View the Cyber Security and Resilience Bill.
The complete Cyber Security and Resilience (Network and Information Systems) Bill. Introduced to the Commons as Bill 329 on 12 November 2025, the document below is the current version - HL Bill 62, as amended on Lords Report Stage (26 October 2026). The Lords completed Third Reading on 2 November 2026 and the Bill is now back with the Commons. For live status, see the UK Parliament Bill page.
Last updated Status: not yet law. The Commons considers the Lords amendments on 24 November 2026.Sources: UK Parliament · HL Bill 62 · NIS Regulations 2018Cyber Security and Resilience (Network and Information Systems) Bill
Loading PDF document...
Bill structure
- Part 1:Introduction (Clauses 1-2)
- Part 2:The NIS Regulations (Clauses 3-23)
- Part 3:Security and Resilience Functions (Clauses 24-43)
- Part 4:National Security Directions (Clauses 44-67)
- Part 5:General (Clauses 68-70)
- Schedules:Schedule 1 (Enforcement), Schedule 2 (Amendments)
Key information
- Bill number:Bill 329 (now HL Bill 62)
- Introduced:12th November 2025
- Presented by:Liz Kendall, Secretary of State (DSIT)
- Status:Passed the Lords; Commons considering Lords amendments
- Clauses:70
- Schedules:2
What is in the Bill, part by part.
HL Bill 62 runs to 5 Parts, 70 clauses and 2 Schedules. Use this to find the provision you need before opening the PDF.
Introduction
Clauses 1 to 2Defines "the NIS Regulations" as SI 2018/506 and gives an overview of the Act.
- cl.1Meaning of "the NIS Regulations"
- cl.2Overview of Act
The NIS Regulations
Clauses 3 to 23The operative part for most organisations. It amends the 2018 Regulations to bring new entities into scope and to change duties, reporting and enforcement.
Chapter 1 – Persons regulated
- cl.3Identification of operators of essential services
- cl.4Data centres to be regulated as essential services
- cl.5Operators of data centre services: Crown application
- cl.6Designation of large load controllers
- cl.7Digital services
- cl.8Duties of relevant digital service providers
- cl.9Managed service providers
- cl.10Duties of managed service providers to manage risks
- cl.11Meaning of "subject to public authority oversight"
- cl.12Critical suppliers
Chapter 2 – Information and incident reporting
- cl.13Provision of information by operators of data centre services
- cl.14Provision of information by digital or managed service providers
- cl.15Reporting of incidents by regulated persons
- cl.16Notification of incidents to customers
Chapter 3 – Other amendments
- cl.17Powers to impose charges (cost recovery)
- cl.18Sharing and use of information
- cl.19Guidance
- cl.20Powers to require information
- cl.21Financial penalties
- cl.22Enforcement and appeals
- cl.23Minor and consequential amendments
Functions of the Secretary of State
Clauses 24 to 43Creates powers to set strategic priorities, make further security regulations and issue a code of practice. This is where most of the delegated-powers criticism in Parliament was aimed.
Chapters 1 to 2 – Definitions and strategic priorities
- cl.24Key definitions in Part 3
- cl.25Statement of strategic priorities
- cl.26Consultation and procedure
- cl.27Duties of regulatory authorities in relation to statement
- cl.28Report by Secretary of State
Chapter 3 – Regulations about security and resilience
- cl.29Regulations relating to security and resilience
- cl.30Imposition of requirements on regulated persons
- cl.31Enforcement, sanctions and appeals
- cl.32Loss of control of an artificial intelligence agent
- cl.33Provision about financial penalties
- cl.34Information, guidance and other functions
- cl.35Recovery of costs of regulatory authorities
- cl.36Supplementary provision and interpretation
Chapters 4 to 6 – Code of practice, report and regulations
- cl.37-40Code of practice: issue, effect and withdrawal
- cl.41Report on network and information systems legislation
- cl.42-43Regulations under Part 3, consultation and procedure
Directions for national security purposes
Clauses 44 to 67A separate regime from the NIS Regulations. It lets the Secretary of State direct regulated persons and regulators, with its own penalties. The Lords added a review of the whole regime and a register of foreign powers.
Chapters 1 to 3 – Directions
- cl.44-47Vendor-related directions, time frames and a mandatory referral scheme
- cl.48General directions
- cl.49Compliance with directions to take priority
- cl.50Monitoring by regulatory authorities
- cl.51-52Information gathering and inspections
- cl.53-57Notification of contravention, penalty amounts and enforcement
Chapters 4 to 5 – Regulators and general provision
- cl.58Power to direct regulatory authorities
- cl.59-62Review of directions, publication, annual report and laying before Parliament
- cl.63-65Information sharing, means of giving directions and interpretation
- cl.66Review of the effectiveness of the NIS regime
- cl.67Register of foreign powers
General
Clauses 68 to 70Extent, commencement and short title. Commencement matters: most duties begin through later regulations, not on Royal Assent.
- cl.68Extent
- cl.69Commencement
- cl.70Short title
The two Schedules
- Schedule 1 – Enforcement and appeals. Further amendments to the NIS Regulations covering how enforcement decisions are made and challenged.
- Schedule 2 – Minor and consequential amendments. Worth knowing because it is a common source of confusion: this is not the sector threshold table. Those thresholds are in Schedule 2 to the NIS Regulations 2018, which this Bill amends but does not reproduce.
Clause numbers are from HL Bill 62, as amended on Lords Report Stage (26 October 2026). If the Bill is reprinted after the Commons considers the Lords amendments, check the arrangement of clauses again.
Copyright and licensing information
This document contains Parliamentary information licensed under the Open Parliament Licence.
Parliamentary material is reproduced with the permission of the Controller of HMSO on behalf of Parliament. You may use and re-use the information featured on this page (not including logos) free of charge in any format or medium, under the terms of the Open Parliament Licence.
Under the Open Parliament Licence you are free to:
- Copy, publish, distribute and transmit the information
- Adapt the information
- Exploit the information commercially and non-commercially
You must, where you do any of the above:
- Acknowledge the source of the information by including the following attribution statement: "Contains Parliamentary information licensed under the Open Parliament Licence"
- Include a link to the Open Parliament Licence
Guides on this topic.
All guidesCyber Security and Resilience Bill summary
The CSRB on one page: what HL Bill 62 does, who it adds, what changed in the Lords, when it starts and what is still moving.
Read the guideNIS Regulations 2018 as amended by the Cyber Security and Resilience Bill: a Keeling schedule
How the NIS Regulations 2018 would read after HL Bill 62: current and amended text for regs 1, 10, 11, 12 and 18, plus the new MSP and data centre rules.
Read the guideThe Cyber Security and Resilience Bill, clause by clause: a summary
Plain-English summary of all 70 clauses of HL Bill 62, with what changed in the Lords and a table mapping old clause numbers to new ones.
Read the guideKnow where you stand before the duties land.
Take the free readiness assessment to see how your organisation measures up against the Cyber Security and Resilience Bill, or talk to our team about a plan.