Yes. The Cyber Security and Resilience Bill (CSRB) is United Kingdom legislation that extends to England and Wales, Scotland and Northern Ireland. If your organisation is in scope, it does not matter which of the four nations you operate in: the duties reach you. What differs across the UK is not whether the Bill applies, but the constitutional process - legislative consent - that runs alongside it, and in some sectors which regulator enforces the rules. This guide explains how the Cyber Security and Resilience Bill reaches the devolved nations, why Holyrood, the Senedd and the Northern Ireland Assembly are being asked to consent, and what organisations in Scotland, Wales and Northern Ireland should do now.
Key takeaways
- The Bill is UK-wide. The Cyber Security and Resilience Bill extends to all four nations under its extent clause (clause 59). Legislative consent does not change that.
- Its subject matter is largely reserved. Cyber security sits mostly in reserved areas - national security and telecommunications - which is why Westminster can legislate for the whole UK.
- Consent is still sought where it touches devolved matters. Under the Sewel convention, the Scottish Parliament, the Senedd and the Northern Ireland Assembly are each asked to consent to the parts that engage devolved competence.
- Scotland is the furthest along. The Scottish Government lodged legislative consent memorandums and a motion (S7M-01498) recommending consent was placed before the Scottish Parliament in October 2026.
- Your scope and timeline do not change. Devolved organisations should prepare on the same footing as English counterparts, with Royal Assent expected between late 2026 and spring 2027 and most duties phased in by secondary legislation through to around 2028.
How the Cyber Security and Resilience Bill applies across the United Kingdom
The Cyber Security and Resilience Bill updates and replaces the Network and Information Systems (NIS) Regulations 2018, the UK's existing cyber security framework for essential and digital services. Like those Regulations, the Bill is designed to work on a UK-wide basis. Its extent clause (clause 59) provides that the Bill extends to England and Wales, Scotland and Northern Ireland.
"Extent" and "application" are not the same thing, but for most in-scope organisations the distinction makes no practical difference here. The new duties - on managed service providers, data centres, large electricity load controllers, critical suppliers and the operators of essential services - apply wherever in the UK those organisations carry on the relevant activity. A managed service provider in Glasgow, a data centre in Cardiff and a water company in Belfast are no less in scope than their counterparts in England. You can check whether your organisation is caught on our who is affected pages.
The reason Westminster can legislate for the whole UK is that cyber security falls mostly within reserved matters. In its legislative consent memorandum, the Scottish Government set out that the Bill's provisions relate principally to national security and to telecommunications and wireless telegraphy - areas reserved to the UK Parliament under the Scotland Act 1998. Because the core of the regime is reserved, the UK Parliament does not need the devolved legislatures' permission to pass most of it.
What is legislative consent, and why does it matter here?
Even where a UK Bill deals mainly with reserved matters, parts of it can touch devolved responsibilities or change what devolved ministers can do. Under the Sewel convention, the UK Parliament does not normally legislate on devolved matters, or alter the competence of the devolved institutions, without their consent. That consent is given - or withheld - through a legislative consent memorandum (LCM) and a legislative consent motion voted on by the relevant legislature.
For the Cyber Security and Resilience Bill, consent is being sought in all three devolved nations because the regime reaches into devolved sectors. Health and water, for example, are devolved, so a Bill that imposes cyber duties on hospitals and water suppliers inevitably interacts with devolved competence. The Bill also gives functions to regulators, and where those functions touch the responsibilities of devolved ministers, consent is engaged.
Crucially for in-scope organisations, legislative consent is a question between parliaments, not a switch that turns the Bill on or off for you. Whatever the devolved legislatures decide, the Bill as enacted by Westminster is what sets your duties. Consent affects the constitutional legitimacy and, in practice, the willingness of the UK Government to proceed with contested provisions - it does not carve devolved organisations out of scope.
The Cyber Security and Resilience Bill and the Scottish Parliament
Scotland's process is the most developed and the most instructive. The Scottish Government lodged its first legislative consent memorandum in January 2026 and later a supplementary memorandum, reflecting changes made as the Bill moved through Westminster. The memorandums were scrutinised by the Scottish Parliament's Economy, Tourism and Energy Committee.
Two points from that scrutiny are worth noting:
- A disagreement over which clauses need consent. The UK Government and the Scottish Government did not fully agree on the list of provisions requiring the Scottish Parliament's consent. The Scottish Government argued that consent was needed for additional clauses because they could indirectly alter the functions of the Scottish Ministers, who act as a designated competent authority for devolved sectors.
- A late, accelerated timetable. The committee worked to a compressed schedule, driven by the pace of the Bill's Lords stages. Its correspondence with the Cabinet Secretary in September 2026 probed a specific delegated power (clause 41), which the Scottish Government was content to recommend consenting to on the basis that the power was "narrowly focused" - the committee asked what that phrase meant in practice.
A legislative consent motion, S7M-01498 in the name of the Cabinet Secretary for Justice Neil Gray and supported by Stephen Gethins and John Swinney, was placed before the Scottish Parliament in October 2026, recommending consent so far as the Bill's provisions fall within devolved competence.
