What is the 'Cost Recovery' mechanism in HL Bill 32?

The Cyber Security and Resilience Bill empowers regulators to recover the costs of their activities directly from the regulated entities. This effectively functions as a new levy on critical sectors to fund oversight.

What costs can be recovered?

Regulators can charge for the costs of investigations, audits, and general oversight administration. This ensures the regulator is well-funded without relying solely on general taxation.

Any designated Critical National Infrastructure (CNI) operator or regulated entity (like MSPs) may be liable for these fees, depending on the specific regulator's funding model (e.g., ICO, Ofcom, or sectoral regulators).

Executive briefing

The "cost recovery" mechanism explained

Cyber security regulation is no longer free. The government is shifting the financial burden of oversight onto the industry itself.

Check your liability risk Talk to our team

What it means for your P&L

Regulation is no longer free

The cost recovery clause allows regulators to invoice regulated entities to cover the expenses of their supervisory activities - designed to solve the "resource constraint" problem that has plagued previous enforcement.

Implication: double-jeopardy financial risk

If you are investigated following an incident, you may be liable for the cost of that investigation, regardless of the final penalty outcome.

The new landscape

What you could be charged for

Cost recovery turns regulatory activity into a direct line item for in-scope organisations.

Audits & inspections

Routine compliance checks and deep-dive technical audits may now be chargeable. Regulators can hire external experts and pass the bill to you.

Investigation costs

Post-incident forensics and regulatory inquiries consume vast resources. The Bill ensures the taxpayer does not foot this bill for private-sector failures.

Avoid the investigation costs

The cheapest investigation is the one that never happens. Proactive compliance is now a direct cost-saving strategy.

Check your liability risk Talk to our team

How Charging Actually Works

Cost recovery is not a general power to bill you for work done on your case. It runs through a published charging scheme, and a regulator cannot charge anyone until it has made one.

A charge is only payable if four conditions are met

Under regulation 20A(1), a NIS enforcement authority may impose a charge only where:

the authority has made a charging scheme and that scheme has effect;
the charge relates to a period specified in that scheme (a "chargeable period");
you were regulated by that authority during all or part of the chargeable period; and
the charge is imposed in accordance with the scheme.

What a scheme must specify

Regulation 20A(3) sets out the minimum contents. This is what to look for when your regulator publishes one.

Which functions are chargeable

The scheme must name the functions a charge is payable for, rather than charging at large.

The chargeable periods

Charges attach to defined periods, so you can work out which years you are exposed to.

Amount, or how it is calculated

Either the actual amount or the method, including the factors the authority will weigh.

When and how to pay

Payment mechanics must be in the scheme itself.

A start date at least 14 days out

A scheme cannot take effect until at least 14 days after it is published, so charges are never retrospective on publication.

Consultation before it is made

The authority must consult the regulated persons it considers appropriate before making or revising a scheme. Minor revisions are exempt.

Schemes must be published, may be revised or revoked, and may set different charges for different types of organisation. A scheme may also exempt named descriptions of person, or waive charges where specified conditions are met.

The point most readers miss

Regulation 20A(5) states that a charge need not relate to the exercise of functions in relation to the person paying it. You are not simply being invoiced for time spent on you. Charges fund the authority's regulatory function across its whole population of regulated entities.

Regulation 20A(2) also lets an authority recover costs it incurred before the charging power commenced, where those costs were preparation for charging. Set-up costs can therefore appear in the first scheme.

If you dispute a charge

Turnover-based charges are determined by the regulator. Where the amount turns on your turnover and you disagree with the authority about the figure, regulation 20B(1) makes the authority's determination the operative one.
Unpaid charges are a civil debt. Regulation 20B(2) makes a charge recoverable as a civil debt due to the authority, so non-payment is a debt matter rather than a further regulatory breach.

The transparency obligation that runs the other way

Regulation 20B(3) to (5) requires each authority to publish a statement for every chargeable period setting out:

the total charges it actually received for the period;
the total still outstanding that it expects to recover; and
what exercising the charged-for functions actually cost it.

That third figure is the useful one. It lets regulated organisations and trade bodies test whether a scheme is genuinely recovering cost or over-recovering, and it is the natural evidence base for challenging a scheme at consultation.