Cyber Security and Resilience Bill: Lords Report Stage - results and what happens next

This article was first published on 29 September 2026, when Report Stage was scheduled, and rewritten with the results on 26 and 28 October 2026.

What happened next (updated 9 November 2026): The Lords completed Third Reading on 2 November 2026 and the Bill returned to the House of Commons for consideration of Lords amendments, for which no date has been set. On 4 November the Commons extended the Bill's carry-over, so it will not lapse before the end of 29 April 2027. Read where the Bill stands now or follow the Bill status and timeline.

The House of Lords completed Report Stage on the Cyber Security and Resilience Bill (CSRB) on Monday 26 October 2026. This was the first stage of the Bill's Lords passage at which amendments could be put to a vote of the whole House, and the Government was defeated twice - on a review of the whole NIS regime and on a new clause requiring a register of foreign powers. The Lords completed Third Reading on 2 November 2026, and the Bill has returned to the Commons.

Update (3 November 2026): The text as amended on Report is HL Bill 62. It makes the review clause 66 and the register clause 67, and contains the vendor-related direction powers as clauses 44-47: the Government moved and agreed them at Report Stage (Amendments 91-94 and related amendments). Report Stage also removed mandatory near-miss reporting. Earlier versions of this post said the vendor powers did not appear at Report Stage and described Amendment 163 as an AISI-only review; both are corrected below.

Status (31 October 2026): Report Stage is complete. The Government lost two divisions: Amendment 163 (Lord Birt: a review of the effectiveness of the whole NIS regime), 202-155, and a new clause requiring a register of foreign powers, 194-155 per the Lords division record. Amendment 70 (AI-agent provision (clause 32: regulations may give the Secretary of State functions where an AI agent is out of control)) was agreed without division. Amendment 41 (developer incident reporting) was defeated 95-165. Third Reading followed on 2 November 2026.

Key takeaways

• Two Government defeats - the Bill's first in the Lords: Amendment 163 (Lord Birt), requiring a statutory review of the effectiveness of the whole NIS regime - including which sectors should be in scope and the AI Security Institute's powers - was agreed 202-155; and a new clause requiring a register of foreign powers that pose a cyber-security threat was agreed, which the Lords division record shows carried 194-155. Both are Government defeats.
• New AI-agent provision now in the Bill (clause 32): Amendment 70, tabled by the Government, lets regulations under clause 29 give the Secretary of State functions where a compromise involves loss of control of an AI agent - including appointing inspectors, entering premises, running tests, requiring information held outside the UK, and imposing financial penalties. Agreed without division.
• Developer incident reporting defeated: Amendment 41 (Baroness Harding), which would have placed an incident reporting duty on developers, was defeated 95-165.
• Two AI amendments not moved: Amendment 66 (AISI pre-deployment review with a 28-day window) and Amendment 79 (AISI standard-setting and inspection powers) were not moved.
• Vendor powers were agreed at Report Stage: the Government's vendor-related direction powers, debated but not moved at Committee, were moved and agreed at Report (Amendments 91-94 and related amendments). They are now clauses 44-47 of HL Bill 62, including a power to set up a mandatory referral scheme.
• Third Reading completed 2 November 2026: the Bill has returned to the Commons for consideration of Lords amendments.
• Nothing changes for compliance yet: Report Stage commences no duties. No date has been set for Royal Assent (the Bill must pass by the end of 29 April 2027 or lapse), with most duties arriving later through secondary legislation.

When is Report Stage for the Cyber Security and Resilience Bill?

Lords Report Stage of the Cyber Security and Resilience Bill takes place on Monday 26 October 2026, the first of what UK Parliament describes as its Report days. The House of Lords rose for the conference recess on 18 September and returned on 12 October 2026, giving peers two sitting weeks to table and group amendments before the debate. The marshalled list of amendments for Report is published on the Bill's publications page.

Lords Committee Stage finished on 7 September 2026 after three days in Grand Committee, on 1, 3 and 7 September. The Bill was then reprinted as HL Bill 49 (as amended in Grand Committee). You can see how this fits the Bill's full passage on our what the Bill is page.

