A register of hostile cyber states was forced into the government's bill by an opposition vote in the Lords. The clause that creates it has no penalty if a minister simply misses its deadline.
Estimated reading time: 7 minutes
In short. On 26 October 2026 the House of Lords voted 194 to 155 to insert a new clause into the Cyber Security and Resilience (Network and Information Systems) Bill, moved by the opposition peer Lord Markham, not the government [4]. It requires the Secretary of State to keep a public register of foreign states GCHQ confirms have attacked, or warns may attack, UK critical infrastructure [3]. The Bill reaches Third Reading in the Lords today, 2 November 2026, unchanged on this point [2] [5]. Two things undercut the clause as drafted: its own commencement date is left to a minister's discretion with no deadline to set one, so the six-month clock inside it may never start, and even once running, nothing in the clause penalises a missed deadline. Separately, the register's entire substance depends on GCHQ choosing to "confirm" or "warn" about a state, a term the Bill never defines and never puts GCHQ under any duty or timetable to do. Two documented mistakes: four stars.
The Cyber Security and Resilience (Network and Information Systems) Bill is the government's vehicle for updating the UK's 2018-era network and information systems rules: wider scope to cover data centres and managed service providers, new powers to direct operators and vendors on national security grounds, and a serious enforcement regime behind it [3]. It had its first reading in the Commons in November 2025 and has been through Commons report stage and Lords committee since [1] [2]. Report stage in the Lords, on 26 October, was the first point at which peers could force a vote rather than simply debate [4]. They used it twice in quick succession: Amendment 163, a review of the whole NIS regime moved by the crossbench peer Lord Birt, passed 202 to 155, and Amendment 164, Lord Markham's foreign-powers register, passed 194 to 155 [4]. Both are now sections 66 and 67 of the Bill as printed after Report [3].
The claims, tested
| The clause's own words | What the rest of the Bill actually does | Verdict |
|---|---|---|
| Section 67(1): the Secretary of State "must... within six months of the day on which this Act is passed, establish and maintain a register" of risk-posing foreign powers [3] | Section 69(3): "the other provisions of this Act come into force on such day as the Secretary of State may appoint by regulations", with no deadline to appoint one. Section 67 is not one of the provisions the Bill commences automatically on Royal Assent; those are limited to Part 1, three chapters of Part 3 and section 41 (section 69(1)) [3] | The six-month deadline only starts once a minister separately switches section 67 on. Nothing requires that to happen by any date, and nothing in the clause penalises either a delayed start or a missed deadline once it does |
| Section 67(2): the register "must include" states GCHQ "has confirmed" carried out an attack, or "has warned" pose a risk [3] | "Confirmed" and "warned" are not defined anywhere in the Bill. GCHQ is mentioned elsewhere only as a recipient of data-sharing duties owed to it by the Information Commission, never as a body placed under any duty or timetable to confirm or warn about anything for this purpose [3] | A Secretary of State who maintains an empty register, because GCHQ has not formally used either word, is in full compliance with section 67, regardless of how many attacks NCSC, allied governments or open-source reporting have already attributed to a state |
A deadline with no clock, and no penalty if it runs anyway
Section 67 sits in Part 4 of the Bill, among the national security direction powers. Its own text reads like a firm commitment: establish the register within six months, review the risk each state poses, report the findings to Parliament within a further six months [3]. But the commencement clause that governs when any of this starts treats section 67 as entirely ordinary. Section 69(1) lists, by name, the parts of the Act that come into force automatically the day it receives Royal Assent: Part 1, three specific chapters of Part 3, and section 41, a separate reporting duty on network and information systems legislation generally [3]. Section 67 is not on that list. Like most of the Bill, it commences "on such day as the Secretary of State may appoint by regulations", under section 69(3), and nothing in section 69 puts a limit on how long a minister can wait before appointing that day [3].
