What the Cyber Security and Resilience Bill means for your business

By Carl Pugh · Published 30 October 2026 · 3 minute read

A new UK law is about to change who has to protect their systems and report cyber attacks. Most small businesses won't be regulated by it directly. Many will still feel it.

Check if it applies to you

What the Bill is

The Cyber Security and Resilience Bill updates the NIS Regulations 2018, the rules for organisations that run essential services. In October 2026 it is in its final stages in the House of Lords, with Royal Assent expected around the end of the year. A lot of the detail will follow in regulations and codes of practice.

Who it covers

• Managed service providers. If your business manages IT for other organisations, you're covered for the first time, unless you're a micro or small business.
• Data centres and digital services. Data centres come in, and the rules for cloud and online platforms are extended.
• Essential services. Energy, transport, water, health and digital infrastructure organisations get tighter rules.
• Critical suppliers. A regulator can name a supplier as critical if an attack on it could cause serious disruption, whatever its size.

What it asks of them

Manage cyber risks in a way that fits the size of the risk. Report a serious incident to the regulator within 24 hours, with a full report within 72. Tell customers who are likely to be affected. The biggest fines go up to £17 million or 4% of worldwide turnover.

Why smaller businesses will feel it

The organisations the Bill regulates have to check the risks in their supply chain. If you supply them, that means you. Expect security questionnaires, new clauses in contracts and requests for Cyber Essentials or Cyber Essentials Plus.

What to do now

Find out where you stand. My free Cyber Bill readiness check takes about four minutes, tells you whether the Bill is likely to apply to you, and gives you a checklist of what to do next. Your answers stay on your device.

Based on the Cyber Security and Resilience (Network and Information Systems) Bill as amended in the House of Lords Grand Committee (HL Bill 49). This isn't legal advice, and the details may change before the Bill becomes law.