Bill Status & Timeline: where the CSRB stands today.
Track the Cyber Security and Resilience Bill from the King's Speech to Royal Assent. Updated after every parliamentary sitting.
AISI pre-deployment audit review. Third Reading is expected on 2 November 2026.
- Current stage
- Lords Third Reading
- Bill number
- HL Bill 49
- Next sitting
- 2 November 2026
- Report Stage result
- Gov defeated on AI (202-155)
- Royal Assent (est.)
- Late 2026 - Spring 2027
- Full implementation (est.)
- ~2028
Source: UK Parliament, Bill 4035
House of Lords - Third Reading (HL Bill 49)
The Bill has passed all House of Commons stages and completed Lords Second Reading, Committee Stage and Report Stage day one. The Government was defeated 202-155 on Amendment 163 (AISI pre-deployment audit review) and new AI-agent direction powers (Amendment 70) were agreed. Third Reading is expected on 2 November 2026. Royal Assent is expected between late 2026 and spring 2027.
Organisations that will fall in scope - MSPs, data centres, cloud providers, critical suppliers - should not wait for Royal Assent to begin preparation. Registration deadlines are typically 3 months from commencement (Section 14), and the Government's 2026 implementation consultation is already underway.
Full legislative timeline
Every key milestone from announcement to projected implementation.
King's Speech announcement
The Cyber Security and Resilience Bill was announced in the King’s Speech as a priority for the new parliamentary session, signalling the Government’s intent to overhaul the UK’s NIS framework.
Introduced to Parliament (Bill 329)
The Bill was formally introduced to the House of Commons and received its First Reading. Published as Bill 329, it contained 5 Parts, 61 sections and 2 Schedules.
Commons Second Reading
MPs debated the Bill’s general principles and voted to proceed. Cross-party support was evident, with particular focus on the expanded scope covering MSPs, data centres and critical suppliers.
Commons Committee Stage
Line-by-line scrutiny in Public Bill Committee. Key amendments debated included Ofcom as sole regulator for data centres, AI scope and the 24-hour incident reporting threshold.
Commons Report Stage & Third Reading
The Bill passed the House of Commons without division. Final amendments were agreed, and the Bill was sent to the House of Lords on 17 June 2026.
Lords Second Reading
The House of Lords backed the Bill without a division. Peers highlighted supply-chain security, vendor direction powers, and the AI kill-switch debate as areas for committee scrutiny.
Lords Committee Stage (Grand Committee)
Three days of detailed scrutiny in Grand Committee. Of 193 amendments tabled, only 5 were agreed - all Government amendments. The Government tabled over 60 amendments creating vendor-related direction powers but did not move them, indicating they will return at Report Stage. The Bill was reprinted as HL Bill 49.
Lords Report Stage (day one)
The Government was defeated 202-155 on Amendment 163, requiring a review of whether AISI should have pre-deployment audit powers over frontier AI. Amendment 70 (AI-agent direction powers) was agreed without division. Amendment 41 (developer incident reporting) was defeated 95-165.
Lords Third Reading
Final opportunity for amendments in the Lords. If the Bill is amended, it returns to the Commons under the parliamentary “ping-pong” process until both Houses agree the text.
Royal Assent
Once both Houses agree the final text, the Bill receives Royal Assent and becomes the Cyber Security and Resilience Act. Section 60 triggers immediate commencement of Parts 1, 5 and key Part 3 provisions. Other provisions commence on dates appointed by the Secretary of State.
Full implementation via secondary legislation
The Government’s 2026 implementation consultation will shape the detailed regulations under Section 29. Registration deadlines (3 months from commencement under Section 14), codes of practice (Section 36), and critical supplier designation (Section 12, tied to Section 29 regulations per Section 60(5)) will be phased in.
What happened at Report Stage and what to watch at Third Reading.
Results from 26 October 2026 and what comes next on 2 November.
Government defeated on AISI review
Amendment 163 (Lord Tarassenko) was agreed 202-155, requiring a review within 12 months of Royal Assent of whether AISI should have pre-deployment audit powers over frontier AI. The first Government defeat on the Bill in the Lords.
AI-agent direction powers agreed
Amendment 70 (Government) adds powers for the Secretary of State where a compromise involves loss of control of an AI agent - including appointing inspectors, entering premises, running tests and imposing financial penalties. Agreed without division.
Developer reporting duty defeated
Amendment 41 (Baroness Harding) would have placed an incident reporting duty on developers. Defeated 95-165. The Government confirmed it will consult on how AI incidents fit the reporting regime.
