Bill Status & Timeline: where the CSRB stands today
Track the Cyber Security and Resilience Bill from the King's Speech to Royal Assent. Updated after every parliamentary sitting.
House of Lords — Report Stage (HL Bill 49)
The Bill has passed all House of Commons stages and completed Lords Second Reading and Committee Stage. It is now approaching Lords Report Stage, scheduled for 27 October 2026, where amendments can be pressed to a vote of the full House. Royal Assent is expected between late 2026 and spring 2027.
Current stage
Lords Report Stage
Bill number
HL Bill 49
Next sitting
27 October 2026
Committee amendments agreed
5 of 193 tabled
Royal Assent (est.)
Late 2026 – Spring 2027
Full implementation (est.)
~2028
Why this matters now
Organisations that will fall in scope — MSPs, data centres, cloud providers, critical suppliers — should not wait for Royal Assent to begin preparation. Registration deadlines are typically 3 months from commencement (Section 14), and the Government's 2026 implementation consultation is already underway.Full legislative timeline
Every key milestone from announcement to projected implementation.
King's Speech announcement
The Cyber Security and Resilience Bill was announced in the King’s Speech as a priority for the new parliamentary session, signalling the Government’s intent to overhaul the UK’s NIS framework.
Introduced to Parliament (Bill 329)
The Bill was formally introduced to the House of Commons and received its First Reading. Published as Bill 329, it contained 5 Parts, 61 sections and 2 Schedules.
Commons Second Reading
MPs debated the Bill’s general principles and voted to proceed. Cross-party support was evident, with particular focus on the expanded scope covering MSPs, data centres and critical suppliers.
Commons Committee Stage
Line-by-line scrutiny in Public Bill Committee. Key amendments debated included Ofcom as sole regulator for data centres, AI scope and the 24-hour incident reporting threshold.
Commons Report Stage & Third Reading
The Bill passed the House of Commons without division. Final amendments were agreed, and the Bill was sent to the House of Lords on 17 June 2026.
Lords Second Reading
The House of Lords backed the Bill without a division. Peers highlighted supply-chain security, vendor direction powers, and the AI kill-switch debate as areas for committee scrutiny.
Lords Committee Stage (Grand Committee)
Three days of detailed scrutiny in Grand Committee. Of 193 amendments tabled, only 5 were agreed — all Government amendments. The Government tabled over 60 amendments creating vendor-related direction powers but did not move them, indicating they will return at Report Stage. The Bill was reprinted as HL Bill 49.
Lords Report Stage
Scheduled for the full House. Amendments withdrawn in committee can be brought back and pressed to a vote. The Government is expected to reintroduce its vendor-related direction powers over risky technology suppliers.
Lords Third Reading
Final opportunity for amendments in the Lords. If the Bill is amended, it returns to the Commons under the parliamentary “ping-pong” process until both Houses agree the text.
Royal Assent
Once both Houses agree the final text, the Bill receives Royal Assent and becomes the Cyber Security and Resilience Act. Section 60 triggers immediate commencement of Parts 1, 5 and key Part 3 provisions. Other provisions commence on dates appointed by the Secretary of State.
Full implementation via secondary legislation
The Government’s 2026 implementation consultation will shape the detailed regulations under Section 29. Registration deadlines (3 months from commencement under Section 14), codes of practice (Section 36), and critical supplier designation (Section 12, tied to Section 29 regulations per Section 60(5)) will be phased in.
What to watch at Lords Report Stage
Key issues expected to return on 27 October 2026.
Vendor direction powers
The Government tabled over 60 amendments creating powers to issue directions about risky technology suppliers. They were debated on 1 September but not moved. Ministers committed to engage peers ahead of Report Stage and are expected to reintroduce them.
AI scope & kill switch
Peers pushed amendments to bring AI systems into the Bill’s scope and to create an AI “kill switch” power. The Government resisted these at committee, but they may return as probing amendments.
Computer Misuse Act reform
Several peers argued the CSRB should include a statutory defence for authorised security researchers under the Computer Misuse Act 1990. The Government said it would consider the issue but did not accept the amendment.
Ofcom as sole data centre regulator
A key committee-stage change confirmed Ofcom as the sole regulator for data centres. This may attract further scrutiny from peers who favour sector-specific oversight.
Penalty thresholds
The penalty framework (Section 21: up to the greater of £17M and 4% of global turnover) was accepted, but peers may table amendments on proportionality for smaller organisations.
