The Cyber Security and Resilience (Network and Information Systems) Bill would give UK cyber regulators turnover-based fining powers on a scale comparable to UK data protection law. For serious breaches the maximum would be £17 million or 4% of worldwide turnover, whichever is higher. The Bill also widens who is regulated and shortens the time allowed to report an incident. Boards of organisations in scope, or close to it, can use the remaining parliamentary stages to test whether their governance and incident response would hold up under the new regime.
Where the Bill stands
The government introduced the Bill to the House of Commons on 12 November 2025. It amends and extends the Network and Information Systems Regulations 2018, the UK's existing regime for operators of essential services and certain digital service providers.
The Commons passed the Bill on 16 June 2026. The House of Lords completed its committee stage on 7 September 2026, and Lords report stage is scheduled for 26 October 2026. Legal commentators expect Royal Assent between late 2026 and early 2027. Much of the operational detail, including security requirements, incident reporting thresholds and implementation timelines, is to follow in secondary legislation after further consultation. The figures in this article reflect the Bill as introduced and as debated in committee, and remain subject to its final passage.
What the penalty regime changes
Under the 2018 Regulations the maximum penalty is a fixed £17 million. The Bill would replace this with two bands. For more serious breaches the maximum would be the higher of £17 million or 4% of worldwide turnover. For less serious breaches it would be the higher of £10 million or 2% of worldwide turnover.
The government set out its reasoning in Public Bill Committee in February 2026. A fixed £17 million ceiling can look disproportionate for a smaller organisation, while a larger one could absorb it as a cost of doing business.
The turnover element applies to larger groups, and a simple calculation shows where it takes effect. Four per cent exceeds £17 million once worldwide turnover passes £425 million, and two per cent exceeds £10 million once turnover passes £500 million. Below those levels the fixed amounts set the ceiling.
The structure closely resembles UK GDPR, where the higher maximum fine is £17.5 million or 4% of total worldwide annual turnover. Where a board has calibrated its oversight of data protection risk to that level of exposure, the same calibration can reasonably extend to the security and resilience of the services the organisation delivers.
Maximum penalties are ceilings, and the level of any fine would depend on the regulator's assessment of the breach. Two further changes bear on the likelihood of enforcement. During committee debate, enforcement under the existing Regulations was described as sparse and inconsistent. The Bill would also allow regulators to recover more of their costs from the organisations they regulate.
Who comes into scope
The Bill extends the regime to new categories of organisation. Data centres and large load controllers, which manage electricity demand from connected devices, would be treated as operators of essential services. Medium and large managed service providers that deliver managed services in the UK would be regulated directly. Commentators read this category to include outsourced IT support, help desk services and managed security services. Peers have tabled amendments at report stage to narrow the definition, so its final boundaries remain open.
Regulators would also gain a power to designate "critical suppliers". A supplier could be designated where disruption to it would have a significant impact on the economy or on the day-to-day functioning of society, and only after notice and consultation. The government's example is suppliers of healthcare diagnostics.
The practical consequence for boards is that an organisation can come into scope because of what it supplies to a regulated sector. An organisation that has never considered itself critical national infrastructure may need a position on whether it is a candidate for designation.
Faster incident reporting
The existing Regulations require reportable incidents to be notified within 72 hours. The Bill would require an initial notification to the regulator and the National Cyber Security Centre within 24 hours of becoming aware of a significant incident, followed by a fuller report within 72 hours. Data centres, digital service providers and managed service providers would also have to notify customers likely to be affected. The government has stated its intention that reportable incidents include ransomware attacks.
A 24-hour window tests the organisation's governance. Someone with the authority to decide whether an incident meets the reporting threshold has to be reachable at any hour, and has to make that decision on incomplete facts. Where escalation passes through several layers of management, the window can close before anyone with that authority has been told.
What leadership should require
The board should expect management to produce a provisional scope position, setting out whether the organisation is likely to fall into an existing or new category, or to be a candidate for critical supplier designation, and which regulator would oversee it. This position will need revisiting as secondary legislation is published. It is worth having now because the other preparations depend on it.
The board should also see evidence that incident response has been exercised against the 24-hour reporting window, with named decision owners and deputies, and a clear route to the regulator and the National Cyber Security Centre.
Supply chain exposure needs the same attention. A map of the suppliers that may themselves come into scope, and a review of whether contracts provide for incident notification, cooperation and audit, would show where the organisation depends on others to meet its own obligations.
Accountability at board level is likely to become more visible. Legal and industry commentators report that the government has committed to including board-level governance requirements in secondary legislation. Figures from the government's Cyber Security Breaches Survey, cited in Public Bill Committee, show that 27% of businesses had a board member responsible for cyber security in 2025, compared with 38% in 2021.
Questions for the board
- Have we taken a provisional view on whether we fall within scope of the Bill, and which regulator would oversee us?
- Could any of our services lead to designation as a critical supplier to a regulated sector?
- If a serious incident began at 2am on a Saturday, who would decide whether to notify the regulator within 24 hours, and when did we last test that?
- Which of our suppliers may themselves come into scope, and do our contracts require them to tell us promptly about incidents?
- How does our oversight of cyber resilience compare with our oversight of data protection, given the similar scale of maximum penalties?
- Which board member is accountable for cyber security, and how does the board receive assurance on it?
- What is our plan for responding to the government's consultations on secondary legislation?
Epitechnic's Regulatory Cyber Resilience practice assesses scope under the Bill, critical supplier exposure, governance and reporting readiness, and the organisational changes the Bill will require, ahead of the secondary legislation.
References
- UK Parliament, "Cyber Security and Resilience (Network and Information Systems) Bill", Bill page and stages, last updated 14 October 2026. https://bills.parliament.uk/bills/4035
- UK Parliament, "Cyber Security and Resilience (Network and Information Systems) Bill, running list of all amendments on report", 8 October 2026.
- Hansard, Public Bill Committee, "Cyber Security and Resilience (Network and Information Systems) Bill, Clause 21, Financial penalties", 10 February 2026.
- Mayer Brown, "Cyber Security and Resilience (Network and Information Systems) Bill introduced to Parliament", 18 November 2025.
- Bird & Bird, "Cyber Security and Resilience Bill: Strengthening the UK's Digital Defences", November 2025.
- Crowell & Moring, "The UK's Cyber Security & Resilience Bill At A Glance", 21 November 2025.
- Lexology, "UK Regulatory Outlook September 2026: Cyber security", September 2026.
- NCC Group, "Expert commentary: What the Cyber Security & Resilience Bill means for organisations today", 2026.
- Information Commissioner's Office, "The maximum amount of a fine under UK GDPR and DPA 2018", fining guidance.
- Department for Science, Innovation and Technology, "Cyber Security Breaches Survey 2025", as cited in Public Bill Committee, 10 February 2026.