UK NIS Regulations

1. 2026-09-25 Medium
   Data (Use and Access) Act 2025 amends Network and Information Systems Regulations 2018

   The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 make amendments to the Network and Information Systems Regulations 2018 to ensure …

   Amendment Action required

1. 2026-10-26 House of Lords Report stage of the Cyber Security and Resilience (Network and Information Systems) Bill
2. 2026-09-30 The Information Commission takes over the Information Commissioner's NIS functions
3. 2026-06-16 Cyber Security and Resilience Bill passes Report stage and third reading in the House of Commons
4. 2025-11-12 Cyber Security and Resilience (Network and Information Systems) Bill introduced in the House of Commons

1. 2026-09-30
   NIS Regulations 2018 (as amended to 30 September 2026) AmendmentCurrent text

   References to the Information Commissioner were replaced with the Information Commission (S.I. 2026/386). source

2. 2025-11-12
   Cyber Security and Resilience (Network and Information Systems) Bill Draft

   Government Bill amending the NIS Regulations 2018; as of October 2026 it is at Report stage in the House of Lords, scheduled for 26 October 2026, and has not received Royal Assent. source

   More

   • It brings managed service providers and data centres into scope, with data centres classed as essential services.
   • It introduces new maximum penalties linked to the turnover of regulated entities, replacing the current £17 million cap.
3. 2024-05-25
   Amended 25 May 2024 Amendment

   Consequential amendments by the Energy Act 2023 (Consequential Amendments) Regulations 2024 (S.I. 2024/706). source

4. 2023-05-03
   Amended 3 May 2023 Amendment

   Words in the Schedule 1 table substituted by a 2023 transfer of functions order between Secretaries of State (S.I. 2023/424). source

5. 2022-07-01
   Amended 1 July 2022 Amendment

   Amendments by the Health and Care Act 2022. source

Two groups: operators of essential services above sector thresholds, and digital service providers of online marketplaces, search engines and cloud computing.

Operators of essential services

A person providing an essential service of a kind in Schedule 2 that relies on network and information systems and meets the threshold for that service is deemed designated as an OES (regulation 8(1)). source

Digital service providers

Relevant digital service providers of an online marketplace, online search engine or cloud computing service in the United Kingdom (regulation 12). source

Proposed expansion

The Cyber Security and Resilience Bill would bring managed service providers and medium and large data centres into scope. source

Covered organisations take appropriate and proportionate security measures and report qualifying incidents within 72 hours; competent authorities supervise them.

Security duty

An OES must take appropriate and proportionate technical and organisational measures to manage risks to the network and information systems its essential service relies on (regulation 10). source

OES incident reporting

Notify the competent authority without undue delay and no later than 72 hours after becoming aware of a NIS incident (regulation 11). source

RDSP incident reporting

Notify the Information Commission without undue delay and no later than 72 hours after first becoming aware of a substantial incident (regulation 12). source

Assessment tool

The NCSC Cyber Assessment Framework is designed to help organisations meet legal and regulatory requirements such as the NIS Regulations. source

Enforcement authorities can issue penalties of up to £17 million; the Cyber Security and Resilience Bill would replace this cap with turnover-linked maximums.

Proposed change

The Bill would introduce new maximum penalties reflecting the turnover of regulated entities; the government says the £17 million cap represents a small proportion of turnover for larger regulated entities. source

1. Law text Network and Information Systems Regulations 2018 (S.I. 2018/506, latest revised text)
2. Law text Cyber Security and Resilience (Network and Information Systems) Bill (UK Parliament)
3. Guidance Cyber Security and Resilience (Network and Information Systems) Bill: factsheets (DSIT)
4. Guidance Cyber Assessment Framework (NCSC)

1. NIS2

   The EU directive that replaced NIS1 in the EU; the UK kept its 2018 Regulations and is updating them through its own Bill.

2. NCSC

   NCSC guidance, including the Cyber Assessment Framework that many NIS regulators use; the NCSC itself has no regulatory responsibilities.

3. UK Telecoms Security

   The separate security regime for public telecoms providers, enforced by Ofcom under the Communications Act 2003.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 19 September 2026. Subscribe to UK NIS Regulations (RSS)