NIS2 and the UK: the Cyber Security and Resilience Bill explained

NIS2 is the EU directive that sets a common framework for cyber security in 18 critical sectors. It is a directive for EU Member States, so the UK is not one of the countries that had to transpose it. The UK's equivalent is the Network and Information Systems (NIS) Regulations 2018, and the government is updating them through the Cyber Security and Resilience (Network and Information Systems) Bill. This guide covers what NIS2 does, what the UK Bill changes, and where the Bill stands as of October 2026.

Does NIS2 apply to the UK?

NIS2, Directive 2022/2555, replaced the original NIS Directive. The European Commission says Member States had until 17 October 2024 to transpose it into national law. It covers 18 critical sectors across the EU, and as a rule, medium-sized and large entities in those sectors must take appropriate cyber security risk-management measures and notify national authorities of significant incidents. It also makes top management accountable for non-compliance.

The UK government describes the NIS Regulations 2018 as the UK's only cross-sector cyber legislation.

On 20 January 2026, the Commission proposed targeted amendments to NIS2 to simplify compliance, which it says will ease compliance for 28,700 companies, including 6,200 micro and small enterprises.

What the UK NIS Regulations cover today

The government's summary says the NIS Regulations apply to operators of essential services and some digital services. These organisations must take appropriate and proportionate security measures for their network and information systems, and report incidents that significantly disrupt their services to their regulator, known as the competent authority. Twelve regulators oversee their own sectors.

The government says two post-implementation reviews, in 2020 and 2022, found the regulations were raising standards but needed updating to keep pace with threats and new technology.

Where the Bill stands

According to UK Parliament records:

• November 2025: first reading in the House of Commons
• January 2026: second reading in the Commons
• February 2026: Commons committee stage
• May 2026: reintroduced in the new parliamentary session
• June 2026: report stage and third reading in the Commons, then first reading in the House of Lords
• October 2026: Lords report stage

The Bill is not yet law. The government's factsheets say the incident reporting, enforcement and managed service provider measures will each be brought into force through secondary legislation after Royal Assent.

What the Bill changes: scope

The government describes three pillars of reform. The first expands scope:

• Data centres. Data centres will be classed as essential services and data infrastructure as a NIS sector. Medium and large data centres and enterprise data centres meeting the thresholds will need appropriate and proportionate risk measures, with Ofcom as regulator.
• Managed service providers. Medium and large managed service providers come into scope, with the Information Commission as regulator.
• Large load controllers. Load controllers manage electrical load for smart appliances, such as electric vehicle charging. Large ones come into scope.
• Designated critical suppliers. Regulators will be able to designate the most important suppliers to essential and digital services, so they are subject to the regime.

Managed service providers: who is in scope

The Bill defines a relevant managed service provider as a person who provides managed services in the UK, whether or not they are established in the UK, and is not a small or micro enterprise. The government gives examples of managed services, including IT outsourcing such as remote support, helpdesks and application management, and managed security services such as a security operations centre.

Providers of operational technology are not in scope of this measure. Small and micro managed service providers are exempt from it, but can still be designated as critical suppliers if they meet the conditions. Once the regulations commence, a relevant managed service provider will have three months to register with the Information Commission.

What the Bill changes: incident reporting

Under the current regime, regulators only hear about incidents once they have caused significant disruption, and notification is due within 72 hours of becoming aware of the breach. The government says attacks such as ransomware, pre-positioning and spyware do not currently have to be reported if they have not yet disrupted the service.

The Bill introduces a two-stage process:

1. Within 24 hours of becoming aware that an incident is taking place, a light-touch notification to the regulator, with the NCSC informed at the same time. It only needs the entity's name, the service affected and brief details.
2. Within 72 hours, a fuller report containing more detail, insofar as it is known.

More harmful incidents, such as ransomware and pre-positioning attacks likely to have a significant impact in the UK, will need reporting even before they cause disruption. Data centres, relevant managed service providers and relevant digital service providers will also have to tell customers who are likely to have been affected, once they have provided a full notification to their regulator. The government intends to set thresholds for when an incident counts as significant in secondary legislation, following consultation.

What the Bill changes: enforcement

The current maximum penalty under the NIS Regulations is £17 million, which the government says can be less than the cost of compliance for larger organisations. The Bill replaces the three-band penalty structure with two bands set out in law, with breaches of incident notification and security duties in the higher band. It introduces new maximum penalties for the two bands, linked to turnover, with the definition of turnover to be set in secondary legislation after public consultation.

Regulators will have to consider factors such as attempts to mitigate a breach and any history of non-compliance, and penalties can be appealed to the First-tier Tribunal.

Critical suppliers

The government points to a June 2024 cyber attack on a supplier of pathology services to the NHS, which it says caused over 11,000 postponed appointments and procedures, as an example of why suppliers matter. Much like the critical third parties regime in financial services, regulators will be able to designate critical suppliers, so the most important suppliers to essential and digital services are subject to the regime.

What to do now

In our view, these steps make sense while the secondary legislation is written:

1. Work out whether you could be in scope, as a managed service provider, data centre, digital service provider or key supplier to one.
2. Build a 24-hour first notification into your incident plan, including who decides an incident is reportable and who contacts the regulator.
3. Know which customers you would have to tell, if you are a data centre or service provider.
4. Get the basics certified. Our guide to Cyber Essentials and Cyber Essentials Plus explains the options.
5. Rehearse it. Our guide to how often to test disaster recovery plans covers exercises, and our guide to whether to pay a ransomware demand covers the wider question of ransomware.

We will update this guide as the Bill progresses.

Frequently asked questions

Does NIS2 apply in the UK?

NIS2 is an EU directive that EU Member States had to transpose into national law by 17 October 2024. The UK's own cross-sector cyber legislation is the NIS Regulations 2018, which the Cyber Security and Resilience Bill will reform.

Is the Cyber Security and Resilience Bill law yet?

Not as of October 2026. It was introduced in November 2025, passed its third reading in the Commons in June 2026, and has reached report stage in the House of Lords. Its incident reporting, enforcement and managed service provider measures will then be brought into force through secondary legislation.

Will managed service providers be regulated?

Yes, under the Bill. Medium and large managed service providers that meet the definition of a relevant managed service provider will have to take appropriate and proportionate security measures and report significant incidents, with the Information Commission as regulator.

What are the new incident reporting deadlines?

The Bill introduces a light-touch initial notification within 24 hours of becoming aware of an incident and a fuller report within 72 hours, with the NCSC informed at the same time as the regulator.

What is the maximum fine under the UK NIS Regulations?

Currently £17 million. The Bill replaces the three-band structure with two bands and new maximum penalties, with the definition of turnover to be set in secondary legislation after consultation.