Cyber security law
The UK Cyber Security and Resilience Bill: who it will cover and where it has got to
The UK's own update to its network and information systems rules. In October 2026 it is still a Bill, and this page says so throughout.
Checked against the published sources on 2 October 2026.
The short answer
The Cyber Security and Resilience (Network and Information Systems) Bill will widen the UK's existing rules to managed service providers, data centres and designated critical suppliers, and tighten incident reporting to 24 and 72 hours. At the time of writing in October 2026 it is before Parliament and is not yet law.
- Introduced
- November 2025
- House of Commons
- Passed June 2026
- House of Lords
- Report stage scheduled for 26 October 2026
- Status
- Not yet law
Who it will bring in
Managed service providers, data centres and suppliers designated as critical would come within the UK regime alongside the operators already covered. Much of the detail will follow in secondary legislation after Royal Assent, which has been expected in late 2026 or spring 2027.
What is worth doing now
The preparation is the same whichever regime turns out to apply. For each security measure, be able to point to a policy, an owner, something in place and a date it was last checked. Know who decides whether an incident is reportable, out of hours as well as in. And know which customers your contracts require you to tell.
This page explains what the rule says. It is not legal, regulatory, clinical or financial advice on your own position. Rules change, so read the sources listed beside it, and tell us at hello@wajd.co.uk if something here is out of date.
Learn it properly, free
This guide is the summary. The course teaches it in full, with a video conversation, worked scenarios and a knowledge check after each module. Every module is free to read with no account. A certificate, if you want one once you pass, is £9.
Cyber and AI regulation · 2.5 CPD hours
NIS2 and UK cyber resilience law: what your business has to do
Questions people ask
Is the Cyber Security and Resilience Bill law yet?
Not at the time of writing in October 2026. It passed the House of Commons in June 2026 and is in the House of Lords.
Who will the Bill apply to?
It widens the existing UK rules to managed service providers, data centres and designated critical suppliers.
Is the Bill the same as NIS2?
No. NIS2 is EU law. The Bill is the UK's own legislation, updating the UK's existing network and information systems rules.