What was debated at Report Stage?

UK Parliament's notice for the sitting says members speaking at Report Stage put forward amendments on subjects including:

• Reporting incidents involving frontier AI models - placing duties around serious incidents connected to the most capable AI systems. This revisits the "AI-shaped hole" peers raised in Committee, where amendment 6 to bring AI products and services into scope was withdrawn.
• Voluntary notification of incidents, cyber threats and near misses - letting organisations report near misses to the authorities without adding to their legal liability, so regulators see more of the threat picture.
• A Digital Sovereignty Strategy - requiring the Government to maintain a strategy on the UK's control of its critical digital supply chains, an issue also pressed (and defeated) in the Commons.
• Cyber-resilience reporting for large businesses - duties on larger organisations to report on their cyber-resilience plans.

These are backbench and Government amendments tabled for the chamber. Because Report Stage allows divisions, any of them can be pressed to a vote, and the Government can be defeated if a majority of peers voting support a change. The amendment text and the outcome of each vote appear in the Lords Hansard for the sitting and in the Bill's updated print once Report Stage concludes.

Report Stage results (26 October 2026)

The Lords sat on 26 October and voted on amendments to the Bill. The headline result is that the Government lost two divisions - its first defeats during the Bill's Lords passage.

Amendment	Subject	Sponsor	Result
163	Statutory review (within 12 months of Royal Assent) of the effectiveness of the whole NIS regime, including sectors in scope and AISI powers such as pre-deployment audit	Lord Birt (cross-bench)	Agreed, 202-155 (Government defeated)
New clause	Register of foreign powers that pose a cyber-security threat to the UK (for the purposes of Part 4)	Tabled by Viscount Camrose, moved by Lord Markham (Conservative)	Agreed, 194-155 per the Lords division record (Government defeated)
70	AI-agent provision (clause 32) - lets regulations give the Secretary of State functions where a compromise involves loss of control of an AI agent, including appointing inspectors, entering premises, running tests, requiring information held outside the UK, and imposing financial penalties	Baroness Lloyd of Effra (Government)	Agreed without division
41	Developer incident reporting duty	Baroness Harding	Defeated, 95-165
66	AISI pre-deployment review of frontier AI products on essential-service networks (28-day review window)	Lord Tarassenko	Not moved
79	AISI powers to set standards, inspect and require remedial action	Lord Clement-Jones	Not moved

The first defeat: a review of the whole NIS regime

Amendment 163, moved by Lord Birt, requires the Secretary of State to review the effectiveness of the Act and the NIS Regulations within 12 months of Royal Assent and report to Parliament. The review must consider which further sectors should be in scope (including all critical national infrastructure, cloud and SaaS, frontier AI, democratic processes and education) and the regulatory framework, including the AI Security Institute's powers such as auditing frontier AI systems before deployment. It is clause 66 of HL Bill 62. The minister argued against the amendment, saying it would undermine the voluntary access AISI currently has to frontier models. The Lords voted it through regardless.

This does not give AISI audit powers or extend scope immediately - it requires the Government to review these questions and report to Parliament. But it is politically significant: the Lords have signalled that they believe AI oversight in critical infrastructure needs more than voluntary arrangements.

The second defeat: a register of foreign powers

The Government also lost a division on a new clause, tabled by Viscount Camrose and moved by Lord Markham for the Opposition, requiring the Government to set up a register of foreign powers that the Secretary of State believes present a risk to the UK's critical network and information systems, linked to the Secretary of State's national security powers in Part 4. The Lords division record shows the clause was agreed by 194 votes to 155.

The minister, Baroness Lloyd of Effra, opposed it, telling peers that "a register can create false certainty" and that national security threats do not come solely or consistently from a fixed group of foreign powers. In our view this is the defeat most likely to cause friction when the Bill returns to the Commons. The Government opposed it in the Lords, but it has not said how it will respond; if the Commons removes it, the two Houses could enter "ping-pong". For in-scope organisations the clause changes no duties today, but a statutory register of foreign powers would sharpen how operators weigh supply-chain and country-of-origin risk alongside the Bill's vendor direction powers.

