The Cyber Security and Resilience Bill is approaching its final parliamentary stages, following a significant House of Lords debate that saw the Government defeated twice over the scope of the legislation. Ministers have also made concessions on incident reporting, although concerns remain about AI security, hostile foreign actors and the powers available to regulators.
On 26 October 2026, peers completed Report Stage of the Cyber Security and Resilience (Network and Information Systems) Bill, which seeks to strengthen the UK’s cyber security framework, expand the organisations covered by the Network and Information Systems (NIS) Regulations 2018 and introduce tougher incident reporting and enforcement requirements.
The debate saw numerous government amendments agreed, alongside two successful opposition and cross-party amendments that could reshape the legislation before it becomes law.
Government backs down on incident reporting
One of the most significant changes concerns how organisations will be required to report cyber incidents. The Government accepted criticism that the original definition of a reportable incident was too broad. Under the previous wording, incidents that could have had a significant adverse impact might have triggered mandatory reporting requirements.
Peers warned that this could overwhelm regulators and the National Cyber Security Centre (NCSC) with thousands of low-level incidents and attempted attacks. Liberal Democrat peer Lord Clement-Jones welcomed the concession, declaring that “Reporting is not resilience.”
The amended Bill narrows the definition to incidents that have actually adversely affected the operation or security of network and information systems. The Government also agreed to remove mandatory near-miss reporting for data centre operators, replacing it with a commitment to develop a voluntary reporting framework for regulated organisations.
Further government amendments strengthen requirements for data centre operators, digital service providers and managed service providers to keep affected customers updated following a reportable incident.
Lords defeat Government over future scope of cyber regulation
The Government suffered its first defeat when peers voted 202 to 155 in favour of Amendment 163, introduced by crossbench peer Lord Birt. The amendment would require the Government to review the effectiveness of the legislation and the wider NIS regime within 12 months of Royal Assent, followed by annual reviews.
Crucially, the review would examine whether additional sectors should be brought within scope, including cloud services, frontier AI, democratic processes, advanced manufacturing and other activities essential to the economy. It would also consider whether the AI Security Institute should receive statutory powers to audit, inspect or recommend restrictions on frontier AI systems.
The Government opposed the amendment, arguing that mandatory annual reviews could create regulatory uncertainty and distract from implementation. The Minister, Baroness Lloyd of Effra, instead offered a narrower review of critical national infrastructure sectors within 12 months, alongside a comprehensive post-implementation review within three years. Peers were unconvinced and voted to retain the broader requirement.
Second defeat over hostile foreign states
Peers also voted 194 to 155 in favour of Amendment 164, which would require the Government to establish and maintain a register of foreign powers presenting cyber security threats to the UK. The proposed register would draw on GCHQ intelligence concerning state-sponsored attacks on critical infrastructure, with the Government required to assess the risks and report its plans for addressing them.
The Minister opposed the measure, warning that a country-based register could create false certainty and that cyber security threats should be assessed individually rather than through a fixed list. Nevertheless, peers backed the amendment, adding a new statutory obligation that the Government may seek to reverse when the Bill returns to the Commons.
AI remains a major point of contention
Perhaps the sharpest criticism concerned the Bill’s treatment of artificial intelligence. Conservative peer Lord Holmes described the absence of comprehensive AI provisions as a “huge hole” in the legislation. Baroness Harding proposed Amendment 41, which would have required developers of frontier AI models to report incidents involving unauthorised access to or interference with critical systems.
The Government opposed the amendment, arguing that the Bill already covers significant AI-related incidents affecting regulated services and that reporting obligations should remain primarily with the regulated organisations.
Peers rejected the proposal by 165 votes to 95.
However, government amendments addressing incidents involving a loss of control of AI agents were accepted. Ministers also committed to consulting on further secondary legislation covering agentic AI risks, including technical safeguards, incident records and notifications to affected organisations.
With these new amendments, the Bill now explicitly addresses certain AI-related cyber risks, although it does not establish a comprehensive regulatory regime for frontier AI developers.
Further reforms to cyber security research promised
Another unresolved issue concerns the Computer Misuse Act 1990. Lord Clement-Jones and Lord Holmes called for greater legal protection for good-faith cyber security researchers, who can face criminal liability when investigating vulnerabilities.
The Government confirmed that the Home Office has developed proposals for a new defence under section 1 of the Act for accredited cyber security researchers undertaking specified activities.
However, ministers argued that these changes should be introduced through separate national security legislation, rather than the Cyber Security Bill. The proposed amendment was not put to a vote, leaving the reform dependent on future legislation.
What happens next?
The Cyber Security and Resilience Bill is scheduled for Third Reading in the House of Lords on 2 November 2026. Following that, the amended Bill will return to the Commons, where MPs must consider the changes made by the Lords. The two government defeats, particularly the mandatory annual review and foreign powers register, could become points of contention between the two Houses.
Even after Royal Assent, much of the new regime will depend on secondary legislation and regulatory consultations, particularly the detailed security requirements, reporting arrangements and scope of additional regulated services.
