Part 5: General.
Part 5 says the Bill would extend to the whole UK, sets out when each provision would come into force (some on Royal Assent, some two months later, the rest on dates set by regulations), and gives the short title: the Cyber Security and Resilience (Network and Information Systems) Act 2026.
Last updated Status: not yet law. The Commons considers the Lords amendments on 24 November 2026.Sources: UK Parliament · HL Bill 62 · NIS Regulations 2018This is a Bill, not law. It has not received Royal Assent, so every duty described here is proposed. Lords stages complete (Third Reading 2 November 2026). The Commons has not yet considered the Lords amendments.
Clause numbers, subsections and page numbers refer to HL Bill 62 (as amended on Report, printed 26 October 2026), checked against the Parliament Bills API on 9 November 2026. Numbers can change if the Commons amends or rejects Lords amendments.
Part 5 · Clauses 68 to 70Clause table
| Clause | Heading | What it does | Who it affects |
|---|---|---|---|
| 68 | Extent | The Act would extend to England and Wales, Scotland and Northern Ireland. | Organisations across the whole UK |
| 69 | Commencement | Sets which provisions start on Royal Assent, which two months later, and which on dates set by regulations. | Everyone preparing for the Bill's duties |
| 70 | Short title | The Act would be cited as the Cyber Security and Resilience (Network and Information Systems) Act 2026. | Everyone citing the legislation |
The clauses
Clause 68Extent
What the Bill saysThe Act extends to England and Wales, Scotland and Northern Ireland.
Our reading: extent is about which legal systems the Act forms part of. Whether a duty applies to a particular organisation depends on the scope provisions (for example, providing a service "in the United Kingdom"), not on this clause. The Scottish Parliament, Senedd and Northern Ireland Assembly have each agreed legislative consent motions (October 2026).
Clause 69Commencement
What the Bill saysClause 69(1): on the day the Act is passed (Royal Assent):
- Part 1;
- Chapters 1, 3 and 6 of Part 3 (definitions, regulation-making powers, and procedure for regulations);
- clause 41 (report on the legislation);
- Part 5.
Clause 69(2): two months after Royal Assent:
- clause 18(3) and (4) (the new information-sharing regulations 6, 6A and 6B, and the Northern Ireland changes to regulation 7);
- Chapter 2 of Part 3 (statement of strategic priorities);
- paragraphs 3, 4 and 15 of Schedule 2 (removing the NIS national strategy, with a saving until the first statement is designated).
Clause 69(3) and (4): everything else on a day or days appointed by the Secretary of State by regulations, which may set different days for different purposes. This includes all of Part 2 apart from clause 18(3) and (4), Chapter 4 of Part 3 (code of practice), and the whole of Part 4.
Clause 69(5) and (6): clause 12 (critical suppliers) must be commenced on the same day as the first regulations under clause 29(1) that amend the NIS Regulations to impose requirements on providers of activity-critical supplies come into force.
Clause 69(7) to (9): the Secretary of State may make transitional or saving provision by regulations made by statutory instrument.
Our reading: Royal Assent alone would not switch on the new scope, registration, incident reporting, customer notification or penalty provisions in Part 2. Those wait for commencement regulations, and no date has been announced. Registration deadlines (clauses 13 and 14) then run three months from the relevant commencement. Any date you see for "when the duties start" that is not taken from commencement regulations is an estimate.
Not settled by the text. Clauses 66 and 67 impose deadlines running from Royal Assent but, as part of Part 4, are commenced only by regulations under clause 69(3).
Clause 70Short title
What the Bill saysThe Act may be cited as the Cyber Security and Resilience (Network and Information Systems) Act 2026.
Our reading: the year in the short title assumes Royal Assent in 2026. Until then it is a Bill, and its provisions are proposals, not law.
Other Parts of the Bill.
Know where you stand before the duties land.
Take the free readiness assessment to see how your organisation measures up against the Cyber Security and Resilience Bill, or talk to our team about a plan.