A new power in Britain's cyber security bill lets ministers force energy, water and NHS suppliers to report vendor risks. It stays voluntary until the risk profile changes, a test the government never defines or dates.
Estimated reading time: 7 minutes
In short. The Cyber Security and Resilience (Network and Information Systems) Bill reached Third Reading in the House of Lords on 2 November 2026 and now awaits the Commons' consideration of Lords amendments, with no date yet listed [5]. The next day, the government's own factsheets page for the Bill was updated with two new entries [6]: a vendor risk management framework and a commitment to consult on "agentic AI" incidents. The vendor framework already has a statutory, Parliament-scrutinised power to convert its voluntary referral scheme into a compulsory one for operators in energy, water, transport, health and digital infrastructure [1]. The government's own memo accompanying the clause says that will happen only "if the risk profile changes", a phrase it never defines, measures or dates [4]. The agentic AI commitment fares worse: it promises to consult on measures at an unstated future date, while explicitly ruling out "a comprehensive framework for AI governance" [2]. Two documented mistakes: four stars.
The Bill updates the UK's 2018-era network and information systems regime: wider scope for data centres and managed service providers, new powers to direct operators and vendors on national security grounds, and a penalty regime behind it running up to £17,000,000 or 10 per cent of worldwide turnover [3]. Trackedchanges torn this Bill down once already, on 2 November, over a different clause: a register of hostile foreign states that Lord Markham forced into the Bill by a Report-stage vote, left with no commencement deadline and no penalty for missing one. The vendor risk and agentic AI material is new, published the day the factsheets page was last updated, and it concerns a part of the Bill that clause did not touch.
The vendor risk framework itself has a history worth setting out. The government laid 64 amendments introducing it on 24 August 2026, then chose not to move them at Committee Stage "to enable the government to work with peers on the concerns raised during the debate", re-tabling a revised version for Report Stage on 19 October [4]. What emerged, now sections 44 to 47 of the Bill as amended on Report, creates a power for the Secretary of State to direct an in-scope operator over a risky vendor, plus a separate power to require operators to refer certain procurement decisions to government before they go ahead [3].
The claims, tested
| The factsheet's own words | What the government's own memo says | Verdict |
|---|---|---|
| "We will seek to introduce a new vendor risk management framework" with "a voluntary referral route" as one of three parts, applying "to begin with" only to operators in energy, drinking water, transport, health, digital infrastructure and data infrastructure [1] | The Supplementary Delegated Powers Memorandum: the same clause gives the Secretary of State a separate power to "convert the voluntary referral process into a mandatory process with consequences for non-compliance", usable whenever the Secretary of State "considers that it is necessary and appropriate in the interests of national security", and that this will happen "if the risk profile changes" [4] | The framework as described to the public is voluntary; the framework as enacted already contains the compulsion, waiting on a term the government has chosen never to define, measure or put a date against |
| "The government will consult on using these regulation-making powers to introduce measures to help regulated entities manage agentic loss of control incidents", while adding that "these measures are not intended to establish a comprehensive framework for AI governance or to tackle general AI harms" [2] | No consultation date, timetable or review point appears anywhere in the factsheet. The power behind it is the Bill's general delegated power to change the regime "through secondary legislation", the same mechanism used for routine scope changes elsewhere in the Act [2] | A government that has already put a defined figure, £40 million, and an undefined mandate into an "agentic" security unit this Budget now adds a second, differently worded "agentic" commitment to a different bill, with no date for even starting the consultation that would define it |
A switch the public cannot see flipped
Section 47 of the Bill, "Power to establish mandatory referral scheme", lets the Secretary of State make regulations requiring operators in scope of the vendor direction power "to refer certain procurements to the government for clearance" [4]. The memorandum is candid about why: "the government determines that a voluntary referral scheme... bolstered by a backstop direction power, is sufficient to mitigate risks. However, it may be necessary to establish a mandatory referral scheme in the future, if the risk profile changes" [4]. Nothing in the Bill, the factsheet or the memorandum says what would count as a changed risk profile, who assesses it, or how often it is reviewed. The nearest the memorandum comes to a standard is procedural, not substantive: "any mandatory referral scheme will be established after the voluntary referral scheme has been operational and extensively socialised with entities in scope" [4], a test about how long the voluntary scheme has existed, not about how risky vendors have become.