That matters because every deadline inside section 67 is written relative to commencement, not to Royal Assent: "within six months of the day on which this Act is passed" starts counting from when section 67 itself takes effect, not from the vote that put it there [3]. A government that preferred not to maintain the register at all could, consistently with the text as it stands today, simply never make the commencement regulations that start the clock. And even for a government that does commence it on time, missing the six-month deadline carries no stated consequence anywhere in the clause: no fine, no duty to explain the delay to Parliament, nothing. Compare that with how the same Bill treats operators a few clauses earlier. Section 54 sets financial penalties of up to £17,000,000, or the greater of that figure and 10 per cent of worldwide turnover where the relevant regulations are in force, for breaching a national security direction, plus a daily rate of up to £100,000 for continuing non-compliance [3]. The drafters plainly know how to attach a penalty to a missed obligation. They did not do it here, for the one duty that falls on the Secretary of State rather than on industry.
The register's content depends on a word the Bill never defines
The second gap sits in what actually populates the register. Section 67(2) is specific about who must go on it: states GCHQ "has confirmed" perpetrated or attempted a cyber attack on UK operators of essential services or critical suppliers in the preceding seven years, through a state department, agency or affiliate group, or states GCHQ "has warned" pose a risk to the same systems [3]. Nowhere in the Bill is "confirmed" or "warned" defined: not a form of words, not a publication requirement, not a classification level, not a time limit within which GCHQ must say anything at all. The Bill mentions GCHQ in five other places, every one of them about data the Information Commission must forward to GCHQ to help it do its existing job, not about any duty GCHQ owes back [3]. Section 67's register is the one place in the Bill where GCHQ's own output becomes the legal trigger for a minister's statutory duty, and it is also the one place that output is left entirely undefined. If GCHQ never issues anything it would describe internally as a "confirmation" or a "warning" for a given state, however many attacks the National Cyber Security Centre or allied intelligence services have already attributed to it in public, the Secretary of State has nothing to add to the register and no obligation has been missed.
This is not the limit the amendment's own sponsor hid. Introducing the clause, Viscount Camrose told the House plainly that it "would not require the publication of sources, substance or method", and that "Parliament would know simply that a designation had occurred and a subsequent review had been undertaken" [4]. That is a defensible, disclosed trade-off about what gets published once a state is on the register. It is a different question from whether a state gets onto the register at all, which section 67(2) ties entirely to GCHQ's own, unscheduled choice of words.
Two documented mistakes, four stars. (1) Section 67's deadlines run from its own commencement, which the Bill leaves to the Secretary of State's discretion under section 69(3) with no date by which commencement must happen, and even once running, missing a deadline carries no stated penalty anywhere in the clause, unlike the up-to-£17,000,000 and £100,000-a-day penalties the same Bill imposes on operators a few sections earlier. (2) The register's actual content depends on GCHQ "confirming" an attack or "warning" of a risk, terms the Bill never defines and never puts GCHQ under any duty or timetable to use, so an empty register would satisfy the clause regardless of how many attacks have already been attributed to a state through other channels.
Credit where due
The clause is not toothless by design in every respect. Section 67(6) requires that any regulations made under it be approved by a resolution of both Houses before they can take effect, a real parliamentary check on how the register is set up, not a power a minister can quietly use alone [3]. Section 67(5) builds in an honest release valve rather than a silent one: if a report cannot be laid for national security reasons, the Secretary of State must say so to Parliament explicitly, rather than simply not publishing [3], and that limit was stated openly on the floor of the House by the clause's own sponsor before the vote, not discovered afterwards [4]. And the definition of "foreign power" itself, covering heads of state, governments, their agencies and governing parties, is detailed and leaves little room for dispute about who counts, even if the trigger for listing one does not [3].
Sources
- Cyber Security and Resilience (Network and Information Systems) Bill, UK Parliament Bills API, bill record.
- Bill stages, UK Parliament Bills API, including Third Reading listed for 2 November 2026.
- HL Bill 62 (as amended on Report), full bill text, UK Parliament Bills API, 26 October 2026.
- Cyber Security and Resilience (Network and Information Systems) Bill, Report stage, House of Lords, Hansard, 26 October 2026.
- HL Bill 62-I, Marshalled list of amendments to be moved on Third Reading, UK Parliament Bills API, 30 October 2026.