The House of Lords completed its work on the Cyber Security and Resilience (Network and Information Systems) Bill on 2 November 2026, when peers gave it a third reading. The Bill, which updates the UK’s NIS Regulations 2018, now returns to the House of Commons to consider the changes made in the Lords.
Key points
- Peers agreed four government amendments at third reading, mostly tidying changes, such as referring to “data centre services” rather than “data centres” throughout the Bill.
- The Bill goes back to MPs carrying the amendments made at report stage on 26 October, including two the government lost: a review of the NIS regime and a register of foreign powers.
- The government has said it will use the Bill’s powers to change the NIS rules through secondary legislation to address the risk of losing control of AI agents, after consultation and with Parliament’s approval. Reports say a clause on agentic AI was added at third reading.
- MPs must now accept, reject, or change the Lords amendments before the Bill can receive Royal Assent.
The Bill will bring more organisations into scope, including managed service providers and data centre services, and introduce stricter incident reporting. Organisations that could be covered, and their suppliers, should keep planning for registration, faster incident reporting, and closer supply chain checks, while watching for the final text and the secondary legislation that will follow.
Source: UK Parliament: Lords completes examination of Cyber Security and Resilience Bill
This update is general information, not legal advice. If you would like help assessing the impact on your information security or privacy programme, contact us.