What about Wales and Northern Ireland?
Wales and Northern Ireland each run their own legislative consent process in parallel. The Welsh Government lodged a legislative consent memorandum, pointing - like Scotland - to the reserved nature of the Bill's core subject matter while flagging the devolved sectors it reaches. The Northern Ireland Department of Finance also brought the Bill into Northern Ireland's legislative consent process. The precise position in each nation has moved as the Bill has progressed, so organisations in Wales and Northern Ireland should treat the current state of their own legislature's consent process as the point to watch, rather than assuming it mirrors Scotland.
None of this changes the headline for organisations: the Bill extends to Wales and Northern Ireland, and in-scope bodies there should prepare on the same timeline as everyone else.
Does the regulator change depending on where I operate?
For some sectors, yes. The Bill works through "competent authorities" - the regulators responsible for overseeing each sector. In devolved sectors such as health and water, the body that enforces the regime can differ between the four nations, even though the duties come from the same UK framework. An English water company and a Scottish water body may answer to different regulators while meeting materially the same obligations. For UK-wide and reserved sectors, such as digital infrastructure and the new data centre regime (where Ofcom is the regulator), the position is consistent across the UK.
If you are unsure which authority oversees your sector, start with the relevant page under who is affected - for example drinking water, NHS and health organisations or managed service providers - and read it alongside our summary of what the Bill changes.
What should devolved organisations do now?
The practical steps for an in-scope organisation in Scotland, Wales or Northern Ireland are the same as for one in England:
- Confirm whether you are in scope. Check the thresholds and sector definitions on our who is affected pages. Being outside England does not take you out of scope.
- Identify your competent authority. For devolved sectors, confirm which regulator will oversee you, because reporting lines and guidance may be nation-specific.
- Map your obligations now. The substantive duties - risk management, significant-incident reporting and the rest - will land through secondary legislation after Royal Assent, but the direction of travel is already clear in the Bill text. Read what the Bill is and view the Bill to understand the duties coming your way.
- Do not wait for consent to conclude. The legislative consent process will not remove you from scope. Treat the Westminster timetable - Royal Assent expected between late 2026 and spring 2027, with duties phased in to around 2028 - as your planning horizon.
For the next milestone in that timetable, see our guide to Lords Report Stage on 26 October 2026, the point at which the Bill's final wording - including any provisions that affect devolved authorities - can still change.
Frequently asked questions
Does the Cyber Security and Resilience Bill apply in Scotland?
Yes. The Cyber Security and Resilience Bill extends to Scotland as well as to England and Wales and Northern Ireland. In-scope Scottish organisations - managed service providers, operators of essential services, data centres and others - are covered in the same way as organisations elsewhere in the UK. The legislative consent process at Holyrood does not change whether the Bill applies to you.
Why does the Scottish Parliament have to consent if cyber security is reserved?
Because even a mainly reserved Bill can touch devolved matters or change the functions of devolved ministers. Under the Sewel convention, Westminster seeks the devolved legislatures' consent for those parts. The Scottish and UK governments did not fully agree on which clauses required consent, which is part of why the process drew scrutiny.
Will Scotland, Wales or Northern Ireland get a different version of the law?
No. The duties come from the single UK Act. What can differ is the competent authority that enforces the regime in devolved sectors such as health and water, and the nation-specific guidance those regulators issue.
Does legislative consent delay the Bill?
Not in itself. The legislative consent processes run alongside the Bill's passage through Westminster. The UK timetable - Royal Assent expected between late 2026 and spring 2027, with most duties arriving later through secondary legislation - is the one in-scope organisations should plan against.
Position as at 12 October 2026. The Bill's UK-wide extent (clause 59), its reserved subject matter and the legislative consent process were confirmed against the Scottish Government's legislative consent memorandums and the Scottish Parliament's Economy, Tourism and Energy Committee papers, the Scottish Parliament Business Bulletin listing motion S7M-01498, the Northern Ireland Assembly and Senedd legislative consent pages, and the House of Commons Library briefing (CBP-10442). UK Parliament and parliament.scot pages were not directly reachable from this environment; the primary documents were read via their official titles and published summaries. The outcome of any consent vote is not asserted here.
Sources
- UK Parliament, Cyber Security and Resilience (Network and Information Systems) Bill (bill text, extent clause, stages)
- UK Parliament, HL Bill 32 Explanatory Notes (territorial extent and application)
- Scottish Parliament, Legislative consent: Cyber Security and Resilience (Network and Information Systems) Bill (memorandums, committee consideration, reserved-matters basis)
- Scottish Parliament, Business Bulletin, 7 October 2026 (motion S7M-01498)
- Northern Ireland Assembly, Legislative consent: Cyber Security and Resilience (Network and Information Systems) Bill
- Senedd, Legislative Consent: Cyber Security and Resilience (Network and Information Systems) Bill
- House of Commons Library, Cyber Security and Resilience (Network and Information Systems) Bill 2024-26 (CBP-10442)