Cyber Security and Resilience Bill tracker

The Cyber Security and Resilience (Network and Information Systems) Bill is the UK's update to the NIS Regulations 2018, the nearest UK equivalent to the EU's NIS2. This page follows it through Parliament. We check the UK Parliament bills record every day and update the stages below when the Bill moves.

Stages last changed on 28 October 2026. Checked daily against the UK Parliament record of the Bill.

What happens next

After third reading in the Lords, any changes the Lords made go back to the Commons, which can accept them or send the Bill back with its own changes. The Lords amended the Bill at report stage, so that step is expected. When both Houses agree the text, the Bill receives Royal Assent and becomes an Act. The government's factsheets say the incident reporting, enforcement and managed service provider measures will then be brought into force through secondary legislation.

Every stage so far

Procedural motions (programme, money and carry-over motions) are left out. "Bill reintroduced" is the carry-over into the new session of Parliament in May 2026.

Latest documents

• 26 October 2026: HL Bill 62 (as amended on Report) (Bill)
• 22 October 2026: HL Bill 49-I Marshalled list for Report (Amendment Paper)
• 22 October 2026: Letter from Lord Strathclyde, Chair of the Constitution Committee to Baroness Lloyd of Effra, Parliamentary Under-Secretary of State for Space, Cyber and Regulatory Reform responding to the Minister's letter regarding the Cyber Security and Resilience (Network and Information Systems) Bill (Select Committee report)
• 21 October 2026: Legislative Consent Motion approved by the Senedd on 20 October 2026 (Legislative Consent Motions-devolved legislatures)
• 21 October 2026: HL Bill 49 Running list of amendments – 21 October 2026 (Amendment Paper)
• 20 October 2026: HL Bill 49 Running list of amendments – 20 October 2026 (Amendment Paper)

All amendments, reports and versions of the Bill are on the Bill's publications page.

Consent from the devolved legislatures

• Legislative Consent Motion agreed to by the Scottish Parliament on 7 October 2026
• Legislative Consent Motion agreed to by the Northern Ireland Assembly on 19 October 2026
• Legislative Consent Motion approved by the Senedd on 20 October 2026

What the Bill does

• It reforms the NIS Regulations 2018, the UK's cross-sector cyber security law.
• Medium and large managed service providers, data centres and large load controllers come into scope, and regulators can designate critical suppliers.
• Regulated organisations send a first notification within 24 hours of becoming aware of an incident and a full report within 72 hours, with the NCSC informed at the same time.
• The incident reporting, enforcement and managed service provider measures are brought into force through secondary legislation after Royal Assent.

Our guide to NIS2 and the UK: the Cyber Security and Resilience Bill explained covers each change, who is in scope and what to do now, and our UK cyber security compliance guide for IT teams puts it alongside Cyber Essentials, UK GDPR and DORA.

Frequently asked questions

Is the Cyber Security and Resilience Bill law yet?

No. The Bill is at third reading in the House of Lords. It is scheduled for 2 November 2026. It becomes law at Royal Assent, once both Houses have agreed the text.

Is this the UK version of NIS2?

NIS2 is EU law and does not apply in the UK. The UK's own cross-sector cyber law is the NIS Regulations 2018, and this Bill reforms them. Our explainer sets out how the two compare.

Sources

• UK Parliament, Cyber Security and Resilience (Network and Information Systems) Bill: stages
• UK Parliament, the Bill's publications
• GOV.UK, Bill factsheet: summary of the Bill
• GOV.UK, Bill factsheet: incident reporting

Stage data comes from the UK Parliament bills API and contains Parliamentary information licensed under the Open Parliament Licence v3.0.