Expert commentary: What organisations need to know about how AI and geopolitics are shaping the UK Cyber Security and Resilience Bill requirements

New measures and refinements to the UK Cyber Security and Resilience Bill’s core reforms have emerged during its passage through the Lords. Today, the Bill reached its latest Parliamentary milestone, with the Third Reading taking place in the House of Lords. These developments build on the changes we detailed in our blog of 4 September.

As the Cyber Security and Resilience (CSR) Bill develops, organisations are facing new questions about its scope and potential impact. Louise Horton, Government Affairs Lead at NCC Group breaks down the latest updates, including the changing approach to vendor risk since September, the role of AI within the legislation, what boards should be paying attention to, and the next steps for the Bill.

How has the Bill changed?

Many details regarding the implementation of the Bill’s measures remain to be confirmed and will be outlined for consultation in the next few months. Nevertheless, the Government made some important changes last week. The practicalities of incident reporting have been a consistent feature of debate around the Bill. Near miss reporting of incidents will now only be a voluntary regime for all regulated sectors, following changes to reporting for data centres. Organisations will still be expected to share information on near misses, but the format of this collaboration with regulators and the National Cyber Security Centre (NCSC) will be outlined later.

Regulators hold a range of sensitive information on critical infrastructure cyber security and incidents. Recognising this, the Government has placed explicit restrictions on regulators' sharing of information with other jurisdictions, limiting this to countries in the European Economic Area, Switzerland and the Five Eyes alliance (the USA, Canada, Australia, New Zealand). The takeaway for businesses is that incident-reporting arrangements are not yet settled, near-miss information remains important, and cyber resilience requires ongoing attention and dialogue with regulators, not just when major incidents arise.

What happened to the vendor risk framework from September?

The Government brought back its vendor risks regime intended to address national security risks from vendor-supplied technology , with some additional clarification on ministerial responsibility and routes for parliamentary scrutiny. Regulations bringing entities within scope would require approval by both Houses of Parliament before taking effect, and relevant representatives would be consulted insofar as practicable. The likely use of these powers remains uncertain: the minister reiterated the Government's intent to focus on a voluntary referral framework and committed to consult prior to fully introducing a mandatory scheme.

The Lords wanted the Government to go further on foreign ownership risks and amended the Bill to require a register of state actors posing a threat to UK cyber security. While supporters advocated for the register as a way to increase transparency, the Government argued that a case-by-case assessment would be more accurate as jurisdiction is not the only indicator of risk. They may look to remove this provision when the Bill returns to the Commons. There are some parallels with the Lords’ register proposal to the reforms outlined in the European Union's Cybersecurity Act 2.0, where similar debates about the way to make risk-based assessments for vendors are ongoing.

Is the Government now regulating AI through this Bill?

The Government clearly signalled its concern about AI cyber risks, including loss of control and the potential consequences for critical infrastructure. It introduced new provisions addressing AI-related compromises of regulated services. In practice, this means that where the strict national security tests are met, directions could require regulated critical infrastructure organisations to isolate systems, restrict data flows or suspend automated actions to contain a loss-of-control incident.

This illustrates how emerging technology is changing cyber regulation, rather than creating a framework for frontier AI. As outlined in our Global Cyber Policy Radar Edition 5, AI security is increasingly being embedded in existing cyber and digital regulatory approaches rather than addressed only through standalone AI laws. For organisations, the practical priority is to assess and assure AI integration within their existing cyber resilience arrangements, including the ability to contain failures and maintain essential services.

The debate over AI regulation will continue beyond this Bill, alongside investment in the UK’s ability to manage AI risks. In its Budget package1, the Government announced an additional £120 million for AISI’s testing, research and technical standards, £60 million for a National Cyber Shield and £70 million for a National Exposure and Real-Time Vulnerability Centre. The investment and legislative debate point to a wider approach of harnessing AI for growth and cyber defence, while developing the capability and oversight to manage its risks.

Peers in the House of Lords wanted the Government to go further, seeking a statutory role for the AI Security Institute (AISI) in obtaining access to frontier models, conducting pre-deployment audits, setting standards and scrutinising deployments in essential services. These AI amendments did not make it into the Bill, but the Government's review obligations were extended. A review would examine the appropriate powers of AISI or another body over frontier AI systems in essential activities, as well as the broader scope of sectors under cyber regulation and the design of the regulatory model. This review requirement could still be changed when the Bill returns to the Commons. However, as the Government indicated that in any case the scope of regulation remains under active consideration, critical infrastructure sectors should continue to monitor the direction of travel and build resilience arrangements capable of adapting to evolving expectations.

What will boards need to do?

Board accountability is taking clearer shape as the Government sets out further details of the planned mandatory Security and Resilience Requirements. These are expected to include board oversight of security and resilience frameworks (with the NCSC's Cyber Assessment Framework as the recommended method), alongside suitably skilled and accredited individuals with senior accountability. Organisations should start preparing by clarifying ownership of cyber risk and ensuring that boards receive meaningful evidence about resilience.

What happens next?

The Bill will return to the Commons, where MPs will consider whether to agree to the amendments, which could lead to a back and forth between the Commons and the Lords until a final text is agreed. The Bill should reach the end of its Parliamentary journey and become law, i.e. an Act, towards the end of this year or early 2027. Consultation on the details of implementation through secondary legislation is also likely to start in the next couple of months. The secondary legislation will also need to go through Parliament before it is finalised and can be brought into force, but will be subject to less scrutiny and potential for amendment than the main Bill provisions.

Broadly speaking compliance is not usually required the moment it becomes law, and the Government has confirmed there will be a business adjustment period before regulators step up expectations of compliance. However, as the timeline continues to evolve, businesses should begin preparing for the changes now.