Download our guide: Preparing for the UK’s Cyber Security and Resilience Bill
The Cyber Security and Resilience Bill is approaching its final parliamentary stages, following a significant House of Lords debate that saw the Government defeated twice over the scope of the legislation. Ministers have also made concessions on incident reporting, although concerns remain about AI security, hostile foreign actors and the powers available to regulators.
On 26 October 2026, peers completed Report Stage of the Cyber Security and Resilience (Network and Information Systems) Bill, which seeks to strengthen the UK’s cyber security framework, expand the organisations covered by the Network and Information Systems (NIS) Regulations 2018 and introduce tougher incident reporting and enforcement requirements.
The debate saw numerous government amendments agreed, alongside two successful opposition and cross-party amendments that could reshape the legislation before it becomes law.
Government backs down on incident reporting
One of the most significant changes concerns how organisations will be required to report cyber incidents. The Government accepted criticism that the original definition of a reportable incident was too broad. Under the previous wording, incidents that could have had a significant adverse impact might have triggered mandatory reporting requirements.
Peers warned that this could overwhelm regulators and the National Cyber Security Centre (NCSC) with thousands of low-level incidents and attempted attacks. Liberal Democrat peer Lord Clement-Jones welcomed the concession, declaring that “Reporting is not resilience.”
The amended Bill narrows the definition to incidents that have actually adversely affected the operation or security of network and information systems. The Government also agreed to remove mandatory near-miss reporting for data centre operators, replacing it with a commitment to develop a voluntary reporting framework for regulated organisations.
Further government amendments strengthen requirements for data centre operators, digital service providers and managed service providers to keep affected customers updated following a reportable incident.
Lords defeat Government over future scope of cyber regulation
The Government suffered its first defeat when peers voted 202 to 155 in favour of Amendment 163, introduced by crossbench peer Lord Birt. The amendment would require the Government to review the effectiveness of the legislation and the wider NIS regime within 12 months of Royal Assent, followed by annual reviews.
Crucially, the review would examine whether additional sectors should be brought within scope, including cloud services, frontier AI, democratic processes, advanced manufacturing and other activities essential to the economy. It would also consider whether the AI Security Institute should receive statutory powers to audit, inspect or recommend restrictions on frontier AI systems.
The Government opposed the amendment, arguing that mandatory annual reviews could create regulatory uncertainty and distract from implementation. The Minister, Baroness Lloyd of Effra, instead offered a narrower review of critical national infrastructure sectors within 12 months, alongside a comprehensive post-implementation review within three years. Peers were unconvinced and voted to retain the broader requirement.
Second defeat over hostile foreign states
Peers also voted 194 to 155 in favour of Amendment 164, which would require the Government to establish and maintain a register of foreign powers presenting cyber security threats to the UK. The proposed register would draw on GCHQ intelligence concerning state-sponsored attacks on critical infrastructure, with the Government required to assess the risks and report its plans for addressing them.
The Minister opposed the measure, warning that a country-based register could create false certainty and that cyber security threats should be assessed individually rather than through a fixed list. Nevertheless, peers backed the amendment, adding a new statutory obligation that the Government may seek to reverse when the Bill returns to the Commons.
AI remains a major point of contention
Perhaps the sharpest criticism concerned the Bill’s treatment of artificial intelligence. Conservative peer Lord Holmes described the absence of comprehensive AI provisions as a “huge hole” in the legislation. Baroness Harding proposed Amendment 41, which would have required developers of frontier AI models to report incidents involving unauthorised access to or interference with critical systems.
The Government opposed the amendment, arguing that the Bill already covers significant AI-related incidents affecting regulated services and that reporting obligations should remain primarily with the regulated organisations.
Peers rejected the proposal by 165 votes to 95.
However, government amendments addressing incidents involving a loss of control of AI agents were accepted. Ministers also committed to consulting on further secondary legislation covering agentic AI risks, including technical safeguards, incident records and notifications to affected organisations.
With these new amendments, the Bill now explicitly addresses certain AI-related cyber risks, although it does not establish a comprehensive regulatory regime for frontier AI developers.
Further reforms to cyber security research promised
Another unresolved issue concerns the Computer Misuse Act 1990. Lord Clement-Jones and Lord Holmes called for greater legal protection for good-faith cyber security researchers, who can face criminal liability when investigating vulnerabilities.
The Government confirmed that the Home Office has developed proposals for a new defence under section 1 of the Act for accredited cyber security researchers undertaking specified activities.
However, ministers argued that these changes should be introduced through separate national security legislation, rather than the Cyber Security Bill. The proposed amendment was not put to a vote, leaving the reform dependent on future legislation.
What happens next?
The Cyber Security and Resilience Bill is scheduled for Third Reading in the House of Lords on 2 November 2026. Following that, the amended Bill will return to the Commons, where MPs must consider the changes made by the Lords. The two government defeats, particularly the mandatory annual review and foreign powers register, could become points of contention between the two Houses.
Even after Royal Assent, much of the new regime will depend on secondary legislation and regulatory consultations, particularly the detailed security requirements, reporting arrangements and scope of additional regulated services.
