The UK's Cyber Security and Resilience (Network and Information Systems) Bill has moved from proposal to a piece of legislation with concrete shape. Introduced to the House of Commons on 12 November 2025, it completed its Public Bill Committee stage in early 2026 and, per the May 2026 DSIT cyber security newsletter and the King's Speech confirmation, is now headed for Report stage ahead of the House of Lords. The government has also signaled that a full National Cyber Action Plan will be published over the summer alongside further parliamentary progress on the Bill.
The Bill is best understood as the UK's answer to the same problem NIS2 addresses in the EU: the original Network and Information Systems Regulations 2018 covered too narrow a population and carried obligations too weak for the current threat environment. Rather than a wholesale replacement, the Bill amends the 2018 regime, widening who is in scope and sharpening what they must do. For software vendors and the platform teams inside regulated entities, two changes stand out: the expansion of scope to managed service providers and critical suppliers, and an incident reporting requirement that is faster than both the current UK rules and, in its initial notification, comparable to the strictest EU timelines.
Because the Bill is still in passage, the precise contours of some obligations will be set in secondary legislation rather than the primary text. But enough is settled by May 2026 to begin preparing in earnest, and the supply chain dimension is one of the clearest signals of where the regime is heading.
TL;DR
- The UK Cyber Security and Resilience Bill, introduced 12 November 2025, completed Commons committee stage in early 2026 and is heading for Report stage as of the May 2026 DSIT newsletter.
- It amends the Network and Information Systems Regulations 2018 rather than replacing them, widening scope and strengthening obligations.
- Expanded scope reportedly includes medium and large managed service providers, data centres above size thresholds, large-scale electricity load controllers (300MW or more), and "critical suppliers" whose compromise could cause serious disruption.
- Incident reporting tightens to notification within 24 hours of a qualifying incident, with a full report within 72 hours, stricter than the current 72-hour NIS Regulations baseline.
- Penalties rise substantially: up to GBP 10m or 2% of worldwide turnover for less serious breaches, up to GBP 17m or 4% for serious breaches, plus daily fines up to GBP 100,000 for continuing violations.
- Supply chain duties (contractual requirements, security checks, continuity plans) are expected via secondary legislation; a National Cyber Action Plan is due over summer 2026.
What the Bill changes
The Bill's core move is to broaden the regulated population. Under the 2018 regulations, oversight focused on operators of essential services and a limited set of digital service providers. The Bill, as reported through its committee stage, extends coverage to several categories that the 2018 regime largely missed.
Medium and large managed service providers come into scope, reflecting the recognition that an MSP compromise is a supply chain compromise affecting every downstream client. Data centres above certain size thresholds are brought in as critical national infrastructure in their own right. Large-scale electricity load controllers, reported at 300MW or more, are added in response to the grid-balancing role such systems now play. And the Bill introduces a category of "critical suppliers," entities whose compromised systems could cause serious disruption to a regulated operator, allowing regulators to designate suppliers into scope even where they would not otherwise qualify.
That last category is the one software vendors should watch most closely. A critical-supplier designation is a route by which a vendor that sells into regulated operators can itself become subject to obligations, on the basis of the disruption its compromise could cause rather than its own sector classification. It is the UK's mechanism for pushing security expectations down the supply chain, analogous to how NIS2 reaches suppliers through Article 21.
The 24-hour clock
The incident reporting change is the most operationally demanding. As reported, the Bill requires regulated entities to notify the regulator within 24 hours of a cyber incident that is having, or is capable of having, an actual adverse effect on the operation or security of network and information systems, with a full report due within 72 hours. This is stricter than the current NIS Regulations, which work to a 72-hour reporting expectation, and it aligns the initial notification with the fastest tier of EU practice.
The phrase "capable of having an actual adverse effect" is worth dwelling on. It means the clock can start before harm is confirmed, on the basis of an incident's potential. For security operations, that lowers the threshold for what triggers a notification and compresses the time available to assess scope. An organization cannot wait until it has fully characterized an incident before the 24-hour obligation bites; it must be able to make a defensible early notification and then refine it in the 72-hour report.
For supply-chain-originated incidents specifically, the 24-hour clock is hard precisely because attribution is slow. When the triggering event is a compromised dependency or a vendor breach, determining whether your systems are affected, and to what degree, can take longer than 24 hours unless you already know what you run and where. The reporting timeline, in effect, is a forcing function for inventory: you cannot scope a supply chain incident on a 24-hour clock that you cannot scope at all without first knowing your component exposure.
The penalty regime
The Bill raises the financial stakes considerably over the 2018 regulations. Reported figures put the ceilings at up to GBP 10 million or 2% of worldwide turnover for less serious breaches, and up to GBP 17 million or 4% of worldwide turnover for serious breaches, with daily fines of up to GBP 100,000 for continuing violations. The turnover-linked alternatives mirror the structure that makes GDPR and NIS2 penalties meaningful for large organizations, and the daily-fine mechanism is aimed at sustained non-compliance rather than one-off failures.
