Is there a UK Cyber Resilience Act?
People searching for a "UK Cyber Resilience Act" are usually looking for the Cyber Security and Resilience Bill (CSRB). This guide disambiguates the UK CSRB, the EU Cyber Resilience Act (CRA), and DORA for UK organisations.
There is no "UK Cyber Resilience Act"
The term "UK Cyber Resilience Act" conflates two separate regulatory regimes.
The EU Cyber Resilience Act (CRA) is a European Union regulation (2024/2847) that sets mandatory cybersecurity requirements for products with digital elements — hardware and software — before they are placed on the EU market. It does not apply in the UK.
The UK Cyber Security and Resilience Bill (CSRB) is the UK's own framework for strengthening the cyber resilience of essential services and critical national infrastructure. It evolves from the original NIS Regulations (2018) and is the closest UK equivalent to both NIS2 and, in certain operational resilience aspects, DORA.
They are fundamentally different laws solving different problems: the CRA is about product security; the CSRB is about service and infrastructure resilience.
UK CSRB vs EU CRA vs EU DORA
Three regulatory frameworks that UK organisations commonly confuse. Here is how they differ.
| Dimension | UK CSRB (HL Bill 32) | EU CRA (Reg. 2024/2847) | EU DORA (Reg. 2022/2554) |
|---|---|---|---|
| Jurisdiction | United Kingdom | European Union (27 member states) | European Union (27 member states) |
| Core focus | Operational resilience of essential services and critical infrastructure | Product security for hardware and software with digital elements | Digital operational resilience of financial services entities |
| Who it regulates | Essential service operators, MSPs, data centres, critical suppliers | Manufacturers, importers, and distributors of products with digital elements | Banks, insurers, investment firms, crypto-asset providers, ICT third-party providers |
| Penalties | Greater of 4% global turnover or £17M | Up to €15M or 2.5% global turnover | Up to €10M or 5% global turnover (for critical ICT providers) |
| Incident reporting | 24h initial · 72h full report Includes near misses | 24h early warning for actively exploited vulnerabilities 72h detailed notification | Initial notification within 4 hours (major ICT incidents) Intermediate and final reports follow |
| UK applicability | Directly applies in the UK | Does not apply in the UK (but UK exporters to the EU must comply) | Does not apply in the UK (but UK firms serving the EU must comply) |
| Timeline | Expected Royal Assent 2026; full application by 2028 | Entered into force December 2024; full application December 2027 | Fully applicable from 17 January 2025 |
CSRB vs EU Cyber Resilience Act
These two laws target entirely different aspects of cybersecurity. Understanding the distinction is critical for compliance planning.
EU Cyber Resilience Act
The CRA regulates products before they reach the market. It requires manufacturers to:
- Design products without known exploitable vulnerabilities
- Ship with secure-by-default configurations
- Provide security updates for at least five years
- Report actively exploited vulnerabilities to ENISA within 24 hours
- Undergo conformity assessment (self-assessment or third-party for critical products)
Applies to: EU market only
UK CSRB
The CSRB regulates organisations that operate essential services. It requires them to:
- Implement appropriate and proportionate security measures
- Report significant cyber incidents within 24 hours (including near misses)
- Manage supply chain risk through critical supplier designations
- Submit to regulator-led investigations and cost recovery
- Cooperate with sector-specific regulators (ICO, Ofcom, etc.)
Applies to: UK organisations
What about UK product security?
The UK already has product security legislation: the Product Security and Telecommunications Infrastructure (PSTI) Act 2022, which came into force on 29 April 2024. It requires IoT device manufacturers to ban default passwords, maintain a vulnerability disclosure policy, and state the minimum security update period. While narrower than the EU CRA, it is the closest UK equivalent for product security.
CSRB vs DORA for UK organisations
Financial services firms often ask whether the CSRB replaces DORA. The answer depends on where you operate.
EU DORA (Digital Operational Resilience Act)
DORA (Regulation 2022/2554) has been fully applicable since 17 January 2025. It creates a comprehensive ICT risk management framework for financial entities across the EU, covering:
- ICT risk management frameworks and governance
- ICT incident classification and reporting (major incidents within 4 hours)
- Digital operational resilience testing, including threat-led penetration testing
- Third-party ICT provider risk management and oversight
UK operational resilience framework
The UK does not have a single "UK DORA". Instead, UK financial services firms are subject to the Bank of England, PRA, and FCA operational resilience requirements, which came into force on 31 March 2022. The key obligations include:
- Identifying important business services and setting impact tolerances
- Mapping critical resources, people, processes, technology, and third parties
- Scenario testing to demonstrate the ability to remain within impact tolerances
- Broader scope than DORA: covers all types of disruption, not just ICT/cyber
The CSRB will complement this existing framework by strengthening cyber-specific obligations for financial services entities that are designated as essential service operators or critical national infrastructure.
Dual compliance for cross-border firms
UK financial services firms with EU operations or clients may need to comply with both DORA and the UK operational resilience framework. DORA applies to any entity providing services within the EU, regardless of where it is headquartered. The CSRB will add a further layer for UK-designated entities. Early gap analysis is essential to avoid duplicated effort.
Which regime applies to your UK organisation?
Use this guide to determine which frameworks are relevant to your compliance obligations.
Essential service operators
If you operate in energy, transport, water, health, or digital infrastructure in the UK, the CSRB will directly apply. Prepare for 24-hour incident reporting, near-miss obligations, and potential cost recovery fees.
Product manufacturers
If you make hardware or software sold in the EU, the EU CRA applies to your products. For the UK market, the PSTI Act already requires banning default passwords and disclosing update support periods for IoT devices.
Financial services firms
UK-regulated firms must comply with the BoE/PRA/FCA operational resilience framework. If you also serve EU clients, DORA adds ICT risk management requirements. The CSRB may apply if you are designated as critical infrastructure.
Looking for NIS2 vs CSRB?
This page takes a broader view across the CRA, DORA, and NIS2. For a detailed side-by-side comparison of the UK CSRB and the EU NIS2 Directive — including scope, penalties, and reporting differences — see the dedicated guide.
Read the NIS2 vs CSRB comparisonFrequently asked questions
Quick answers for compliance professionals navigating these overlapping regimes.
Is there a UK Cyber Resilience Act?+
What is the UK equivalent of DORA (Digital Operational Resilience Act)?+
Does the EU Cyber Resilience Act apply in the UK?+
What is the difference between the EU CRA and the UK CSRB?+
Does the UK have a NIS2 equivalent?+
Not sure which regulations apply to you?
Whether you need to comply with the CSRB, EU CRA, DORA, or a combination of all three, our assessment identifies exactly which obligations apply and where your gaps are.