtaining a warrant (clause 31(4)).

Where regulations provide for financial penalties they must provide for appeals to a court or tribunal (clause 31(6)(a)).

### Clause 32: Functions of the Secretary of State: loss of control of artificial intelligence agent

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-3-secretary-of-state-powers#clause-32 · Affects: Regulated persons whose systems involve AI agents · Official text: HL Bill 62, PDF page 65 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=65)

**What the Bill says**

Regulations under clause 29 may confer functions on the Secretary of State where a security or operational compromise of a relevant system is or may be attributable to loss of oversight or control of an "AI agent", or there is a risk of that (clause 32(1)).

"AI agent" and "loss of oversight or control" are to be defined by regulations (clause 32(2)). Functions may include imposing requirements on regulated persons in connection with identifying and investigating such compromises, preserving and analysing information, assessing causes and risks, and testing and sharing remedies (clause 32(5)), with inspector, entry, seizure, testing and direction powers (clause 32(6)) and sanctions including financial penalties (clause 32(9)).

**What this means in practice (our interpretation)**

Our reading: this does not regulate AI developers as such. It lets the Government give itself an investigation and response role when an AI agent used in or around a regulated system goes wrong. Its reach will depend entirely on how the regulations define "AI agent".

**History.** Inserted at Lords Report stage (26 October 2026) on a Government amendment (Baroness Lloyd of Effra). Clauses 32 onwards in Part 3 were renumbered as a result.

**Not settled by the text.** The key terms "AI agent" and "loss of oversight or control" are left to regulations, which must be consulted on (clause 43(1)(d)).

Related: [AI and the Bill](https://cybersecurityandresiliencebill.com/guides/ai-and-the-bill) · [AI companies and AI users](https://cybersecurityandresiliencebill.com/whos-affected/ai-companies)

### Clause 33: Provision about financial penalties

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-3-secretary-of-state-powers#clause-33 · Affects: Regulated persons under clause 29 regulations · Official text: HL Bill 62, PDF page 67 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=67)

**What the Bill says**

Regulations providing for penalties may set the amount or how it is worked out, including a daily rate, and must say how sums received are dealt with (clause 33(1) and (2)).

They must include a maximum: for an undertaking, no more than the greater of £17,000,000 and 10% of turnover (inside and outside the UK); otherwise no more than £17,000,000. They must say how turnover is determined and may treat group members or controllers as part of the undertaking (clause 33(3) and (4)). The £17m figures can be uprated for inflation (clause 33(5)).

**What this means in practice (our interpretation)**

Our reading: 10% is the ceiling Parliament would allow, not a figure the regulations must use. It is higher than the 4% cap in the NIS Regulations (clause 21), so describing the Bill's maximum penalty as "£17m or 4%" is only true of Part 2.

Related: [Fines and penalties](https://cybersecurityandresiliencebill.com/fines-and-penalties)

### Clause 34: Regulatory authorities, the Secretary of State and other persons: information, guidance and other functions

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-3-secretary-of-state-powers#clause-34 · Affects: Regulators and public bodies such as the NCSC · Official text: HL Bill 62, PDF page 68 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=68)

**What the Bill says**

Regulations may give regulators (and, where clause 32 is used, the Secretary of State) functions on disclosure of information (including to and from persons outside the UK), guidance, records and registers, reports, reviews, and co-operation (clause 34(1) and (2)). Disclosures under the regulations need not breach confidence, but nothing may authorise a disclosure prohibited by the Investigatory Powers Act 2016 (clause 34(4) and (5)). Regulations may also give functions to other public bodies, such as monitoring incidents and promoting best practice (clause 34(6) and (7)).

### Clause 35: Recovery of costs of regulatory authorities

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-3-secretary-of-state-powers#clause-35 · Affects: Regulated persons · Official text: HL Bill 62, PDF page 70 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=70)

**What the Bill says**

Regulations may allow regulators to charge current or former regulated persons for costs of functions under Part 3, Part 4 or the NIS Regulations, including enforcement, through charging schemes covering amounts, exemptions, payment, interest and disputes. A charge need not relate to functions exercised in relation to the payer, and may take previous deficits into account.

Related: [Cost recovery](https://cybersecurityandresiliencebill.com/cost-recovery)

### Clause 36: Supplementary provision and interpretation

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-3-secretary-of-state-powers#clause-36 · Affects: Drafting provision · Official text: HL Bill 62, PDF page 71 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=71)

**What the Bill says**

Regulations under clause 29 may confer discretionary functions, provide for delegation, require regard to guidance or a code of practice, and refer to documents as amended from time to time. Clause 36(2) collects the Chapter 3 definitions.

**History.** A Government drafting amendment agreed at Lords Third Reading on 2 November 2026 (not in the HL Bill 62 print) adds "(and see also section 30(5))" to the definition of "regulated person".

## Chapter 4: Code of practice

### Clause 37: Code of practice

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-3-secretary-of-state-powers#clause-37 · Affects: Regulated persons · Official text: HL Bill 62, PDF page 71 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=71)

**What the Bill says**

The Secretary of State may issue, revise and reissue a code of practice describing measures recommended for complying with requirements under clause 29 regulations or the NIS Regulations, after consulting such persons as the Secretary of State considers appropriate. It may make different provision for different kinds of regulated person.

