Part 4: Directions for national security purposes.

The Secretary of State may give a direction to a person (P) specified, or of a description specified, in regulations, if two conditions are met: the Secretary of State considers a national security risk arises or could arise from P's use, in connection with its Part 4 systems, of goods, services or facilities provided by another person (condition 1); and the direction is necessary and its requirements proportionate (condition 2) (clause 44(1), (3) and (4)).

Regulations may only specify persons who are regulated persons under clause 30(2), carry on a Part 4 essential activity in the UK, or provide essential goods or services (clause 44(2)). The regulations need consultation and approval by both Houses (clause 44(7) and (9)).

A direction may require P to do or not do something to eliminate, reduce or mitigate the risk, including restricting or prohibiting use or installation of goods, services or facilities, removing, disabling or modifying them, providing information, and appointing a "skilled person" (clause 44(5) and (6)).

It does not matter whether the vendor is in the UK, the goods or services are provided from outside the UK, or the use is in the UK (clause 45(1)). A direction must name the recipient, the vendor and the goods, services or facilities, give reasons (unless contrary to national security), the start time, and a reasonable period for each requirement (clause 45(2)).

The recipient must comply (clause 45(3)), must get written approval before appointing a skilled person and notify the appointment (clause 45(4)); the Secretary of State may rely on a list published by GCHQ (clause 45(5)).

Before giving a direction the Secretary of State must, so far as reasonably practicable, consult the recipient, the vendor and others, unless contrary to national security (clause 45(6) and (7)), and may require the recipient and those consulted not to disclose the direction or consultation where necessary and proportionate for national security (clause 45(8) and (9)).

The Secretary of State may make regulations about the time frame for deciding whether to give a direction under clause 44, whether on a referral or otherwise, including the decision period and when it can be extended or paused. They are subject to annulment by either House.

The Secretary of State may by regulations establish a scheme requiring persons specified under clause 44(1)(a) to refer a "qualifying transaction" (including a proposed one) so the Secretary of State can decide whether to give a vendor-related direction, but only if this is considered necessary or expedient for national security (clause 47(1) to (3)). "Qualifying transaction" would be defined in the regulations, for example by nature, value, criticality or vendor identity (clause 47(4) and (5)).

The regulations may cover timing, procedure, information, monitoring and enforcement, applying clauses 50 to 57 (clause 47(6) and (7)). They need consultation and approval by both Houses (clause 47(8) and (10)).

The Secretary of State may give a direction if the occurrence or threat of a security or operational compromise to a person's Part 4 system gives rise to a national security risk, and the direction is necessary and proportionate (clause 48(1)). It can be given to regulated persons under clause 30(2), or persons specified in affirmative regulations who carry on a Part 4 essential activity in the UK or provide essential goods or services (clause 48(2), (3), (6) and (17)).

Clause 48(5) lists the kinds of requirement (system management, risk reduction, information, restrictions and prohibitions on goods or services, removal or modification, a skilled person, and action in or outside the UK). Clause 48(8) sets what a direction must specify; clause 48(9) imposes the duty to comply; clause 48(10) and (11) cover skilled-person approval; clause 48(12) and (13) consultation; and clause 48(14) and (15) non-disclosure requirements.

If the Secretary of State considers it is not reasonably practicable to comply with both a direction and another regulatory requirement under any enactment, and notifies the person, the conflicting requirement does not apply to the extent of the conflict (clause 49(1) and (2)). Relevant regulators must be told unless contrary to national security, and told again if the direction is varied or revoked.

The Secretary of State may direct a regulator to obtain information about a person's compliance with a clause 44 or 48 direction, report on it and hand over the underlying information. A regulator that is a Minister, devolved government or Northern Ireland department cannot be directed but may be asked (clause 50(8) and (9)). The Secretary of State may disclose the reports, having regard to commercially and personally sensitive information.

The Secretary of State may require any person to provide information or documents reasonably required for Part 4 functions; a regulator may require a regulated person to do so for a clause 50 direction or request (clause 51(1) and (2)). Notices must explain why, unless contrary to national security, and may require information to be generated or retained, including information stored outside the UK. Legally privileged communications are protected. The power cannot be used against the SPOC or the CSIRT.

The Secretary of State, or a monitoring regulator, may carry out an inspection, appoint an inspector, or direct the person to appoint an approved inspector (clause 52(2) and (3)). The person must pay the reasonable costs if required, co-operate, give access to premises (not private dwellings), documents and people, and comply with the inspector's requests (clause 52(4) and (6)). Inspectors may require material to be preserved, copy or remove documents and equipment, interview people and carry out security tests (clause 52(8)). Powers over premises, equipment and people do not extend outside the UK (clause 52(10)).

Where there are reasonable grounds to believe a relevant requirement (a direction, skilled-person approval, an information notice or an inspection requirement) has been contravened, the enforcement authority may give a notification setting out the contravention, a period for representations, the steps to take and the proposed penalty (clause 53(1) to (3)). Continuing contraventions can attract daily penalties after a confirmation decision (clause 53(6)). It does not matter whether the conduct happened in the UK (clause 53(8)). The notification can be made confidential on national security grounds (clause 53(9) and (10)).

