The UK's Cyber Security and Resilience (Network and Information Systems) Bill is nearly through Parliament. It passed the Commons in June 2026, finished its Lords Committee stage in September, and Lords Report stage is scheduled for 26 October. When it becomes law, it will extend the UK's NIS Regulations 2018 to managed service providers and large data centres, let regulators designate "critical suppliers", require a first incident notification within 24 hours, and raise maximum penalties to £17 million or 4% of worldwide turnover.
This explainer is for engineering and security leaders at managed service providers, digital service providers, data centre operators, and the software and service companies that supply them. It covers who comes into scope, what changes for incident reporting, how penalties work, what happens on Royal Assent versus later, and what to do before the secondary regulations arrive. It's based on the bill as amended in Lords Grand Committee (HL Bill 49) and the government's explanatory notes from June.
The short answer
If you provide managed IT or security services in the UK and you're not a micro or small business, you'll probably be regulated by the Information Commission under NIS. If you run a UK data centre service of 1 MW or more (10 MW for enterprise data centres serving only their own organisation), Ofcom will regulate you. If you supply regulated organisations, a regulator could designate you a critical supplier. Everyone in scope will have to notify their regulator, and the NCSC, of significant incidents within 24 hours, with a full report within 72 hours, and some will have to tell affected customers. Most of these duties start on dates set later by regulations, not on Royal Assent, so there's time to prepare, but not much.
Where the bill is
| Stage | Date |
|---|---|
| Commons first reading | 12 November 2025 |
| Commons second reading (and carry-over into the new session) | 6 January 2026 |
| Commons committee | February 2026 |
| Commons report and third reading | 16 June 2026 |
| Lords second reading | 14 July 2026 |
| Lords Committee (Grand Committee) | 1, 3 and 7 September 2026 |
| Lords Report stage | scheduled for 26 October 2026 |
Dates are from the Parliament bill page. Amendments are still being tabled for Report, and after that come Lords third reading, any consideration of Lords amendments by the Commons, and Royal Assent. Details below could still change, so check the final text.
Who comes into scope
The NIS Regulations 2018 already cover operators of essential services, such as energy, transport, health, water and digital infrastructure, plus relevant digital service providers: online marketplaces, search engines and cloud computing services. The bill adds four groups.
Managed service providers. A "relevant managed service provider" provides ongoing managed services to another organisation through a connection to its network and information systems: IT outsourcing, remote support, application and infrastructure management, and managed security services such as firewall management, threat detection and incident response. The explanatory notes say small and micro businesses are excluded, using the EU's SME definition. The notes put the threshold as employing 50 or more people with annual turnover or balance sheet above €10 million. Providers based outside the UK are in scope if they provide managed services in the UK. The Information Commission (formerly the ICO) regulates them, with the same duties that digital service providers already have.
Data centres. Data centre services in the UK with a rated IT load of 1 MW or more come into scope. Enterprise data centres, which serve only their own organisation, come in at 10 MW. They'll be treated as operators of essential services, with Ofcom as regulator. The notes say these thresholds are meant to align with EU precedent.
Large load controllers. Organisations that can remotely control 300 MW or more of electrical load across consumer appliances, regulated jointly by the energy department and Ofgem.
Critical suppliers. This is the change that reaches furthest into supply chains. A regulator can designate a supplier to a regulated organisation as "critical" if the supplier relies on network and information systems to supply it, an incident on those systems could disrupt the services it supplies, and that disruption would likely have a significant impact on the economy or day-to-day life in all or part of the UK. The notes give the example of a supplier whose systems become a route for attackers into the essential service. What critical suppliers must actually do will be set in later regulations, and the bill says no one can be designated before those regulations are in force.
What changes for incident reporting
Today, NIS only requires a report when an incident significantly disrupts the service. The bill changes three things:
- Two stages, with a 24-hour first notification. Regulated organisations must send an initial notification within 24 hours of becoming aware of a significant incident, and a full notification within 72 hours. Both go to the regulator, with copies to the NCSC as the UK's CSIRT.
