June has seen the latest milestone in the UK Cyber Security and Resilience Bill, taking us one step closer to this important mandatory regulation for essential UK services and their supply chains. The legislation successfully concluded its report stage and third reading in the House of Commons on 16 June 2026, marking the end of its time in that chamber. Following this, it was reintroduced to the House of Lords on 17 June as HL Bill 32, where the second reading is now scheduled for 14 July.
What this means is that we are now drawing very close to the implementation of the Bill, requiring organisations and their supply chains within the designated sectors to abide by the new requirements. The proposed amendments intend to expand the types of entities subject to cybersecurity and business resilience regulations, imposing stricter obligations regarding the reporting of incidents, and adding more focus on supply chains.
Alongside these changes, the bill seeks to increase enforcement powers and penalties for non-compliance to deter lapses in security and business resilience. While specific updates on the EU NIS2 Directive remain ongoing, businesses in the UK are encouraged to align their compliance efforts with both the domestic Bill and the European directive to ensure complete coverage.
There is no doubt at all that the CSRB underscores the practical necessity for organisations to review their current position and prepare for higher standards before the law fully takes effect.
If you don’t know about CSRB and want o learn more, visit our CSRB resource page.