**What this means in practice (our interpretation)**

Our reading: expect the code to draw on NCSC material such as the Cyber Assessment Framework, though the Bill does not name it.

Related: [Glossary: code of practice](https://cybersecurityandresiliencebill.com/glossary/code-of-practice) · [NCSC Cyber Assessment Framework](https://cybersecurityandresiliencebill.com/cyber-assessment-framework) · [Software Security Code of Practice](https://cybersecurityandresiliencebill.com/guides/software-security-code-of-practice)

### Clause 38: Procedure for issue of code of practice

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-3-secretary-of-state-powers#clause-38 · Affects: Parliament; regulated persons · Official text: HL Bill 62, PDF page 72 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=72)

**What the Bill says**

A draft code must be laid before Parliament. If either House resolves not to approve it within 40 days, it cannot be issued in that form; otherwise it can be issued, and comes into force on publication unless it says otherwise.

### Clause 39: Effects of code of practice

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-3-secretary-of-state-powers#clause-39 · Affects: Regulated persons; courts; regulators · Official text: HL Bill 62, PDF page 72 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=72)

**What the Bill says**

Failing to follow the code is not of itself evidence of a failure to comply with a requirement, and does not of itself create liability (clause 39(1)). The code is admissible in evidence, and courts, tribunals and regulators must take relevant provisions into account when deciding compliance questions about the period when they were in force (clause 39(2) to (4)).

**What this means in practice (our interpretation)**

Our reading: the code is not mandatory, but departing from it means you would need to show your own measures met the legal duty. Documenting why you chose a different approach will matter.

### Clause 40: Withdrawal of code of practice

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-3-secretary-of-state-powers#clause-40 · Affects: Regulated persons · Official text: HL Bill 62, PDF page 73 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=73)

**What the Bill says**

Withdrawal requires consultation and a notice laid before Parliament, and takes effect at the end of 40 days unless the notice specifies otherwise.

## Chapter 5: Report on network and information systems legislation

### Clause 41: Report on network and information systems legislation

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-3-secretary-of-state-powers#clause-41 · Affects: Parliament; regulators · Official text: HL Bill 62, PDF page 73 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=73)

**What the Bill says**

At least once every three years from Royal Assent, the Secretary of State must lay before Parliament and publish a report on the operation of the NIS Regulations, Parts 3 and 4 and regulations under Part 3. It must set out their objectives, assess whether they have been achieved and remain appropriate, consider less onerous alternatives, and review use of the Secretary of State's powers.

## Chapter 6: Regulations under Part 3

### Clause 42: Regulations under section 24 or Chapter 3

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-3-secretary-of-state-powers#clause-42 · Affects: Drafting provision · Official text: HL Bill 62, PDF page 74 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=74)

**What the Bill says**

Regulations under clause 24 or Chapter 3 may make different provision for different purposes or areas, apply to the Crown and to UK waters (internal waters, territorial sea and designated continental shelf areas), and make consequential provision, including amending or repealing primary legislation (Acts, Acts of the Scottish Parliament, Senedd legislation and Northern Ireland legislation).

**What this means in practice (our interpretation)**

Our reading: the power to amend Acts by regulations is a "Henry VIII" power. Clause 43(5) requires any such regulations to be approved by both Houses.

**History.** A Government drafting amendment agreed at Lords Third Reading on 2 November 2026 (not in the HL Bill 62 print) adds "(and see also section 30(5))" to clause 42(1)(a).

Related: [Henry VIII powers](https://cybersecurityandresiliencebill.com/guides/henry-viii-powers)

### Clause 43: Consultation and procedure

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-3-secretary-of-state-powers#clause-43 · Affects: Parliament; anyone consulted on regulations · Official text: HL Bill 62, PDF page 75 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=75)

**What the Bill says**

The Secretary of State must consult before making regulations on essential activities, regulatory authorities, the meaning of "AI agent" and "loss of oversight or control", extra matters for the clause 41 report, and most substantive clause 29 regulations (requirements, regulator functions, appeals, penalty caps, information sharing, cost recovery). Earlier consultation counts (clause 43(1) to (3)).

Regulations needing consultation, or amending primary legislation, must be approved in draft by both Houses; other regulations under Part 3 are subject to annulment by either House (clause 43(5) and (6)).

Related: [Secondary legislation tracker](https://cybersecurityandresiliencebill.com/guides/secondary-legislation-tracker)

## Related pages

- [Secondary legislation tracker](https://cybersecurityandresiliencebill.com/guides/secondary-legislation-tracker)
- [Statement of strategic priorities](https://cybersecurityandresiliencebill.com/guides/statement-of-strategic-priorities)
- [AI and the Bill](https://cybersecurityandresiliencebill.com/guides/ai-and-the-bill)
- [Glossary: code of practice](https://cybersecurityandresiliencebill.com/glossary/code-of-practice)
- [Henry VIII powers](https://cybersecurityandresiliencebill.com/guides/henry-viii-powers)
- [All 70 clauses](https://cybersecurityandresiliencebill.com/the-bill)