The House of Lords is due to hold the third reading of the Cyber Security and Resilience (Network and Information Systems) Bill today, 2 November. It is the final stage in the upper house. The bill then returns to the House of Commons, which must consider the Lords’ amendments. For IT firms – including those run by Poles in the UK – the new obligations are getting closer.
What the bill changes
The bill updates the Network and Information Systems Regulations 2018, which until now have mainly covered operators of essential services such as energy, transport and water. The government introduced it in November 2025. It is led by the Department for Science, Innovation and Technology (DSIT).
The main changes, according to the government’s plans as described by law firm Pinsent Masons and Infosecurity Magazine:
- Managed service providers (MSPs) – medium and large firms that run IT and cyber security for other organisations will be regulated for the first time, by the Information Commissioner’s Office. Estimates at introduction put the number at around 900–1,100 firms.
- Data centres – to be treated as operators of essential services, overseen by DSIT and Ofgem.
- Critical suppliers – regulators will be able to designate firms on which critical services depend and impose minimum security standards on them.
- Incident reporting – in the original version: an initial notification within 24 hours, a full report within 72 hours, and a duty to inform affected customers.
- Penalties – tougher, turnover-based fines for serious breaches.
What the Lords changed
Report stage in the Lords ended on 26 October. The government lost two votes. Lord Birt’s amendment (202 to 155) requires a review of the legislation and the wider NIS regime within 12 months of Royal Assent and annually after that, considering cloud services and frontier AI among other things. A second amendment (194 to 155) requires the government to keep a register of foreign powers posing cyber threats to the UK.
Peers rejected (165 to 95) an amendment that would have required frontier AI developers to report unauthorised access. According to VinciWorks, which tracks the bill, the government also narrowed reportable incidents to those that actually harmed systems rather than those that could have, and dropped mandatory near-miss reporting for data centres.
What it means for Polish firms in the UK
The argument is simple: even a small Polish IT company will feel these rules, although the bill directly covers only medium and large businesses. The evidence? The bill introduces “critical suppliers” and duties towards customers. Large clients – NHS trusts, councils, energy firms – will pass requirements down to subcontractors through contracts.
In practice it is worth acting now:
- check whether your firm provides managed services (e.g. server administration, network monitoring, backups) and whether it is medium or large;
- prepare an incident response plan – who reports, to whom and how fast (24 hours is very little if nobody has a defined role);
- review client contracts for incident-reporting and audit clauses;
- consider Cyber Essentials certification (the NCSC-backed scheme), which many public-sector clients already require.
When the rules take effect
This is not yet law. After third reading in the Lords, the bill goes back to the Commons. The government can accept or reject the Lords’ amendments, so the dispute over reviews and the register of hostile states may continue. Many details – including exact size thresholds and deadlines – will be set later in secondary legislation and consultations. These are worth following, as they will decide whether a particular firm falls within scope.
Sources:
- UK Parliament – Cyber Security and Resilience (Network and Information Systems) Bill
- Hansard Society – Parliament Matters Bulletin, 2–4 November 2026
- VinciWorks – government defeats in the Lords (29.10.2026)
- Pinsent Masons Out-Law – scope of the bill
- Infosecurity Magazine – government introduces the bill
We assess factual corrections and substantive responses. Verified changes are reflected in our reporting.
Contact the editorial desk →