This is not a power exercised in secret. A statutory instrument making the referral scheme mandatory needs the draft affirmative procedure, meaning both Houses of Parliament must approve it before it takes effect [4]. But Parliament's role starts only once a minister decides to move. Until then, the factsheet given to the public and to operators describes a voluntary, guidance-led scheme without once mentioning that the statute underneath it already lets a minister switch that off on a test nobody outside government can check.
A second undefined "agentic" promise in a fortnight
The agentic AI resilience factsheet opens by linking the measure to "recent developments and incidents" that have "sharpened the question of whether the UK's essential services are prepared for cyber and agentic loss of control risks" [2]. It commits to four future measures, including security requirements, notification duties, evidence preservation and ministerial post-incident review powers, all "following consultation" and all subject to the affirmative procedure once drafted [2]. None of that is dated. The factsheet does not say when the consultation opens, how long it runs, or when the resulting regulations might be laid.
This is the second time in a fortnight that the government has put a specific sum or a specific delegated power behind an undefined "agentic" risk without tying it to a working definition. HM Treasury's Autumn Budget, published 28 October, set aside £40 million for a National Agentic Security Unit to handle "rogue agentic incidents", a phrase this site found undefined anywhere in the Budget's 166 pages. The NIS Bill's own factsheet now promises to work out a definition of "loss of control" risk only after consulting "with industry, oversight authorities, and other relevant organisations" [2], with no stated relationship to the Budget's unit, its own wording, or its £40 million. Two government documents, two different phrases for an AI agent acting outside its intended bounds, and nothing in either saying whether they describe the same problem.
Two documented mistakes, four stars. (1) The vendor risk management factsheet describes a voluntary, guidance-led scheme without disclosing that the same clause already contains a Parliament-scrutinised power to make referral compulsory, triggered by "the risk profile changes", a phrase the government's own Supplementary Delegated Powers Memorandum never defines, measures or dates. (2) The agentic AI resilience measures factsheet commits to a future consultation on managing "agentic loss of control" incidents with no date, timetable or review point, the second undefined "agentic" risk commitment from government in a fortnight after the Autumn Budget's £40 million National Agentic Security Unit, with nothing in either document reconciling the two.
Credit where due
The vendor risk clauses are not a power exercised without scrutiny. Both the initial vendor direction power and any future move to a mandatory referral scheme require the draft affirmative procedure, meaning a minister cannot act until both Houses approve the regulations [4]. The memorandum is also explicit that the power "will not" be used to raise penalties for the referral scheme beyond what the Bill already sets for other breaches, a limit stated up front rather than left to be discovered later [4]. And the government did not simply push the original vendor amendments through: it withdrew them at Committee Stage specifically to address concerns peers raised, re-tabling a revised version two months later, and the responsible minister wrote to peers in the meantime answering direct questions about why the power sits with the Secretary of State rather than GCHQ [7]. That is a genuine, visible concession to scrutiny, not a cosmetic one.
Sources
- Vendor risk management, Cyber Security and Resilience (NIS) Bill factsheet, GOV.UK, updated 3 November 2026.
- Agentic AI resilience measures, Cyber Security and Resilience (NIS) Bill factsheet, GOV.UK, updated 3 November 2026.
- HL Bill 62 (as amended on Report), full bill text, UK Parliament Bills API, 26 October 2026.
- Supplementary Delegated Powers Memorandum, Cyber Security and Resilience (NIS) Bill, Lords Report stage, UK Parliament Bills API, 19 October 2026 (pages 1 and 5).
- Bill stages, UK Parliament Bills API, Third Reading in the Lords listed 2 November 2026, Commons consideration of Lords amendments listed with no date.
- Cyber Security and Resilience (Network and Information Systems) Bill: factsheets, GOV.UK, collection page, updates log showing 3 November 2026 additions.
- Letter from Baroness Lloyd of Effra to Peers, responding to Committee Stage questions on vendor risk management responsibility, UK Parliament deposited papers, 3 September 2026.