A board-level issue, managing cyber risk is now recognised as a business resilience necessity carrying operational, regulatory, financial, and reputational exposure and, at worst, existential threat.

The numbers tell their own story. According to the UK Government's Cybersecurity Breaches Survey 2025/26, 43% of businesses identified a cyber security breach or attack in the previous 12 months. The figure rises to 65% of medium-sized businesses and 69% of large businesses, with phishing remaining the most common and disruptive attack type.

The threat is particularly acute in sectors where operational technology, manufacturing systems and supply chains are increasingly interconnected. A recent Make UK survey reveals that 30% of UK manufacturers experienced a cyber incident affecting either their own business or their supply chain in the previous 12 months. Only half of those manufacturing businesses had a cyber incident response plan in place. The consequences included lost production time, increased costs and disruption to deliveries, reinforcing the importance of cyber resilience as a core element of business continuity and operational resilience planning.

In this intensified risk environment, the UK Government is progressing the Cyber Security and Resilience (Network and Information Systems) Bill (CSRB), the most significant reform of the UK's cyber security regime since the introduction of the Network and Information Systems Regulations 2018 (NIS Regulations). The Bill is intended to strengthen the resilience of critical services and the supply chains that support them, responding to the increasingly volatile threat landscape and growing concerns about national security, economic resilience and public safety.

For many businesses, the key question is less centred on whether the CSRB will directly apply to them and more about how its requirements may influence customers, suppliers and wider market expectations. Organisations outside its immediate scope are likely to feel its effects through altered customer requirements, procurement expectations, supply chain obligations, insurance requirements and industry best practice.

In this article, we examine the latest developments in the CSRB, the key regulatory changes businesses should be aware of, how the legislation fits into the wider cyber compliance landscape, and the practical steps organisations can take now to strengthen cyber resilience and prepare for future obligations.

Quick links:

The Bill at a glance

The reforms are intended to strengthen the protection of services that people and businesses rely on every day, including healthcare, energy, transport, drinking water and digital infrastructure, while improving the UK's ability to respond to threats posed by cyber criminals and hostile state actors.

Key features include:

  • Expansion and modernisation of the existing NIS Regulations;
  • Stronger incident reporting obligations;
  • Enhanced powers for regulators;
  • Greater visibility of cyber risks across critical supply chains;
  • New powers to regulate certain critical suppliers;
  • Bringing additional digital and managed service providers into scope;
  • Improved information-sharing and oversight arrangements.

Read more: The UK Cyber Security and Resilience Bill and what it means for your business.

What stage is the Bill at now?

The CSRB is in its final stages, now at Report Stage in the House of Lords. During the Committee stage, members debated amendments on AI regulation, data centre incidents and senior executive liability – areas that continue to attract scrutiny in today's geopolitical climate. Some proposed changes reflect calls for stronger oversight of frontier AI to address cybersecurity and public safety risks. The forthcoming Committee Report will confirm which amendments proceed to shape this landmark legislation.

Why secondary legislation may matter most

Although the CSRB will establish the new legal framework, many of the details businesses need to have are likely to emerge through secondary legislation, regulatory guidance and codes of practice attached to the CSRB. Further detail is likely to be set out relating to: reporting thresholds; notification timeframes; security requirements; definitions of critical suppliers; enforcement expectations; and sector-specific obligations. In practice, these specifications will prove just as important as the primary legislation itself.

Organisations should therefore monitor not only the CSRB's progress through Parliament but also the regulatory consultations, new law and guidance which will inevitably follow.

Cybersecurity regulation extends beyond the CSRB

One of the most important points for organisations to understand is that the CSRB is not intended to regulate every business operating in the UK. Its primary focus remains on operators of essential services; critical national infrastructure; certain digital service providers; and organisations supporting those services through critical supply chains. It is targeted legislation designed to protect services whose disruption could have significant impacts on the economy, public services and national security.

Whilst the CSRB will overhaul the national cybersecurity backbone, there is, alongside it, an increasingly complex cyber regulatory landscape, in the UK and beyond, for businesses to navigate.

For example, businesses may also need to take into account:

  • EU NIS2 (Network and Information Security (2) Directive);
  • UK Product Security and Telecommunications Infrastructure regime (PSTI);
  • EU Cyber Resilience Act (CRA);
  • EU Machinery Regulation, and the UK's update to the Supply of Machinery (Safety) Regulations
  • EU AI Act (for high-risk AI systems)
  • sector-specific regulatory requirements
  • data protection, privacy and security requirements under UK GDPR, Data Protection Act (DPA) 2018 and Privacy and Electronic Communications Regulations 2023 (PECR).

The EU Cyber Resilience Act in particular introduces mandatory cybersecurity requirements for products with digital elements throughout their lifecycle and has implications for many businesses operating within European markets. Its reporting obligations apply from 11 September 2026 with main obligations applying from 11 December 2027. The European Commission recently published practical guidance to help manufacturers and businesses comply with the CRA's requirements. Read more about the requirements of the EU CRA and the UK's PSTI regime: Product Cybersecurity How to comply with UK and EU law.