A penalty must be appropriate and proportionate (clause 54(1)). Maximums (clause 54(2)):

• contravening a direction, or the skilled-person approval duty, by an undertaking: £17,000,000, or, where regulations under clause 54(5) are in force, the greater of £17,000,000 and 10% of worldwide turnover;
• the same contravention by a person that is not an undertaking: £17,000,000;
• breaching a Part 4 information or inspection requirement: £10,000,000.

Daily penalties (clause 54(3)): up to £100,000 a day for continuing contravention of a direction, and £50,000 a day for information or inspection requirements, not counting days before the notification (clause 54(4)).

The Secretary of State must make regulations defining "undertaking" and how turnover is determined (clause 54(5)); they are subject to annulment (clause 54(9)).

After the representation period the authority may give a confirmation decision, with reasons, if satisfied the contravention occurred, or say no further action will be taken. The decision may require immediate action or set a period, and may impose the notified penalty or a lesser one. The duty to comply can be enforced by injunction, specific performance (Scotland) or other relief, and can be made confidential on national security grounds.

A penalty is recoverable in England and Wales as if payable under a county court order, in Scotland like a registered decree arbitral, and in Northern Ireland as if under a county court order, and is entered on the relevant register of judgments.

Non-disclosure requirements under clauses 45(8), 48(14), 53(9) and 55(9) are enforceable through clauses 53 to 56 with modifications. A disclosure by an employee or person engaged in the business counts as the organisation's disclosure unless it took all reasonable steps to prevent it. Maximum penalty £10,000,000, or £50,000 a day for continuing contraventions.

Where necessary and proportionate in the interests of national security, the Secretary of State may direct a regulator about its functions under the NIS Regulations, clause 29 regulations or Part 4, generally or specifically. The regulator must comply. Ministers of the Crown, the Scottish and Welsh Governments and Northern Ireland departments cannot be directed.

The Secretary of State must review directions from time to time and may vary them (only if the varied direction is necessary and proportionate) or revoke them, giving notice. Before varying a clause 44 or 48 direction the Secretary of State must consult the recipient so far as reasonably practicable, unless contrary to national security, and may impose non-disclosure requirements on those consulted.

The Secretary of State must publish, as soon as practicable, notice that a vendor-related direction has been given, varied or revoked, stating when it takes effect, the recipient, a summary of it, its effect and reasons. Material that might unreasonably harm commercial interests or would be contrary to national security may be left out.

For each 12 months from when clause 44(1) comes into force (other than for making regulations), the Secretary of State must lay a report giving the number of vendor-related directions given, varied and revoked, and the kinds of services provided by the recipients (including sectors).

Copies of clause 48 and 58 directions and notices of variation must be laid before Parliament, unless the Secretary of State considers that contrary to national security; commercially harmful or security-sensitive material may be excluded.

The Secretary of State and regulators may disclose information obtained under Part 4 to each other, GCHQ, other UK public authorities and overseas public authorities, where necessary for national security and limited to what is relevant and proportionate. This overrides confidentiality obligations but not the Investigatory Powers Act 2016 prohibitions.

Directions, notices, notifications and decisions may be delivered by hand, left at or posted to the proper address, emailed, or given to a notified representative. Email is treated as received at 9am on the next working day unless the contrary is proved.

A "Part 4 essential activity" is one the Secretary of State considers essential to the UK economy or day-to-day functioning of society; "essential goods or services" are those without which such an activity would be at risk of disruption; a "Part 4 NIS" is a network and information system used for such an activity or supply, or associated with one.

The Secretary of State must, within 12 months of Royal Assent, review the effectiveness of the Act and the NIS Regulations (clause 66(1)), including which organisations should have obligations, technology providers' obligations, and regulatory options (clause 66(2)).

The review must consider whether to add sectors, with particular regard to critical national infrastructure; digital infrastructure including cloud, SaaS and content delivery networks; frontier AI and agentic technologies; democratic processes; advanced manufacturing, life sciences and critical transport equipment; and education, research and large-scale retail of essential goods other than food (clause 66(3)). It must also look at thresholds, supply chains, the regulatory framework, powers for the AI Security Institute over frontier AI, cyber skills supply and incident reporting timelines (clause 66(4) and (5)).

A report must be laid; where it concludes an activity should be brought in, the Secretary of State must within six months lay draft regulations or explain why not; further reviews follow at intervals of not more than 12 months (clause 66(8) to (10)).

To inform action under Part 4, the Secretary of State must, by affirmative regulations made within six months of Royal Assent, establish and maintain a register of foreign powers believed to present a risk to the UK's critical network and information systems (clause 67(1) and (6)). It must include states GCHQ has confirmed attacked or attempted to attack OES or critical supplier systems in the UK in the preceding seven years through state bodies or affiliates, and states GCHQ has warned pose such a risk (clause 67(2)).

For each listed power the Secretary of State must review the risk, and within six months of the register being established lay a report with findings and a plan, or a statement if it cannot be laid for national security reasons (clause 67(3) to (5)). "Foreign power" includes heads of state, governments, their agencies and governing political parties (clause 67(7) and (8)).