Tools / Regulatory tracker / Cyber Security and Resilience Bill
Regulatory tracker · United Kingdom · Cyber and resilience
Cyber Security and Resilience Bill
Brings data centres of 1 MW or more (10 MW for enterprise sites) under the NIS rules, with Ofcom as regulator.
Bill in Parliament House of Lords report stage held on 26 October 2026; Lords third reading is scheduled for 2 November 2026. Duties start by secondary legislation after Royal Assent.
What it does
The rule in brief
The Bill makes data centre services an essential service under the NIS Regulations 2018. Third-party data centres are in scope at a rated IT load of 1 MW or more, and enterprise data centres (run only for the owner's own IT) at 10 MW or more. Operators must notify Ofcom, put proportionate security and resilience measures in place and report significant incidents: an initial notice within 24 hours and a full report within 72 hours. Ofcom can direct interim measures and impose penalties, including daily fines. Managed service providers are brought in too, regulated by the Information Commission.
Timeline
Key dates
| Date | What happens |
|---|---|
| 12 November 2025 | Bill introduced |
| 26 October 2026 | Lords report stage |
| 2 November 2026 | Lords third reading (scheduled) (ahead) |
Found automatically
1 new official document since the last review
Found on the UK Parliament bill page; the summary above was last reviewed on 29 October 2026.
- Cyber Security and Resilience (Network and Information Systems) Bill: Lords 3rd reading UK Parliament New since last review
- Cyber Security and Resilience (Network and Information Systems) Bill: Lords report stage UK Parliament
Primary sources
Read it at source
- Cyber Security and Resilience (Network and Information Systems) Bill Parliament
- Bill factsheet: data centres Government
- Bill factsheet: incident reporting Government
Cite as: InfraCompute regulatory tracker, “Cyber Security and Resilience Bill”, checked 29 October 2026, https://www.infracompute.co.uk/tools/regulatory-tracker/uk-cyber-security-resilience-bill.
Related
Also on the tracker
National Security and Investment Act 2021
Mandatory approval before acquiring control of a UK entity in 17 sectors, including data infrastructure and computing hardware.
United Kingdom · Cyber and resilienceData centres designated critical national infrastructure
UK data centres were designated CNI in September 2024, alongside energy and water.
United Kingdom · Planning and permittingAI Growth Zones
Designated zones with grid connection priority, planning support and a proposed electricity cost discount.
United Kingdom · Grid and powerGrid connections for strategic demand
Proposals to clear speculative demand from the queue and prioritise capacity for data centres.
Method
Each entry is written from the official text and the government, regulator or legislature pages listed above, never from secondary commentary. New documents on the UK Parliament bill page are picked up automatically and listed here. Status and dates can change after the review date, so check the source before relying on it. General information drawn from public filings. It is not legal advice on any transaction, and using this page does not create a lawyer-client relationship. Views are personal.