A growing challenge for organisations is therefore understanding how multiple cybersecurity related legal frameworks interact across different jurisdictions and sectors.

AI-driven cyber risk: why businesses must prioritise resilience

The CSRB is progressing through Parliament against a backdrop of rapidly evolving national cybersecurity threat. AI is transforming both sides of the cyber equation. Cybersecurity specialists will deploy AI vulnerability detection tools to strengthen detection, monitoring and response capabilities.

At the same time, threat actors are deploying AI to scale attacks, create convincing impersonations and identify vulnerabilities more quickly. Most days media warnings highlight the risk of AI tool deployment by threat actors to optimise and innovate phishing, impersonation and social engineering attacks. For example, recent reports highlight the rise of so-called "synthetic insider" attacks, where AI-generated identities and credentials are used to gain trusted access to organisations from within.

Cybersecurity experts have reported seeing two main changes in the nature of ransomware attacks due to AI: better exploitation of stolen data during an attack, and monetisation of stolen data at a later date after the initial attack, adding a second level of victimisation.

In May 2026, the Information Commissioner's Office (ICO) published guidance setting out five practical steps organisations should take to protect themselves against AI-powered cyber threats - including AI-enhanced phishing, deepfake social engineering and AI-powered malware - urging businesses to invest in layered cyber defences and ensure appropriate security measures are in place to protect the personal data they hold.

Agentic AI, now moving from pilot phase to production in many businesses, poses further, emerging, and even greater cybersecurity risk. Rather than task-specific automation, AI agents plan, decide and act across multiple steps and systems, often on behalf of users and teams. High impact threats to cybersecurity from agentic AI include agent hijack, tool misuse and exploitation, identity and privilege abuse, agentic supply chain vulnerability, memory and context poisoning, insecure inter-agent communication, human agent trust exploit and rogue agents.

Read more: AI agents: why governance, oversight and guardrails matter more than ever.

Ransomware risk and the growing debate over cyber extortion payments

Ransomware remains one of the most significant cyber threats facing organisations globally. High-profile incidents continue to reignite debate in cybersecurity and legal spheres, around whether ransomware payments should be permitted, restricted, or prohibited, with businesses often caught between operational necessity and wider policy concerns.

Cyber insurance and cyber security governance

From an insurance perspective, there is increasing scrutiny of cybersecurity governance arrangements, incident response planning, supplier management and cyber maturity when assessing risk. Organisations demonstrating effective cyber governance may find themselves in a stronger position when seeking cover or managing claims following an incident. Agentic AI risk is evolving the cyber insurance industry still further.

NCSC Guidance

The National Cyber Security Centre (NCSC) continues to push cyber resilience higher up the corporate agenda. The NCSC's Cyber Governance Code of Practice identifies five key areas for director oversight: risk management, strategy, people, incident planning, response and recovery, and assurance and oversight.

The NCSC offers two further key tools: Cyber Essentials, the Government-recommended certification scheme that helps organisations of all sizes protect against the most common internet-based cyber threats by implementing five foundational technical controls; and the Cyber Assessment Framework (CAF), a more comprehensive framework designed primarily for operators of essential services and critical national infrastructure to systematically assess and improve their cyber resilience - both of which, if adopted, will significantly strengthen a business's ability to prevent, detect and respond to cyber incidents.

Businesses should also be signed up to the NCSC's free Early Warning service, which monitors information feeds from public, commercial and closed intelligence sources and sends organisations tailored alerts about malicious activity, vulnerabilities and potential compromises detected on their networks, giving them crucial early notice to act before threats escalate.

How to prepare for the Cyber Security and Resilience Bill

The Cyber Security and Resilience Bill is in its last stages of its passage through Parliament now. Royal Assent may be granted towards the end of this year turning the bill to law. Regardless of whether your organisation falls directly within scope of the CSRB, these are key steps to take now:

  1. Brief the board

    Cyber risk should be discussed alongside other strategic business risks, with clear accountability and regular reporting.

  2. Review critical suppliers

    Understand which suppliers support your most important services and assess whether appropriate contractual and operational protections are in place.

  3. Collaboration

    Partnership and knowledge-sharing across disciplines is critical. Legal, security, data, product design and operational teams need to be connected.

  4. Test incident response plans

    Plans should be regularly rehearsed and include legal, operational, communications and regulatory workstreams.

  5. Assess AI-related cyber risks

    Consider how AI may affect your threat profile, fraud exposure and identity management controls.

The most significant compliance obligations for many businesses will emerge through secondary legislation, regulator, NCSC and sector-specific guidance rather than the CSRB itself. The CSRB is only one part of a rapidly evolving cyber risk and regulatory landscape in the UK and businesses trading internationally must also ensure compliance in the EU and beyond.

Our Cyber Security and Resilience team advises organisations across a range of sectors on cyber resilience, incident response, regulatory, compliance and cyber risk management. If you would like to discuss the implications of the Bill and other cybersecurity laws for your business, speak to Amber Strickland, Sarah Gray or a member of the team for more information.