Summary

  • Current UK rules require a minister to publish an NIS national strategy and require regulators to have regard to it. The Cyber Security and Resilience Bill would remove those provisions and let the Secretary of State designate a replacement priorities statement.
  • The Bill makes the first regulator-compliance report a duty, but starts its first twelve-month period only when that statement is published. The text gives no date for that first publication; a separate, broader review would begin its five-year cycle when the Act is passed.

The first year has a missing date

Suppose Parliament wants to compare how the UK’s sector regulators put a national cyber priority into practice. The draft Cyber Security and Resilience (Network and Information Systems) Bill offers a recurring report for that purpose. But before anyone can ask when the first report is due, one date has to exist: the day the first strategic-priorities statement is published.

That date is the hinge in clause 28. Its first reporting period is the twelve months beginning on publication of the first statement designated under clause 25. At the end of each period, the Secretary of State must lay a report before Parliament and publish it. The report is to describe, in general terms, how regulators complied with their duties during the year and how they plan to comply in the next one.

Clause 25, however, says that the Secretary of State may designate a statement, provided the procedure in clause 26 is followed. The Bill does not set an outer date by which the first statement must appear. Read together, the clauses make annual reporting compulsory after the first statement, but do not give the first year a calendar start. That is a conclusion from the proposed wording, not a prediction that a minister will withhold a statement.

A change from “must” to “may”

The contrast becomes clearer beside the rules already in force. Regulation 2 of the Network and Information Systems Regulations 2018 requires a Minister of the Crown to designate and publish an NIS national strategy. Regulation 3(6) requires the competent authorities and the Information Commission to have regard to that strategy. The text of HL Bill 49 would omit both provisions from the Regulations.

The replacement is not a word-for-word continuation. Clause 25 would let the Secretary of State designate a statement of government priorities, roles and responsibilities, and objectives for regulators. Clause 27 would then require each regulator, while a statement is designated, to have regard to it and seek to achieve relevant objectives. In the February Commons committee debate, the minister described the statement as replacing the existing national strategy and said the three-year rule was intended to give regulators enough stability to plan.

There is a practical case for the change. The Government says twelve sectoral regulators administer the NIS framework. Their expertise matters because cyber risks differ between energy, health, communications, water and digital services. At the same time, the Government has argued that the regulators have sometimes taken divergent approaches. A shared priorities statement could give them a common direction without requiring identical sector rules.

But the legal switch matters. Under the current regulation, the duty to produce a national strategy is part of the standing framework. Under the Bill, the statement that activates the new duties is an executive choice. The clause does not require the Secretary of State to choose a date, publish a timetable or explain a decision not to designate. That leaves the first annual accountability period dependent on a separate act of ministerial publication.

The statement has checks, but no launch deadline

If a Secretary of State chooses to proceed, clause 26 sets a sequence. The Minister must consult the regulatory authorities on a draft and allow at least forty days for responses. After considering the responses, the Minister must lay the statement before Parliament. A further forty-day period follows. If either House resolves not to approve it during that window, the statement cannot be designated.

Those steps create scrutiny around a proposed statement; they do not set the date on which the process must begin. Even after the statement is designated, the Bill generally bars an amendment or withdrawal for three years. It allows an earlier change after a general election or where the Secretary of State considers that government policy or the nature of threats has changed significantly. The structure offers planning stability once priorities exist, while reserving a route to respond to specified changes. It says less about how quickly the first priorities must be put in place.

The annual report also has a narrower job than its label might suggest. It must describe regulator compliance and plans “in general terms”. It can make actions visible to Parliament and support questions to ministers, as the Commons debate anticipated. But the clause does not by itself require an independent audit of whether cyber resilience improved, whether incidents fell, or whether public services became more recoverable. Compliance with a priorities statement and the outcome of the whole regime are different measures.

A second clock asks a different question

Clause 40 creates the broader review. It requires the Secretary of State to report at least once every five years, beginning with the day the Act is passed. The review covers the operation of specified NIS legislation, whether its objectives were achieved and remain appropriate, whether less onerous alternatives could achieve them, and how the Secretary of State exercised powers under the Bill.

The House of Lords Constitution Committee argued that five years was too long for a fast-moving field in which the Bill grants significant ministerial powers. On 13 October, Lord Clement-Jones tabled an amendment to replace “5” with “2” in clause 40. That proposal remained pending at the research cutoff; it had not changed the printed bill. The amendment would shorten the broader review interval. It would not, by itself, set a date for the first clause 25 statement or start the first clause 28 year.

The Government’s response in the earlier Commons debate was that a full cross-sector review takes time and that annual reports on the priorities statement provide more frequent monitoring. The distinction is defensible: a short annual account of regulator activity is not the same exercise as assessing the legislation’s effectiveness, alternatives and ministerial powers. But that defence assumes the statement is published. If the first period has no fixed trigger, the annual channel cannot serve as a calendar-based backstop before it begins.

As of 14 October 2026, the Bill is still before the House of Lords. HL Bill 49, amended in Grand Committee on 7 September, is the latest reprinted text; Report stage is scheduled for 26 October. It is not law. The 13 October list records proposals for that stage, not decisions already made. Any future effect would also depend on passage and commencement.

The important question is therefore not whether the Bill promises reports: it does. It is whether Parliament wants the first reporting year to start on a date chosen later by the executive, or to require a visible timetable for activating the new framework. A deadline for the first statement could preserve the consultation and parliamentary scrutiny while making the start of the annual cycle knowable. A fallback report could expose delay, but would need a clear account of what regulators should report before common priorities exist.

Either design would separate a minister’s choice about policy direction from Parliament’s ability to see when oversight begins.

The Bill’s shift from a required national strategy to a discretionary statement may offer flexibility and a route to more consistent direction. It also moves the first accountability clock behind a publication gate. Once a statement exists, the annual duty is real. Until then, the Bill supplies no fixed date against which the public or Parliament can measure the wait.

Sources