The UK Government has announced that it intends to introduce the Cyber Security and Resilience Bill (the “Bill”) to Parliament in 2025. Formally proposed as part of the King’s Speech in July, this Bill is intended to strengthen the UK’s cross-sectoral cyber security legislation to better protect the UK’s economy and infrastructure. This Bill will update the existing NIS Regulations, which derive from EU law. Part of the UK Government’s motivation seems to be to keep pace with updates to EU law in this area, specifically relating to the NIS2 Directive that starts to apply this month (see our blog post on this, here).

A draft of the Bill has not yet been published, but the Government has indicated that this new Bill will, as compared to the existing NIS Regulations:

• Expand the scope of entities captured, “to protect more digital services and supply chains”.
• Impose more stringent reporting requirements on covered entities, including where companies are held to ransom.
• Put regulators on a “stronger footing”, for example by introducing cost recovery mechanisms to ensure regulators are better funded, and providing regulators with the power to proactively investigate potential vulnerabilities.

Further detail about the Bill is limited, but the previous Government’s response to a consultation on amending the NIS Regulations suggested that:

• Digital managed services (such as IT outsourcing services or threat and vulnerability management services) would be brought within scope of the regime.
• Incident reporting obligations would be expanded to include incidents that do not directly affect the continuity of a service.
• A risk-based approach to regulation would be adopted (but that the legislation itself would not create a two-tier system whereby some entities are proactively regulated and others only reactively).
• A new power would be created, to bring into scope critical suppliers or services on which covered services depend.

If the new Labour Government takes inspiration from the EU’s NIS2 Directive it could, for example, expand the sectors within scope of the law even further.

The Government has stated that it is “working with key stakeholders to gather input” and will in due course publish further communications on how stakeholders can provide their views on the Bill’s content. Once introduced to Parliament, we expect that the Government will look to pass the Bill through the legislative process as quickly as possible. The Government’s announcements on the Bill have emphasised its urgency in light of a number of recent high-profile cyber-attacks on important UK institutions. A swift passage could see the Bill becoming law in the first quarter of 2026 (or even sooner), depending on when it is introduced to Parliament.