Implementation timeline
Cross-party concern about the pace of implementation. Peers may seek commitments on when the Section 29 regulations and codes of practice (Section 36) will be published.
When duties actually start
The Bill's commencement provisions stagger when different obligations take effect.
Day of Royal Assent
- Part 1 — Introduction and definitions
- Part 3, Chapters 1, 3 & 6 — Security and resilience functions framework
- Section 40 — Five-yearly reports on the legislation
- Part 5 — General provisions (extent, commencement, short title)
2 months after Royal Assent
- Section 18(3)–(4) — Information sharing with GCHQ
- Part 3, Chapter 2 — Statement of Strategic Priorities
- Schedule 2, paragraphs 3, 4 & 13 — Consequential amendments
Appointed day (by Secretary of State regulations)
- Part 2 — Expanded scope (MSPs, data centres, load controllers, critical suppliers)
- Incident reporting — 24-hour notification, 72-hour full report (Section 15)
- Enforcement powers — Penalties up to the greater of £17M and 4% turnover (Section 21)
- Customer notification obligations (Section 16)
- Registration requirements — 3-month deadline from commencement (Section 14)
- Section 12 (critical suppliers) — must commence on same day as first Section 29 regulations
~2028 — Full implementation
- Secondary legislation under Section 29 — detailed security and resilience regulations
- Codes of Practice under Section 36 — recommended compliance measures
- Critical supplier designation regime fully operational
- Cost recovery charging schemes published by regulators (Section 17)
Bill status FAQ
Quick answers to the questions compliance teams ask most.
Has the Cyber Security and Resilience Bill been passed?
Not yet. The Bill has completed all House of Commons stages and is now before the House of Lords (HL Bill 49). Lords Committee Stage finished on 7 September 2026, and Lords Report Stage is scheduled for 27 October 2026. It must still pass Lords Report Stage, Third Reading, and receive Royal Assent before it becomes law.
What stage is the Cyber Security and Resilience Bill at?
As of October 2026, the Bill is at Lords Report Stage — the next scheduled sitting is 27 October 2026. It previously passed Lords Committee Stage (1, 3, 7 September 2026 in Grand Committee), Lords Second Reading (14 July 2026), and all Commons stages. It is published as HL Bill 49.
When does the Cyber Security and Resilience Bill come into force?
Royal Assent is expected between late 2026 and spring 2027. Under Section 60, some provisions (Parts 1 and 5, key Part 3 chapters, Section 40) take effect immediately on the day the Act is passed. Most Part 2 duties (expanded scope, incident reporting, enforcement) commence on a date appointed by the Secretary of State via regulations. Full implementation, including critical supplier designation and detailed codes of practice, is expected around 2028 via secondary legislation.
What is HL Bill 49?
HL Bill 49 is the version of the Cyber Security and Resilience (Network and Information Systems) Bill as reprinted after Lords Committee Stage on 7 September 2026. It replaces the earlier HL Bill 32 (the version introduced to the Lords). Five Government amendments were agreed during committee, all incorporated into HL Bill 49.
What happens at Lords Report Stage?
Lords Report Stage is when the full House of Lords debates and votes on amendments to the Bill. Unlike Committee Stage (which sat in Grand Committee where votes cannot be held), Report Stage allows peers to press amendments to a division. The Government is expected to reintroduce vendor-related direction powers that were tabled but not moved during committee.
How long until organisations must comply with the CSRB?
The timeline depends on the provision. Once the Act is passed, some requirements take effect immediately. For most operational duties (registration, incident reporting, security measures), the Secretary of State will set commencement dates by regulations. Registration deadlines are typically 3 months from commencement (Section 14). The Government has said it will consult during 2026 on detailed implementation, with full effect expected around 2028.
Official sources
Every date and fact on this page is drawn from official parliamentary records.
- Bill stages and publications — UK Parliament
The authoritative record of the Bill’s progress, amendments and committee reports.
- Cyber Security and Resilience Bill collection — GOV.UK
DSIT policy statement, factsheets and the impact assessment.
- Lords Committee Stage report — UK Parliament
Parliament’s summary of the three-day Grand Committee scrutiny.
- Research briefing CBP-10442 — House of Commons Library
Clause-by-clause analysis of the Bill and its Commons passage.
Don't wait for Royal Assent to start preparing
Registration deadlines are typically 3 months from commencement. Our compliance team can assess your readiness now and build a roadmap that keeps pace with the parliamentary timetable.