Vendor direction powers still to come
The Government's 60+ amendments on vendor-related direction powers were not on the day-one marshalled list. They may appear at Third Reading or a further Report day if one is scheduled.
Third Reading: 2 November 2026
The next and final Lords stage. Final tidying amendments only - no new policy changes. If the Bill is amended, it returns to the Commons for consideration ("ping-pong").
AI in scope confirmed
The minister confirmed during debate that commercial AI services delivered as software or platforms are "likely to be in scope" of the NIS regime, and that a non-UK model developer could be designated a critical supplier.
When duties actually start
The Bill's commencement provisions stagger when different obligations take effect.
Day of Royal Assent
- Part 1 - Introduction and definitions
- Part 3, Chapters 1, 3 & 6 - Security and resilience functions framework
- Section 40 - Five-yearly reports on the legislation
- Part 5 - General provisions (extent, commencement, short title)
2 months after Royal Assent
- Section 18(3)-(4) - Information sharing with GCHQ
- Part 3, Chapter 2 - Statement of Strategic Priorities
- Schedule 2, paragraphs 3, 4 & 13 - Consequential amendments
Appointed day (by Secretary of State regulations)
- Part 2 - Expanded scope (MSPs, data centres, load controllers, critical suppliers)
- Incident reporting - 24-hour notification, 72-hour full report (Section 15)
- Enforcement powers - Penalties up to the greater of £17M and 4% turnover (Section 21)
- Customer notification obligations (Section 16)
- Registration requirements - 3-month deadline from commencement (Section 14)
- Section 12 (critical suppliers) - must commence on same day as first Section 29 regulations
~2028 - Full implementation
- Secondary legislation under Section 29 - detailed security and resilience regulations
- Codes of Practice under Section 36 - recommended compliance measures
- Critical supplier designation regime fully operational
- Cost recovery charging schemes published by regulators (Section 17)
Bill status FAQ
Quick answers to the questions compliance teams ask most.
Not yet. The Bill has completed all House of Commons stages and Lords Report Stage day one (26 October 2026). The Government was defeated 202-155 on an AI amendment. It must still complete Lords Third Reading (expected 2 November 2026), Commons consideration of Lords amendments, and receive Royal Assent before it becomes law.
As of 28 October 2026, the Bill has completed Lords Report Stage day one and is heading to Third Reading, expected 2 November 2026. The Government was defeated on Amendment 163 (AISI audit review, 202-155) and new AI-agent direction powers (Amendment 70) were agreed. It is published as HL Bill 49.
Royal Assent is expected between late 2026 and spring 2027. Under Section 60, some provisions (Parts 1 and 5, key Part 3 chapters, Section 40) take effect immediately on the day the Act is passed. Most Part 2 duties (expanded scope, incident reporting, enforcement) commence on a date appointed by the Secretary of State via regulations. Full implementation, including critical supplier designation and detailed codes of practice, is expected around 2028 via secondary legislation.
HL Bill 49 is the version of the Cyber Security and Resilience (Network and Information Systems) Bill as reprinted after Lords Committee Stage on 7 September 2026. It replaces the earlier HL Bill 32 (the version introduced to the Lords). Five Government amendments were agreed during committee, all incorporated into HL Bill 49.
Lords Report Stage is when the full House of Lords debates and votes on amendments to the Bill. Unlike Committee Stage (which sat in Grand Committee where votes cannot be held), Report Stage allows peers to press amendments to a division. Day one took place on 26 October 2026, when the Government was defeated 202-155 on Amendment 163 (AISI audit review). The vendor-related direction powers tabled but not moved during committee were not on the day-one list.
The timeline depends on the provision. Once the Act is passed, some requirements take effect immediately. For most operational duties (registration, incident reporting, security measures), the Secretary of State will set commencement dates by regulations. Registration deadlines are typically 3 months from commencement (Section 14). The Government has said it will consult during 2026 on detailed implementation, with full effect expected around 2028.
Official sources
Every date and fact on this page is drawn from official parliamentary records.
- Bill stages and publications - UK ParliamentThe authoritative record of the Bill's progress, amendments and committee reports.→
- Cyber Security and Resilience Bill collection - GOV.UKDSIT policy statement, factsheets and the impact assessment.→
- Lords Committee Stage report - UK ParliamentParliament's summary of the three-day Grand Committee scrutiny.→
- Research briefing CBP-10442 - House of Commons LibraryClause-by-clause analysis of the Bill and its Commons passage.→
Don't wait for Royal Assent to start preparing.
Registration deadlines are typically 3 months from commencement. Our compliance team can assess your readiness now and build a roadmap that keeps pace with the parliamentary timetable.