CSRB Radar — July 2026: The Bill Clears the Commons and Moves to the Lords
Archive note — added 21 October 2026. This is a dated snapshot and is kept for chronology. Position at 21 October 2026: The Cyber Security and Resilience (Network and Information Systems) Bill had completed all Commons stages and Lords Committee Stage (held in Grand Committee, 1–7 September 2026). The Lords version at that date was HL Bill 49, as amended in Grand Committee. The Bill is not law in force until Royal Assent and commencement. Check the official Bill page for the latest status.
It's been a while since the last update on this blog, and in that gap the Bill has kept moving. If you've been heads-down running client environments instead of tracking Hansard, here's the state of play as of 1 July 2026, grounded in what's actually been published rather than what's been guessed at.
Where the Bill actually is
The Cyber Security and Resilience (Network and Information Systems) Bill had its First Reading in the House of Commons on 12 November 2025, Second Reading on 6 January 2026, and then went through Public Bill Committee — clause-by-clause scrutiny and evidence sessions — from 3 February 2026. It then completed its remaining Commons stages — Report Stage and Third Reading, both on 16 June 2026 — and moved across to the House of Lords, where it had its First Reading the next day, 17 June 2026, and has been renumbered HL Bill 32 for the 2026-27 session.
That renumbering is just process, not a restart: the Bill was carried over from the 2024-26 session into 2026-27 (Parliament's own tracker records a formal "Bill reintroduced" step on 14 May 2026 as part of that process), which is why you'll see it referenced under two different bill numbers depending on which chamber's tracker you're looking at. It's the same Bill throughout.
Update, checked against Parliament's own bill-stages tracker at the time of writing: the Lords Second Reading was expected on 14 July 2026. Parliament's page flagged that dates more than a week out could still move. The direction of travel was settled, though: the Commons stages were done, and the Bill was with the Lords.
Bill progress snapshot
Commons complete · Lords scrutiny under way
The one document worth reading if you read nothing else
GOV.UK's factsheet on "Relevant Managed Service Providers" was last updated 30 June 2026 — that's the freshest primary-source material tied to MSPs specifically, and it's where the actual scope and duties are defined, not in secondary commentary. Key points:
- An RMSP is any entity providing ongoing management of IT systems under contract — support, maintenance, monitoring, active administration, on-prem or remote.
- Medium and large MSPs providing UK managed services are in scope. Small and micro enterprises are exempt, as are certain public authority bodies.
- Data centre services, public electronic communications networks, and pure operational-technology management (without IT management) are excluded from the RMSP definition — data centres get their own regulated category instead.
- Duties include: registering with the Information Commission (the regulator), appointing a UK representative if you're overseas-based, running appropriate and proportionate risk-management measures, keeping security proportionate to risk using state-of-the-art methods, and notifying the regulator of significant incidents.
- Once the relevant provisions commence, RMSPs get three months to register — but security duties apply from commencement, not after registration.
The wider Bill-level incident reporting regime — which applies to RMSPs too — is a two-stage process: initial notification to the regulator and NCSC/CSIRT within 24 hours of becoming aware of a significant incident, then a fuller report within 72 hours. Affected customers have to be told "as soon as reasonably practicable" if they're likely to be hit.
What's still genuinely open
Two things the factsheet does not settle, and that nobody should be claiming are settled: exactly what counts as a "significant" incident triggering the 24/72-hour clock, and the precise size or turnover thresholds that separate an in-scope RMSP from an exempt small/micro provider. Both are left to secondary legislation that hasn't been published yet. Anyone telling you the exact numbers before it's published is speculating — including some of the penalty figures (the £10m/2%, £17m/4% turnover-based tiers you may have seen quoted) which are consistently reported across law-firm trackers but haven't been independently verified against the Bill's actual clauses in this update.
Estimates of how many MSPs will end up in scope also vary by source — figures ranging from roughly 900 to over 1,200 firms have been cited depending on which threshold assumptions are used. There isn't one definitive number yet, and there won't be until the secondary legislation lands.
What this means for your business
None of the above changes what's sensible to do in the meantime: know whether you'd plausibly count as medium/large under current thinking, and know what a registration and incident-reporting workflow would need to look like for your stack. Gap-analysis and registration-readiness work doesn't need to wait for a commencement date to be useful.
For practical groundwork alongside this, the kits cover tasks such as answering supplier security questionnaires and preparing Cyber Essentials answers.
If you're a small business rather than an MSP, our Small Business Cyber Starter Checklist is a place to start, one topic at a time.
Secordit Intelligence products are operational intelligence and compliance readiness materials. They do not constitute legal advice and do not guarantee regulatory outcomes.
Last reviewed: 1 July 2026.
