AV Resilience Consulting | 12 October 2026
Scope first: which sectors and businesses would need to comply?
Once its relevant provisions and implementing regulations take effect, the Cyber Security and Resilience (Network and Information Systems) Bill would update duties for organisations already covered by the NIS Regulations 2018 and bring additional categories into scope. Existing NIS duties continue in the meantime.
Existing coverage includes qualifying operators of essential services in energy, transport, health, drinking water and digital infrastructure, alongside relevant digital service providers such as cloud computing services, online marketplaces and online search engines. Coverage depends on the service definitions, thresholds and exemptions, not simply the sector a business operates in.
The proposed new categories are:
- UK data centres with at least 1 MW of rated IT load, or at least 10 MW for enterprise data centres serving only their own undertaking. Ofcom would regulate the new data-infrastructure category.
- Relevant medium and large managed service providers providing ongoing contractual IT management or cyber-security services with access to customers' systems. Overseas providers serving the UK can be covered. The Information Commission, commonly known as the ICO, would regulate them.
- Large load controllers with potential electrical control of at least 300 MW across relevant energy-smart appliances. This is controllable electrical load, not a business's ordinary electricity consumption.
- Critical suppliers designated by regulators where disruption to their systems could have significant consequences for essential, digital or managed services and the UK economy or day-to-day society. Designation would follow statutory criteria; it is not automatic for every supplier.
Who would not automatically be covered?
The Bill would not impose the same duties on every UK business, every IT consultancy or every supplier. It would not bring all financial-services companies, pharmaceutical businesses or AI developers into NIS merely because they operate in those sectors.
Small and micro managed service providers are generally excluded from the direct MSP category, but could potentially be designated critical suppliers. A company's precise service, size and group position need to be assessed against the legal definitions.
Businesses outside direct scope may still feel the effect through their data centres, cloud providers, managed services and other critical dependencies. The Bill sits alongside existing sector-specific regimes, including financial-services resilience regulation.
What is the Bill intended to do?
Its focus is the continuity and security of services that society and the economy depend on, including the infrastructure and suppliers behind them. It would expand the NIS regime, broaden incident reporting, strengthen enforcement and give government powers to update the framework and respond to national-security risks.
As at 12 October 2026, it is still before Parliament. The latest text is HL Bill 49, as amended in Grand Committee on 7 September. Lords Report stage is scheduled for 26 October, subject to changes in parliamentary business. The Bill is not yet an Act, and there is no verified general compliance start date.
Incident reporting and enforcement
Qualifying incidents would require an initial notification within 24 hours of awareness, followed by a full notification within 72 hours, to the relevant regulator and NCSC. These are reporting deadlines, not recovery targets.
The reporting tests would cover significant effects on system operation or security and likely impacts, rather than only service disruption already experienced. Data centres have a distinct test that also includes incidents which could have had significant impact. Relevant providers would need to identify and notify customers likely to have been adversely affected.
For undertakings, proposed maximum NIS penalties would be the greater of £10 million or 2% of worldwide turnover in the standard band, and £17 million or 4% in the higher band. These are ceilings for breaches, not automatic fines for suffering an attack. Severity, proportionality, mitigation and further turnover rules matter.
Where does AI fit?
The current Bill does not expressly add all AI products and services to the regulated categories. Nor does it create a general AI licensing regime or a standalone AI "kill switch" law.
Its approach is technology-neutral. If an essential service relies on AI within its systems, relevant risks still need to be managed. In the Lords debate on 1 September, the minister explained that national-security directions could require a regulated entity to cease using and isolate an AI model where the legal conditions are met.
Peers proposed wider AI controls, including explicit AI-service coverage. That amendment was withdrawn. Proposed amendments and government discussion must not be presented as duties already in the Bill.
Timeline and preparation
Introduced in November 2025, the Bill completed its Commons stages in June 2026 and was amended in Lords committee in September. The next scheduled stage is Lords Report on 26 October.
After Royal Assent, commencement would be phased. Many operational duties would depend on secondary legislation, consultation, technical detail and an adjustment period. Businesses should monitor that process rather than treat a parliamentary date as their compliance deadline.
Preparation should begin with the services and dependencies: identify possible scope, review system and supplier risks, test recovery arrangements and rehearse incident assessment and notification.
At AV Resilience Consulting, we help organisations assess whether the Bill could cover their services or suppliers, map the dependencies that would become critical, and rehearse incident assessment and notification against the proposed 24-hour and 72-hour windows. Once duties take effect, we test whether the recovery and reporting evidence regulators would expect can actually be produced under pressure.
Discuss your priorities and how we work: https://www.avresilienceconsulting.com/how-it-works
Could your organisation identify a serious incident, assess its wider impact and notify the right people within 24 hours?
Primary sources
DSIT summary and implementation
