Draft UK Cyber Security and Resilience Bill Enters UK Parliament

On 12 November 2025, the UK government introduced the draft Cyber Security and Resilience (Network and Information Systems) Bill to the UK Parliament, seeking to amend the Network and Information Systems Regulations 2018 in light of the EU NIS2 Directive. According to the UK government, the Bill is designed to mitigate the ever-increasing risk of cyber attacks targeting the UK’s essential services.

Key provisions include Broader Applicability, which would extend the NIS Regulations to cover more entities such as medium and large data centres; managed service providers providing IT management; large load controllers for smart appliances; and designated critical suppliers to operators of essential services. Organisations within the scope would be required to adhere to clear security standards, promptly report significant cyber incidents, and maintain robust contingency plans.

The Bill was originally announced in July 2024 and reflects an intent to harmonise UK cyber security rules with evolving European measures in the wake of rising digital threats.