Insights and analysis on the Cyber Security and Resilience Bill.
Expert guidance on the Cyber Security and Resilience Bill. Stay informed with the latest compliance updates, implementation strategies, and regulatory insights.
Every update on the Bill, newest first.
Parliamentary progress, analysis of what each change means, and practical guidance for organisations in scope.
Government Defeated on AI Amendment at CSRB Report Stage - First Lords Defeat on the Bill
The Government lost its first division on the Cyber Security and Resilience Bill on 26 October 2026, with peers voting 202-155 to require a review of whether AISI should have pre-deployment audit powers over frontier AI. New AI-agent direction powers were also agreed. Third Reading is expected 2 November 2026.
Read the update →Does the Cyber Security and Resilience Bill Apply in Scotland, Wales and Northern Ireland?
The Cyber Security and Resilience Bill (CSRB) is UK-wide legislation that extends to Scotland, Wales and Northern Ireland. This guide explains how it reaches the devolved nations, why Holyrood, the Senedd and the Northern Ireland Assembly are being asked for legislative consent, and what in-scope organisations across the UK should do now.
Read the update →Cyber Security and Resilience Bill: Lords Report Stage - results and what happens next
The Government was defeated at Lords Report Stage on 26 October 2026 - peers voted 202-155 to require a review of AISI pre-deployment audit powers over frontier AI. New AI-agent direction powers (Amendment 70) were agreed without division. Third Reading is expected 2 November 2026. Here are the full results and what they mean.
Read the update →Cyber Security and Resilience Bill: AI Scope at Lords Committee
At Lords Committee Stage this month, the Government rejected calls to pull AI vendors into the Cyber Security and Resilience Bill, now HL Bill 32. The Bill regulates the organisations that use technology to deliver essential and digital services, not the companies that build AI models - so AI risk falls to in-scope entities to manage under their security duties. Here is what was debated in committee, including the rejected AI kill switch, and the steps to take now.
Read the update →Cyber Security and Resilience Bill: New Powers to Block Risky Suppliers
Ahead of Lords Committee Stage, the Government has tabled amendments to the Cyber Security and Resilience Bill (CSRB) creating a new 'vendor-related direction' power - letting ministers order essential and digital service providers to stop buying from, restrict, or remove technology from suppliers judged a national security risk. Here is what it does, how it differs from the Huawei-era telecoms powers, and what your supply chain team should do now.
Read the update →Cyber Security and Resilience Bill: CAF Readiness Guide
The Cyber Security and Resilience Bill (CSRB) leaves most technical detail to secondary legislation, so what should in-scope organisations do now? Start with the NCSC Cyber Assessment Framework (CAF v4.0). This guide walks through the CAF's four objectives and 14 principles, how to run a baseline self-assessment, and how each part maps to the Bill's incident reporting, supply chain and risk management duties.
Read the update →The Cyber Security and Resilience Bill Skills Gap: Can UK Firms Resource the New Duties?
A new think-tank report warns the Cyber Security and Resilience Bill (CSRB) risks becoming a "paper tiger" unless the UK's cyber skills shortage is addressed. With 49% of businesses and 58% of government bodies reporting a basic skills gap, the people needed to run 24/72-hour reporting and ongoing risk management may not be there. Here is what in-scope organisations should do about it before the duties commence.
Read the update →Lords Complete Cyber Security and Resilience Bill Second Reading: Key Themes and Committee Stage on 1 September
The Lords gave the Cyber Security and Resilience Bill (CSRB), now HL Bill 32, cross-party support at Second Reading on 14 July 2026 without calling a division - but they put five pointed themes on the record, from the public sector exemption to the Bill's total silence on AI. Committee Stage begins on 1 September, and those themes are the working agenda. Here is what each one means for in-scope organisations.
Read the update →UK Cyber Resilience Pledge: 60 Firms Commit Ahead of the Cyber Security and Resilience Bill
Technology Secretary Liz Kendall launched the Cyber Resilience Pledge at Number 10 on 7 July 2026, and more than 60 organisations signed on day one - M&S, Nationwide, Vodafone, NCC Group and, to some comment, Capita. Each of its three time-bound commitments maps onto a duty that the Cyber Security and Resilience Bill (CSRB), now HL Bill 32, will make mandatory. Here is how to use the voluntary track to get ahead of the statutory one.
Read the update →Know where you stand before the duties land.
Take the free readiness assessment to see how your organisation measures up against the Cyber Security and Resilience Bill, or talk to our team about a plan.