Amendment 70: new AI-agent powers

Amendment 70 was a Government amendment that adds a new power. Where a cyber incident involves loss of control of an AI agent operating on an essential-service network, regulations may give the Secretary of State functions including:

• Appointing inspectors to investigate
• Entering premises and running tests
• Requiring information, including information held outside the UK
• Imposing financial penalties

This was agreed without division and is now part of the Bill. The Minister also told peers that commercial AI services "are often delivered under similar digital service models and so are likely to be in scope", including "AI assistance delivered via software-as-a-service models, AI platforms, and infrastructure used for AI workloads" (HL Deb, 26 October 2026).

Vendor-related direction powers

The Government's package of vendor-related direction powers - creating powers to direct organisations about risky technology suppliers - was debated at Committee on 1 September but not moved. It was moved and agreed at Report Stage (Amendments 91-94 and related amendments), and is now clauses 44-47 of HL Bill 62.

Why does Report Stage matter more than Committee Stage?

Report Stage matters more because amendments can be pressed to a vote and carried against the Government. Lords Committee Stage on this Bill took place in Grand Committee, a committee room procedure where decisions have to be unanimous. In practice that means amendments can only be probed and withdrawn, not voted through.

The Committee record shows this clearly. Of the 193 amendments tabled:

Outcome at Lords Committee Stage	Government amendments	Other peers' amendments
Agreed	5	0
Withdrawn after debate	1	20
Not moved	63	104
Total	69	124

Source: UK Parliament, Committee Stage amendments list for the Bill.

At Report Stage the Bill is debated in the main chamber, every member can take part and divisions are allowed. A peer who withdrew an amendment in September can table it again and ask the House to vote on it. That is why 26 October is the most important date for how the Bill's final duties will read.

What did Lords Committee Stage actually change?

The five amendments agreed in Committee were narrow. They became part of HL Bill 49 and remain in HL Bill 62:

• Large load controllers (amendments 4 and 5): the new essential service of load control only applies to organisations that carry on activities for "system-balancing purposes", meaning activities that contribute to the balancing, flexibility, security or stability of the electricity system. Read more on our large load controllers page.
• Incident reporting (amendments 19, 36 and 44): once the new incident-reporting provisions commence, operators of essential services, relevant digital service providers and relevant managed service providers would have to consider whether any data relating to the service has been compromised when deciding whether an incident is reportable. Before this change the Bill's test was only data relating to users of the service.

Everything else, including the AI, Computer Misuse Act and public-sector amendments, left Committee unchanged.

Which amendments are likely to return at Report Stage?

This section was written before Report Stage (29 September 2026) and is kept for the record. For what actually happened, see the results above.

These are the issues peers pressed in Committee and said they would bring back, or where the Government committed to act before Report.

Issue	Led by	Committee outcome	Government position
Vendor-related direction power	Government (Baroness Lloyd of Effra)	Debated 1 September, not moved	Will engage peers "ahead of Report"
Delegated powers (Clauses 37(7) and 40(5))	Lord Clement-Jones	Withdrawn	Will respond formally to the Delegated Powers Committee ahead of Report
Computer Misuse Act review (amendment 164)	Lord Clement-Jones	Withdrawn	Reform to come in the national security Bill announced in the May King's Speech
AI products and services in scope (amendment 6)	Baroness Kidron	Withdrawn	Resisted; AI's impact kept "under review"
AI "kill switch" (amendment 84)	Lord Clement-Jones	Not moved	Exploring "proportionate containment powers" instead
Public bodies, councils and elections in scope (81B-81D)	Lord Clement-Jones	Not moved	Engagement on new sectors offered ahead of Report

The vendor-related direction power

This is the biggest expected change at Report. The Government tabled the package on 24 August 2026. It would let the Secretary of State direct in-scope organisations to restrict, remove or modify goods, services or facilities from a vendor that poses a national security risk. The minister told peers the power would apply "to operators of essential services in the first instance". It would come with procurement guidance, a voluntary referral route into government, and a power to create a mandatory referral scheme later if needed.

