UK Cyber Security and Resilience Bill

Bill — not yet law United Kingdom

Introduced but not enacted. It can be amended beyond recognition or die on the order paper, and nothing in it binds anyone today. Catalogued because the obligations it proposes are the ones worth building toward.

The Cyber Security and Resilience Bill is in this catalog as a placeholder with a purpose. The UK inherited the NIS Regulations 2018 from the EU, the EU replaced its own version with NIS2, and the UK has not yet replaced its. The result is a widening gap that matters commercially: a managed service provider selling into both markets is regulated in the EU and largely not regulated in the UK, for the same service.

What the Bill is expected to do:

• Bring managed service providers into scope - The largest single extension, and a direct parallel to NIS2. An MSP holding privileged access to a regulated entity’s systems becomes regulated itself, rather than being a supply-chain risk somebody else has to manage.
• Reach data centres - Treated as critical infrastructure in their own right.
• Strengthen incident reporting - Faster initial notification, and reporting that captures incidents affecting customers rather than only the regulated entity.
• Give regulators cost-recovery and stronger enforcement - The chronic weakness of the 2018 regime was that sector regulators had duties without resources.
• Allow the scope to be updated without primary legislation - Which is how you avoid being eight years behind the next time.

I want to be precise about status, because this is exactly the kind of entry that gets cited as though it were law. It is not. It has not been enacted, its provisions can change substantially in passage, and nothing in the description above creates an obligation on anyone today. What binds in the UK right now is the NIS Regulations 2018 as they stand, plus whatever sector-specific regime applies.

The reason to carry the entry anyway is planning. Every company I talk to that sells infrastructure into Europe has already done NIS2 work — supply-chain security requirements, incident reporting timelines, management accountability. The Bill, if it passes in anything like its announced form, asks for the same things. The marginal cost of treating the EU work as the baseline for both jurisdictions is close to zero; the cost of treating the UK as out-of-scope and then discovering otherwise on a twelve-month implementation clock is not.

There is a pattern here worth naming across this whole catalog. The UK’s post-Brexit divergence has been real but asymmetric: it has diverged quickly and substantively on data protection, where it wanted to move, and slowly or not at all on cybersecurity and product security, where it mostly wants what the EU wants but has to find parliamentary time to say so. Betting on divergence has been a losing bet outside of data protection.