The Cyber Security and Resilience Bill: a new era for data centre regulation

Since July 2024, £45 billion of private investment has been committed to the sector, with hyperscalers betting heavily on UK capacity to fuel AI-driven compute demand. That growth makes data centres strategically indispensable and an increasingly irresistible target.

As facilities expand, so does the attack surface that must be protected. Modern data centres are deeply interconnected - with cloud infrastructure, with the energy grid and with the supply chains that keep them running.  A targeted intrusion on one system can cascade rapidly across others. Where a facility serves hyperscalers or financial institutions with their own interconnected infrastructure, the downstream consequences of an outage extend far beyond the data centre itself.

That interconnectedness also makes AI-enabled attacks particularly dangerous.  OpenAI, Anthropic and Meta have all disclosed incidents in which their models demonstrated the ability to conduct attacks autonomously and without human instruction. Lord Clement-Jones, a Liberal Democrat peer in the House of Lords, recently proposed a "kill switch" amendment to the Bill itself, allowing state intervention should an AI model malfunction or be weaponised.  The UK Government has resisted the amendment, stating that, "Britain cannot simply turn AI off", but the exchange illustrates how directly AI risk now intersects with the protection of critical national infrastructure.

The Bill amends the Network and Information Systems Regulations 2018 (NISR), which already regulates operators of essential services in sectors including energy, transport, water and health, as well as relevant digital services including online marketplaces, search engines and cloud computing services. The Bill brings data centres into scope as a new category of "essential services" under NISR.

The definition of a "data centre service" is intentionally broad, covering both the physical structure (housing, connecting and operating IT equipment) and the supporting infrastructure (electricity supply, cooling and environmental control systems, HVAC, and security and resilience systems).

Not all data centres will fall within scope. The Bill applies size-based thresholds:

The obligations apply regardless of whether the operator is UK-established, provided the service is delivered in the UK.

Ofcom is established as the operational regulator for data centres.

Operators must implement "appropriate and proportionate" measures to manage risks to the network and information systems on which the data centre service depends and must take steps to prevent and minimise the impact of incidents to ensure service continuity. Detailed requirements will emerge through secondary legislation and statutory Codes of Practice issued by the Secretary of State (following consultation and parliamentary scrutiny). In addition, the Secretary of State has specific powers to direct regulated entities to take mandatory steps to mitigate national security risks, with directions issued under this power taking precedence over other legal or regulatory requirements.

The new regime significantly expands incident reporting obligations.  It also enables the NCSC to build a more immediate, centralised picture of threats as major incidents unfold, supporting national response planning.

The Bill introduces a two-stage regime, considerably more demanding than the current NISR requirement to report "without undue delay" and in any event within 72 hours:

• Stage 1: Initial notification to Ofcom and the NCSC within 24 hours of becoming aware of an incident.
• Stage 2: Full notification within 72 hours.

The definition of a reportable incident is broader than the current framework. Under NISR, operators must only report incidents that have "a significant impact on the continuity" of services. In other words, the current regime is concerned with disruptions that have already materialised. The Bill replaces this with a definition that captures any incident capable of having a significant impact. Specifically, a reportable "data centre incident" includes incidents having a significant impact on the operation or security of the network and information systems relied on to provide the service, incidents affecting the continuity of the service itself, and any other incident with a significant impact in the UK or any part of it. Near-misses, ransomware attempts and pre-positioning attacks all fall within scope, whether or not the threat ultimately materialises.

Operators must also notify affected customers "as soon as reasonably practicable" following an incident, creating a new layer of transparency obligations with direct commercial consequences for those serving hyperscalers, financial institutions and other enterprise customers managing their own regulatory requirements.

Operators must register with Ofcom within three months of the relevant provisions coming into force, providing specified information on operations, ownership and key contacts, with ongoing obligations to maintain records, notify significant changes, and respond to regulatory information requests.

 The Bill introduces a tiered penalty regime:

Non-compliance also carries the risk of contractual liability to affected customers and reputational damage.

Regulators are separately empowered to recover their full costs of oversight, enforcement and supervision through published charging schemes. Compliance is, in other words, a recurring fixed cost of doing business in this sector.

The Bill gives regulators the power to designate certain businesses as "critical suppliers" to regulated entities, drawing them into the NIS regime even if they would not otherwise fall within scope. Providers of specialist cooling, power management infrastructure or security services to data centres could find themselves directly regulated as a result. The risk this is designed to address is real: according to the IBM 2025 Cost of a Data Breach Report, third-party vendor and supply chain compromise was the most reported cause of data breaches among UK organisations surveyed, accounting for 18% of incidents, ahead of phishing at 16% and compromised credentials at 11%.

IT managed service providers (MSPs) are also brought within scope as a new regulated category, which should improve systemic resilience given how many data centre operators outsource significant IT functions to MSPs.

The Secretary of State also retains power through secondary legislation to expand the regime to cover entirely new sectors and entities, so supply chains not currently in scope could be caught in future rounds.

The obligations carry consequences well beyond the compliance function. Investment decisions will increasingly need to weigh resilience alongside capacity. Operators that can demonstrate strong incident management and governance are likely to find this translates into commercial advantage, as hyperscalers and financial firms are already requesting evidence of incident response and business continuity plans as a condition of tenders and contract renewals. For investors, resilience KPIs are being weighted more heavily in due diligence, with some lenders already building operational risk triggers into financing terms. 

Operators should also review their insurance position. Where a cyber incident causes damage to physical hardware, for example because equipment is destroyed by a compromised cooling system, the loss may fall into the gap between property and cyber policies, with neither responding clearly. Identifying and closing those gaps should form part of any compliance review.

On the contractual side, operators should review supplier agreements to ensure they address incident response coordination and regulatory notification, and review customer contracts and SLAs in light of the Bill's requirement to notify affected customers following an incident.

At the time of writing (September 2026), the Bill is still making its way through the House of Lords. Certain measures are due to take effect on or shortly after Royal Assent; others will follow through secondary legislation, with a transition period anticipated before duties are actively enforced, according to a Government policy paper.

Operators should be:

• assessing now whether they fall within scope (by reference to the MW thresholds)
  
  
• reviewing their existing cyber security and incident response frameworks
  
  
• engaging with their supply chains to understand where vulnerabilities lie
  
  
• reviewing their insurance position

Those who treat early preparation as an investment will be better placed, both commercially and legally, when the new framework comes into force.