Because these amendments were not moved in Committee, they are not yet in the Bill. If the Government re-tables them for Report, peers will be able to vote on them. Our post on new powers to block risky suppliers explains how the power would work.

Computer Misuse Act reform

Lord Clement-Jones's amendment 164 would have required the Secretary of State to review, within 12 months of Royal Assent, whether a statutory defence under section 1 of the Computer Misuse Act 1990 is needed for people carrying on legitimate cyber security activities. The Government said that review would be too narrow, and pointed to the national security Bill announced in the May 2026 King's Speech, which includes measures to update the Computer Misuse Act. Lord Clement-Jones withdrew the amendment, saying he hoped for "more clarity" on the timing of that Bill "between Committee and Report".

This matters to any organisation that commissions penetration testing or runs a vulnerability disclosure programme, because it decides how that work is treated in criminal law.

AI scope and the AI "kill switch"

Baroness Kidron's amendment 6, backed by Lord Clement-Jones, Lord Tarassenko and Lord Holmes of Richmond, would have added AI products and services to the digital services the Bill covers. Lord Tarassenko told the Committee there was an "AI-shaped hole in the Bill". The minister, Baroness Lloyd of Effra, replied that the Bill regulates risks to the systems of the organisations it covers, and that the Government will keep AI's impact "under review". The amendment was withdrawn.

Lord Clement-Jones's amendment 84 proposed a last-resort power to shut down an AI model in critical infrastructure, widely described as an AI "kill switch" (Lord Clement-Jones later used the term in the Lords on 15 September 2026). It was debated but not moved. The Government argued that the Bill's existing direction powers could already require an organisation to "cease using and isolate an AI model". It also said it was examining "proportionate containment powers", including powers "to restrict access to specific AI systems". We cover this debate in detail in our analysis of the AI scope debate at Lords Committee.

Delegated powers and the public sector

The Delegated Powers and Regulatory Reform Committee recommended removing Clause 37(7) and Clause 40(5). These clauses would let ministers amend the Bill's own consultation and reporting requirements by regulations. Lord Clement-Jones said that if the Government does not respond to both recommendations "we will bring this back on Report". The Government said it would respond to the committee formally before Report.

Lord Clement-Jones also tabled amendments 81B to 81D to bring central government, local authorities and electoral infrastructure into scope. They were not moved. The minister offered further engagement "ahead of Report" on which new sectors could be added. See our local councils page for what this means for the public sector.

What happens after Report Stage?

Step	What happens	Expected timing
Lords Report Stage	Whole House debated and voted on amendments; two Government defeats	26 October 2026 ✓
Lords Third Reading	Final tidying amendments in the Lords	Completed 2 November 2026
Commons consideration of Lords amendments	MPs accept or reject each Lords change ("ping-pong" if they disagree)	After Third Reading
Royal Assent	The Bill becomes an Act	Not yet scheduled (must pass by end of 29 April 2027)
Commencement	Most duties switched on by secondary legislation	Phased by regulations; no dates set

The Bill has been carried over from the 2024-26 session. It cleared the Commons on 16 June 2026 and completed Lords Second Reading on 14 July 2026. For the full journey, see our analysis of the Lords Second Reading and Committee Stage agenda.

What should organisations do now Report Stage is under way?