- A wider definition of "incident". The notes say the current test misses attacks that compromise systems without yet disrupting them. The bill brings in incidents such as pre-positioning, where attackers gain access to enable future disruption, and ransomware.
- Telling customers. Digital service providers, managed service providers and data centre operators must alert customers who are likely to have been affected by a significant incident.
For an MSP, the third point is the one that will change operations most. A compromise of the tooling you use to manage customer environments, such as a remote monitoring tool, an identity provider or a deployment pipeline, is exactly the kind of incident this aims at. You'll need to know quickly which customers an incident could reach.
Penalties
The bill replaces the current penalty structure with two tiers:
| Tier | Maximum for an undertaking | Otherwise |
|---|---|---|
| Standard maximum | the greater of £10 million or 2% of worldwide turnover | £10 million |
| Higher maximum | the greater of £17 million or 4% of worldwide turnover | £17 million |
The bill also lets the Secretary of State raise turnover-based penalties, by regulations, up to 10% of worldwide turnover. Breaching a national-security direction from the Secretary of State under Part 4 carries its own penalty: up to £17 million, or the greater of £17 million and 10% of turnover once regulations allow it, plus up to £100,000 per day while the breach continues. Separately, regulators get a cost-recovery framework that lets them charge regulated organisations a periodic fee.
What starts when
The commencement clause splits the bill into three groups. Definitions, the Secretary of State's powers to make regulations and a reporting requirement start on Royal Assent. Information-sharing provisions and the statement of strategic priorities start two months later. Everything that creates new obligations for businesses (bringing MSPs and data centres into scope, critical supplier designation and the Secretary of State's direction powers) starts on dates set later by regulations, and different parts can start on different days.
So there will be a gap between Royal Assent and your obligations, and the secondary regulations, guidance and codes of practice that fill it will decide much of the detail. Part 3 of the bill lets the Secretary of State set security requirements by regulations and issue a code of practice, and Part 4 adds powers to direct regulators and regulated organisations for national security reasons.
What to do now
- Work out whether you're in scope. For MSPs, check headcount and turnover against the SME definition, and list the UK customers you manage through a connection to their systems. For data centres, check rated IT load. For suppliers, list the regulated organisations you serve and how they depend on you.
- Make 24 hours achievable. Most incident processes are built around confirming impact before notifying anyone. Write down who decides that something is a significant incident, who notifies, and what goes into a first notification when you don't know much yet.
- Map customers to systems. To alert affected customers, you need to know which tooling, credentials and environments each customer depends on. An MSP that can't answer "which customers can this remote access tool reach?" within an hour will struggle with the new duty.
- Look at your own suppliers. Critical supplier designation flows both ways. If you're regulated, you'll want evidence that the suppliers your service depends on are secure. If you're a supplier, expect more questions from regulated customers before any designation happens.
- Watch the regulations. The duties and timelines that matter most will come from secondary legislation and guidance from the Information Commission and Ofcom. Track the consultations.
How it compares with the EU
The bill moves the UK closer to the EU's NIS2 directive without copying it. Both bring managed service providers into scope, both use a two-stage early warning, and the data centre thresholds are meant to align with EU practice. NIS2's early warning is also due within 24 hours. The UK approach leans more on regulators designating individual critical suppliers and on secondary legislation, where NIS2 sets more detail in the directive and national laws. Organisations that have already done NIS2 work will find much of it reusable. Our NIS2 explainer covers the EU side.
The fair view
There are reasonable concerns about the bill. Much of the detail, including what critical suppliers must do and how the Secretary of State will use powers to add sectors and set requirements, is left to regulations that Parliament will scrutinise less closely than primary legislation. The Lords Delegated Powers and Constitution committees both reported on the bill this summer. For businesses, that means the compliance target will keep moving after Royal Assent.
But the direction is clear, and the pieces that will cost the most effort, fast incident notification, knowing which customers an incident affects, and evidence about suppliers, are good practice whatever the final regulations say. Starting on them now is low-regret work.
