# Part 5 of the Cyber Security and Resilience Bill (CSRB): General (Clauses 68 to 70)

> Part 5 says the Bill would extend to the whole UK, sets out when each provision would come into force (some on Royal Assent, some two months later, the rest on dates set by regulations), and gives the short title: the Cyber Security and Resilience (Network and Information Systems) Act 2026.

Canonical page: https://cybersecurityandresiliencebill.com/the-bill/part-5-general
Last updated: 2026-11-09 · Source print: HL Bill 62, as amended on Report (26 October 2026)

## Where this stands

This is a Bill, not law. It has not received Royal Assent, so every duty described here is proposed. Lords stages complete (Third Reading 2 November 2026). The Commons has not yet considered the Lords amendments.

Clause numbers, subsections and page numbers refer to HL Bill 62 (as amended on Report, printed 26 October 2026): https://bills.parliament.uk/publications/68323/documents/8979. Checked against the Parliament Bills API on 9 November 2026. Numbers can change if the Commons amends or rejects Lords amendments.

"What the Bill says" is a close paraphrase of the clause text. "What this means in practice" is our interpretation.

## Clause table

| Clause | Heading | What it does | Who it affects |
| --- | --- | --- | --- |
| [68](https://cybersecurityandresiliencebill.com/the-bill/part-5-general#clause-68) | Extent | The Act would extend to England and Wales, Scotland and Northern Ireland. | Organisations across the whole UK |
| [69](https://cybersecurityandresiliencebill.com/the-bill/part-5-general#clause-69) | Commencement | Sets which provisions start on Royal Assent, which two months later, and which on dates set by regulations. | Everyone preparing for the Bill's duties |
| [70](https://cybersecurityandresiliencebill.com/the-bill/part-5-general#clause-70) | Short title | The Act would be cited as the Cyber Security and Resilience (Network and Information Systems) Act 2026. | Everyone citing the legislation |

## The clauses

### Clause 68: Extent

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-5-general#clause-68 · Affects: Organisations across the whole UK · Official text: HL Bill 62, PDF page 106 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=106)

**What the Bill says**

The Act extends to England and Wales, Scotland and Northern Ireland.

**What this means in practice (our interpretation)**

Our reading: extent is about which legal systems the Act forms part of. Whether a duty applies to a particular organisation depends on the scope provisions (for example, providing a service "in the United Kingdom"), not on this clause. The Scottish Parliament, Senedd and Northern Ireland Assembly have each agreed legislative consent motions (October 2026).

Related: [Devolved nations](https://cybersecurityandresiliencebill.com/guides/devolved-nations) · [Does the Bill apply to overseas companies?](https://cybersecurityandresiliencebill.com/guides/does-the-bill-apply-to-overseas-companies)

### Clause 69: Commencement

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-5-general#clause-69 · Affects: Everyone preparing for the Bill's duties · Official text: HL Bill 62, PDF page 106 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=106)

**What the Bill says**

Clause 69(1): on the day the Act is passed (Royal Assent):

- Part 1;
- Chapters 1, 3 and 6 of Part 3 (definitions, regulation-making powers, and procedure for regulations);
- clause 41 (report on the legislation);
- Part 5.

Clause 69(2): two months after Royal Assent:

- clause 18(3) and (4) (the new information-sharing regulations 6, 6A and 6B, and the Northern Ireland changes to regulation 7);
- Chapter 2 of Part 3 (statement of strategic priorities);
- paragraphs 3, 4 and 15 of Schedule 2 (removing the NIS national strategy, with a saving until the first statement is designated).

Clause 69(3) and (4): everything else on a day or days appointed by the Secretary of State by regulations, which may set different days for different purposes. This includes all of Part 2 apart from clause 18(3) and (4), Chapter 4 of Part 3 (code of practice), and the whole of Part 4.

Clause 69(5) and (6): clause 12 (critical suppliers) must be commenced on the same day as the first regulations under clause 29(1) that amend the NIS Regulations to impose requirements on providers of activity-critical supplies come into force.

Clause 69(7) to (9): the Secretary of State may make transitional or saving provision by regulations made by statutory instrument.

**What this means in practice (our interpretation)**

Our reading: Royal Assent alone would not switch on the new scope, registration, incident reporting, customer notification or penalty provisions in Part 2. Those wait for commencement regulations, and no date has been announced. Registration deadlines (clauses 13 and 14) then run three months from the relevant commencement. Any date you see for "when the duties start" that is not taken from commencement regulations is an estimate.

**Not settled by the text.** Clauses 66 and 67 impose deadlines running from Royal Assent but, as part of Part 4, are commenced only by regulations under clause 69(3).

Related: [When does the Bill come into force?](https://cybersecurityandresiliencebill.com/guides/when-does-the-bill-come-into-force) · [Glossary: commencement](https://cybersecurityandresiliencebill.com/glossary/commencement) · [Bill status and timeline](https://cybersecurityandresiliencebill.com/timeline) · [Secondary legislation tracker](https://cybersecurityandresiliencebill.com/guides/secondary-legislation-tracker)

### Clause 70: Short title

Anchor: https://cybersecurityandresiliencebill.com/the-bill/part-5-general#clause-70 · Affects: Everyone citing the legislation · Official text: HL Bill 62, PDF page 107 (https://cybersecurityandresiliencebill.com/hl-bill-62.pdf#page=107)

**What the Bill says**

The Act may be cited as the Cyber Security and Resilience (Network and Information Systems) Act 2026.

**What this means in practice (our interpretation)**

Our reading: the year in the short title assumes Royal Assent in 2026. Until then it is a Bill, and its provisions are proposals, not law.

Related: [The Cyber Security and Resilience Act](https://cybersecurityandresiliencebill.com/guides/cyber-security-and-resilience-act)

## Related pages

- [Bill status and timeline](https://cybersecurityandresiliencebill.com/timeline)
- [When does the Bill come into force?](https://cybersecurityandresiliencebill.com/guides/when-does-the-bill-come-into-force)
- [The first 90 days](https://cybersecurityandresiliencebill.com/guides/first-90-days)
- [Devolved nations](https://cybersecurityandresiliencebill.com/guides/devolved-nations)
- [All 70 clauses](https://cybersecurityandresiliencebill.com/the-bill)