Cyber Security and Resilience Bill: where it stands now

The Cyber Security and Resilience Bill has cleared another hurdle. On 26 October, the House of Lords completed report stage, having debated how far new cyber security duties should reach across essential services, managed service providers (MSPs) and smaller technology suppliers². Lords third reading is listed for today (Monday 2 November¹).

This post covers how it got here, what peers decided last week and what MSPs can sensibly do while the detail is still being settled.

Where the Cyber Security and Resilience Bill stands

After third reading, the two Houses must agree the final text before Royal Assent. The Bill is not yet law.

How the Cyber Security and Resilience Bill got here

The Bill was introduced just under a year ago, and the route since has been long enough to need a table.

Parliament lists the Bill across two parliamentary sessions, 2024-26 and 2026-27, following a carry-over motion in January 2026¹.

What the Bill sets out to do

The Bill amends the Network and Information Systems (NIS) Regulations 2018 and extends to the whole of the UK⁴. It aims to improve protection for essential services and the technology suppliers they rely on, and it covers cyber incident reporting, regulatory oversight and powers to respond to national security risks⁵.

Lords report stage: the votes that mattered

Peers held three votes at report stage. They agreed two amendments and rejected a third². According to VinciWorks’ summary of the debate, both successful amendments went against the Government’s position⁶.

A review of the NIS regime passed by 202 votes to 155. It requires the Government to review the regime’s effectiveness within 12 months, and VinciWorks reports that it also provides for annual reviews and asks whether more sectors, or new powers for the AI Security Institute, are needed^{2, 6}. The Government had offered a narrower review instead⁶.
A register of foreign powers posing cyber security threats passed by 194 votes to 155. Ministers argued that a country-based register could create false certainty⁶.
A proposal for developers of frontier AI models to report incidents affecting critical systems was rejected by 165 votes to 95⁶.

The Commons must now consider the Lords’ changes, and VinciWorks expects the review and the register to become points of contention between the two Houses⁶.

MSPs and the question of scope

Peers questioned whether routine consultancy, training or helpdesk work might be caught by an overly broad definition. Ministers indicated that the focus should be services whose access to customer systems creates significant risks. An amendment proposing explicit exclusions was withdrawn³.

Smaller suppliers received attention too. The case made in the debate was that company size alone is not a reliable measure of cyber risk. The Government outlined plans to bring certain small MSPs and digital providers into scope where their services justify it, and the detailed approach is still subject to consultation³.

Incident reporting and accountability

The Lords discussed board oversight, professional competence and how to report significant incidents without overwhelming regulators with low-value notifications³.

VinciWorks reports that the Government accepted the original definition of a reportable incident was too broad. The amended Bill narrows it to incidents that have actually affected the operation or security of network and information systems. Mandatory near-miss reporting for data centre operators was dropped in favour of a voluntary framework, and further amendments strengthen the duty on data centres, digital service providers and MSPs to keep affected customers updated after a reportable incident⁶. The final obligations remain to be settled.

AI and the Bill

Artificial intelligence featured heavily in the debate, reflecting concern about increasingly capable AI systems that can act without direct human oversight. An AI agent might access a system, move data or change settings on someone’s behalf. Peers asked what should happen if an agent acts beyond its instructions and disrupts an essential service.

The Lords agreed Amendment 70, allowing ministers to introduce investigatory powers through future regulations³. The Government also plans to consult on safeguards, preserving evidence of AI incidents and warning other affected organisations³.

A separate proposal to make developers of powerful AI models report serious incidents was rejected by 165 votes to 95⁶. Ministers argued that this Bill should focus on protecting essential services using AI, while wider regulation of model developers should be considered separately³.

What is decided and what remains open

Decided

The Lords completed report stage on 26 October².
The Lords agreed amendments requiring a review of the NIS regime and a register of state actors posing cyber security threats².
The Lords agreed Amendment 70 on investigatory powers linked to AI³.

Still open

The outcome of Lords third reading, listed for 2 November¹.
The Commons’ response to the Lords’ changes⁶.
The final wording agreed by both Houses.
Detailed rules for smaller suppliers and incident reporting.
Implementation dates and transition arrangements.

Practical foundations for MSPs while the detail is settled

For MSPs and other technology suppliers, the questions that matter are specific. Do you manage customer systems, hold privileged administrative access or support essential services? The answers could affect whether a provider is brought within scope.

In the meantime, the practical foundations stay relevant: keep software updated, protect accounts with multi-factor authentication, restrict administrative privileges and prepare for incidents. Cyber Essentials provides a useful baseline for these controls, although certification alone does not demonstrate compliance with the proposed regime.

Frequently asked questions about the Cyber Security and Resilience Bill

Is the Cyber Security and Resilience Bill law yet?

No. The Bill is still moving through Parliament. The Lords completed report stage on 26 October and third reading is listed for 2 November. Both Houses must agree the final text before Royal Assent.

What happens after Lords third reading?

The Commons considers the changes made by the Lords. The two Houses must then agree the final text before the Bill can receive Royal Assent.

Will managed service providers be covered by the Bill?

That depends on the final scope. Ministers indicated that the focus should be services whose access to customer systems creates significant risks, and the detailed approach for smaller providers is still subject to consultation.

Does Cyber Essentials certification satisfy the Cyber Security and Resilience Bill?

Cyber Essentials provides a useful baseline for controls such as software updates, multi-factor authentication and restricted administrative privileges. Certification alone does not demonstrate compliance with the proposed regime.

Following the Bill through its final stages

The next milestone is Lords third reading on Monday 2 November. Further consultation and regulations will then determine the practical duties and timetable for affected businesses. Follow CyberSmart on LinkedIn for updates as the Bill moves back to the Commons.