On Monday 26 October the House of Lords began the report stage of the Cyber Security and Resilience (Network and Information Systems) Bill. It is another chance for amendments after second reading on 14 July and committee stage on 1–3 September.
The bill is intended to strengthen the protection of companies and institutions providing essential services, including in healthcare, water and energy. It also extends the rules to new sectors and changes incident reporting requirements. The government gains powers to issue directions to such organisations on national security grounds.
According to the government’s summary, the new duties will cover, among others, medium and large data centres (regulated by Ofcom), medium and large managed service providers, such as IT helpdesks and cyber security firms (regulated by the Information Commission), and companies controlling large electricity loads, such as electric vehicle charging. Regulators will also be able to designate “critical suppliers”.
An initial notification of a serious incident must reach the regulator within 24 hours, with a full report within 72 hours. The NCSC will be informed at the same time. Data centres, digital service providers and IT firms will have to notify customers likely to be affected by an incident. These duties will only take effect through secondary legislation. Maximum penalties are set to rise, approaching the levels known from data protection law. The government estimates the bill’s cost at less than £150m a year.
On Monday peers tabled amendments on, among other things, reporting incidents involving the most advanced AI models, voluntary reporting of threats and “near misses”, and a duty for large companies to report resilience plans.
What it means for you
Most small Polish businesses in the UK will not be directly covered by the bill. They will feel it indirectly, though: IT, hosting and cloud providers will get new duties and will more often ask customers about security. You will also find out sooner if your provider is attacked. Polish owners of IT firms serving other businesses should check whether they will exceed the “medium-sized” thresholds.
Our assessment
The bill has government backing and is at its final stage in the Lords, so it will most likely become law. The key details – thresholds, deadlines and penalties – will appear in secondary legislation. Small IT providers have some time, but should not waste it.
What to do
- Ask your IT provider how it will inform you about incidents.
- Prepare a simple attack response plan: who calls whom, and within how many hours.
- Check the free guides for small businesses on the NCSCwebsite.
- Read the government summary of the bill.
Source: UK Parliament (23.10.2026); GOV.UK – bill summary.
We assess factual corrections and substantive responses. Verified changes are reflected in our reporting.
Contact the editorial desk →