1. Scope yourself now. The Bill's core structure has been stable since the Commons: operators of essential services, relevant digital service providers, relevant managed service providers, data centres and designated critical suppliers. None of the amendments expected at Report would change whether most organisations are in scope. Use our key changes summary and the text of the Bill as a starting point.
2. Check your incident reporting test. Once the provisions commence, the Committee change means you would need to consider whether any data relating to your service was compromised, not only your users' data. Build that into your triage runbook alongside the 24-hour initial notification.
3. Review supplier risk if you are an operator of an essential service. Now that the vendor-related direction power is in the Lords text, operators of essential services could be directed to remove or restrict specific suppliers. Now is the time to map which suppliers support your critical systems.
4. Read the Report Stage marshalled list and the Hansard record. The marshalled list is the reliable guide to what peers voted on, and the Lords Hansard for 26 October 2026 records which amendments were agreed, withdrawn or defeated - including the two Government defeats on the NIS regime review and the register of foreign powers, and the amendments on AI incident reporting, near-miss notification and digital sovereignty.
5. Brief your board on the timeline. No date has been set for Royal Assent (the Bill must pass by the end of 29 April 2027 or lapse). Organisations that have not yet named an accountable owner or aligned to the NCSC Cyber Assessment Framework have a short runway.

Frequently asked questions

When was Report Stage for the Cyber Security and Resilience Bill?

Lords Report Stage took place, and was completed, on 26 October 2026, beginning in the chamber from 3.15pm. It followed Lords Committee Stage, which sat in Grand Committee on 1, 3 and 7 September 2026. With Report Stage complete, the Lords went on to complete Third Reading, the final Lords stage, on 2 November 2026; the Bill has now returned to the Commons for consideration of the Lords amendments.

Is the Cyber Security and Resilience Bill now HL Bill 32 or HL Bill 49?

It is now HL Bill 62. HL Bill 32 was the Bill as brought from the Commons on 17 June 2026. After Lords Committee Stage it was reprinted as HL Bill 49 (as amended in Grand Committee), and after Report Stage as HL Bill 62 (as amended on Report).

Can the Lords defeat the Government at Report Stage?

Yes. Unlike Grand Committee, Report Stage takes place in the main chamber and amendments can be pressed to a division. If a majority of peers voting support an amendment, it is added to the Bill against the Government's wishes. MPs can then accept or reject it when the Bill returns to the Commons.

Was the vendor-related direction power added at Report Stage?

Yes. The Government tabled the package on 24 August 2026 and debated it on 1 September, but did not move the amendments in Committee. It moved and agreed them at Report Stage on 26 October 2026, and they are now clauses 44-47 of HL Bill 62. The Commons must still agree the Lords amendments.

Does anything change for my organisation on 26 October 2026?

No. Report Stage commences no duties. It only settles more of the final wording of the Cyber Security and Resilience Bill. Duties will start after Royal Assent, mostly through secondary legislation, on dates the Government has not yet set.

When will the Cyber Security and Resilience Bill become law?

The Lords completed Third Reading on 2 November 2026. The Bill still needs Commons consideration of the Lords amendments. No date has been set for Royal Assent (the Bill must pass by the end of 29 April 2027 or lapse).

Sources

• UK Parliament, Cyber Security and Resilience (Network and Information Systems) Bill: stages (Report Stage date, stage history)
• UK Parliament, Committee Stage amendments (amendment numbers, sponsors and outcomes)
• UK Parliament, Bill publications (HL Bill 49, HL Bill 62, marshalled lists)
• Lords Hansard, Grand Committee debates of 1 September, 3 September and 7 September 2026
• UK Parliament news, Cyber security bill completes Lords committee stage, 8 September 2026
• UK Parliament news, Cyber Security and Resilience (Network and Information Systems) Bill undergoes further scrutiny in the Lords (Report Stage date and amendment subjects)

Position as at 31 October 2026, updated with the full Report Stage division results. Report Stage completion (26 October) and Third Reading (2 November 2026) are confirmed against UK Parliament's news item on the Bill's further Lords scrutiny and the Bill's stage history. Amendment outcomes (163, moved by Lord Birt, agreed 202-155, 70 agreed without division, 41 defeated 95-165, 66 and 79 not moved) were confirmed against Hansard and the Resultsense parliamentary monitoring report of 27 October 2026. The second Government defeat - a new clause on a register of foreign powers, agreed 194-155 - is drawn from the Lords division record and corroborated by parliamentary-monitoring reporting. Committee-stage facts were checked against the UK Parliament Bills site and Lords Hansard.