The House of Lords completed report stage of the Cyber Security and Resilience (Network and Information Systems) Bill on 26 October 2026. Peers voted to add two amendments to the Bill, defeating the government twice.
Key points
- Peers agreed an amendment requiring a review of the Network and Information Systems scheme within 12 months.
- Peers also agreed an amendment requiring a register of foreign state actors that threaten UK cyber security.
- Debate covered voluntary notification of incidents, cyber threats, and near misses, bringing service providers and software manufacturers into scope, and the designation of critical suppliers.
- The Bill now goes to third reading in the Lords, then back to the Commons, which must agree the final text before Royal Assent.
The Bill extends the UK’s NIS rules to managed service providers, data centres, and critical suppliers, with tighter incident reporting. Managed service providers, operators of essential services, and their key suppliers should keep preparing: map which of your services may fall in scope, check your incident reporting and supplier assurance arrangements, and watch for the final text.
Source: UK Parliament
This update is general information, not legal advice. If you would like help assessing the impact on your information security or privacy programme, contact us.