The supply chain obligations to expect
Much of the supply chain detail is expected to arrive through secondary legislation rather than the primary Bill, but the direction is clear from the reported framing. Regulated entities will likely be required to implement contractual requirements, security checks, or continuity plans addressing supply chain cyber risk. In practice that translates into obligations to know your suppliers' security posture, to verify it rather than assume it, and to plan for the disruption a supplier compromise would cause.
The following is an illustrative mapping, not a configuration, of the reported obligations to the evidence a regulator would plausibly seek.
# Illustrative CSR Bill readiness map — not a configuration
Scope determination -> assessment of whether you are an operator, MSP,
data centre, load controller, or designated critical supplier
24h incident reporting -> declaration criteria, on-call notification path,
early-warning template, supporting detection records
72h full report -> scope assessment tied to component/asset inventory
Supply chain duty -> supplier security checks (verified, not asserted),
(via secondary leg.) contractual security requirements, continuity plans
Asset/component view -> SBOMs and inventory enabling fast incident scoping
Penalty exposure -> evidence that controls operated, to mitigate severity
The recurring requirement under almost every row is the ability to know what you run and what it depends on, fast enough to act on a 24-hour clock. That capability is the same one the supply chain duty will demand, which means the two obligations reinforce each other: an inventory built for incident scoping is also the inventory supplier oversight operates on.
What to do Monday morning
- Determine your likely scope. Assess whether you fall in as an operator, an MSP, a data centre, a load controller, or are exposed to a critical-supplier designation. The critical-supplier route is the one vendors most often overlook.
- Build incident-notification readiness for the 24-hour clock. Define what triggers a notification under the "capable of having an actual adverse effect" standard, who declares it, and how the early warning is filed. Rehearse it.
- Generate component inventories now. SBOMs for the systems in scope are what let you scope a supply-chain incident inside the reporting window. This is the highest-leverage technical preparation.
- Move supplier assurance from assertion to verification. Where you rely on supplier security questionnaires, plan to back them with verifiable evidence, because the expected supply chain duty leans toward checks rather than claims.
- Draft continuity plans for critical supplier failure. Identify the suppliers whose compromise would cause serious disruption and document how you would continue operating.
- Track the secondary legislation and the National Cyber Action Plan. The supply chain specifics will land there; build the inventory and reporting muscle now so the specifics are a configuration exercise rather than a standing start.
Why this keeps happening
The UK, the EU, and the US are converging on the same conclusion from different legislative starting points: the regulated perimeter of critical services is no longer the operator alone but the supply chain that feeds it. The 2018 NIS Regulations, like the original NIS Directive, drew the boundary too tightly around named operators and left the MSPs, data centres, and suppliers that those operators depend on largely outside the regime. Every major incident since then, from MSP-borne ransomware to dependency compromises, has demonstrated that the boundary was in the wrong place. The Bill, like NIS2 and the EU Cyber Resilience Act, is an attempt to redraw it around the actual attack surface.
The structural difficulty is that pushing obligations down the supply chain only works if the obligations are evidence-based. A contractual requirement that a critical supplier be secure is worth little if the regulated entity cannot verify it and the supplier cannot demonstrate it. The regimes that succeed will be the ones where supply chain security is expressed as artifacts, inventories, signed provenance, verified findings, that move between parties, rather than as attestations that cannot be checked. The Bill's eventual secondary legislation will determine how far the UK pushes toward verification, and organizations that can already produce the evidence will adapt fastest.
The structural fix
The capability the Bill rewards is fast, accurate knowledge of what you run and what it depends on, applied to both incident scoping and supplier oversight. Safeguard's SBOM generation and SBOM Studio produce the component inventory that makes 24-hour incident scoping feasible, and the third-party risk management view turns supplier assurance from a questionnaire into a verifiable, continuously-updated risk record. Policy as code lets the controls be expressed once and enforced consistently as the secondary legislation lands, and the supply chain compliance workflows keep the evidence current rather than point-in-time.
This does not satisfy the Bill on its own; scope determination, notification governance, and continuity planning are organizational obligations. What it does is shorten the time to scope a supply-chain incident under the 24-hour clock and provide the verified supplier evidence the expected supply chain duty will require, rather than assertions a regulator can discount.
What we know we don't know
The Bill remains in passage as of May 2026, and the figures cited here, the scope categories, the 300MW load-controller threshold, the 24/72-hour timeline, and the penalty ceilings, are drawn from reporting on the Bill as it stood through committee stage and may change at Report stage or in the Lords. The supply chain obligations in particular are expected to be set largely in secondary legislation that does not yet exist, so the specific checks, contractual requirements, and continuity expectations are directional rather than final. The timing of Royal Assent and the phased implementation, which reporting suggests may not complete until 2028, are also not fixed. Organizations should prepare against the Bill's reported direction while treating the precise obligations as subject to amendment, and should watch the summer 2026 National Cyber Action Plan for the supply chain specifics.
References
- Cyber Security and Resilience (Network and Information Systems) Bill — UK Parliament bill page
- DSIT cyber security newsletter, May 2026 — GOV.UK
- Cyber Security and Resilience Bill progresses through Parliament — Macfarlanes
- Cyber Security and Resilience (NIS) Bill 2024-26 — House of Commons Library
- UK Cyber Security and Resilience Bill: key considerations for technology businesses — Taylor Wessing
Internal reading: